Every day after work, during dinner, our team will chat about what we have learnt, what we have done, and new project ideas. Today, I’d like to share with you one of our dinner topics about customizing authorization attribute in ASP .NET MVC5. [caption id=“attachment_21371” align=“aligncenter” width=“922”] Having dinner in airport transit area after work is enjoyable.[/caption] We’re now working on building a product management web application for a small company of around 100 employees. In the company, there are many teams, such as marketing, design, retail, product, advertising, and so on. One of the project requirements is thus to allow user logging in to the system with their own account. In ASP .NET MVC 5 project, by default, if individual user account is chosen as the authentication mode, ASP .NET Identity will use Entity Framework Code First to create a database and then store all the user information in a database. [caption id=“attachment_21378” align=“aligncenter” width=“756”] Individual User Account option in Visual Studio 2013[/caption] Role Based Access Control Normally, there will be five tables generated: AspNetUsers, AspNetUserRoles, AspNetRoles, AspNetUserLogins, AspNetUserClaims. With the help of the first three tables, we will be able to implement role-based authentication which we can restrict access to parts of our application by roles. How do we define roles? In some applications, the roles are super admin, manager, operator, agent, etc. For our case, the teams are the roles. So we will have one role for each individual team. After that, we can easily add all members in the team to the corresponding role. Then in our web application, we will be able to check if the current logged in user has the role to access or not by decorating our controllers with Authorize attribute as follows.
...