Hide different options (actions) for different user profiles

Question

I am in a project where I have 3 different levels of profiles: Administrator, Professor and Coordinator. I already have the login module, registration and such.

What happens is that I wanted for each type of profile to appear only what it is allowed, hiding the parts of the system that it cannot access according to its hierarchy.

This is direct on view? If it is, how do you do it?

Answer 1

Whereas your project uses at least Membership or ASP.NET Identity, write down on top of each View the following attribute:

[Authorize(Roles = "Administrador, Professor, Coordenador")]
public ActionResult MinhaAction() { ... }

To authorize any user on Role, use the following command somewhere in your code:

Roles.AddUserToRole("LoginDoUsuario", "Administrador");

To check in your code if the user belongs to any Role, use:

if (User.IsInRole("Administrador")) { ... }

To remove the user from a Role, use:

Roles.RemoveUserFromRole("LoginDoUsuario", "Administrador");

For Views, the principle is the same:

@if (User.IsInRole("Administrador")) { ... }

To verify the Roles of the current user:

@Roles.GetRolesForUser()

Or a specific user:

@Roles.GetRolesForUser("LoginDoUsuario")

By the way, you can use the attribute without specifying Role only to verify that the user is logged in:

[Authorize]
public ActionResult MinhaAction() { ... }

If no authentication scheme is specified, your application will use the SimpleMembership if it is MVC4 or ASP.NET Identity with Basic Authentication if it’s MVC5.

As stated, it is possible to customize the authentication scheme by reimplementing some classes. In any case, this part would already serve for another question.

Answer 2

Another possible situation would be, to have different profiles, create partitals corresponding to each user profile that exists in the system. That is, if you have 3 different profiles, separate the system into areas and decorate the actions with the possible permissions, according to your system and then each profile accesses only your area.
In short, create an action that returns a specific partial to that type of profile. This solves any problem with permissions, because each profile can only access what is allowed, what is not, not access !
To create these permissions can be used as a basis this link here as a basis for doing this operation, which is even another question of mine.

I hope I’ve helped !