Showing posts from June, 2009

Asp.Net Forms Authentication with Groups and Roles

I found this great post from Rob Convery on creating a FilterAttribute that can be used to authorize specific controller actions against roles. I’d always wanted to implement a Group strategy and had made several attempts. They all seemed like kluges and I was never really happy. One small change to Rob’s code and I can do grouping in a simple manner. Note: If you have a large number of roles and groups, this will probably not work for you. Also, this uses Asp.Net MVC. ok, Rob’s code basically checked for a single role and you could use a constant to supply the role name. Something like [RequiresRoleAttribute(RoleToCheckFor = ApplicationRoles.AdminRole)] public ActionResult Edit( int id) My change just allows you to pass more than one role into RoleToCheckFor.  Basically, I split RoleToCheckFor using a comma. [RequiresRoleAttribute(RoleToCheckFor = ApplicationRoles.ChangeClientsGroup)] public ActionResult Edit( int id) The ApplicationRoles class looks like this