How do I profile security with Asp.Net MVC?

Question

I am creating a system using Asp.Net MVC and before I start I need to do profile-based security. I’ll have multiple profiles each with an access option. For example: Admin Profile (access all), Common Profile (restricted access), Advanced Profile (some administrative access), etc.

I thought to create the profile and create the modules (methods or controllers) for the profile and through a true/false Boolean give permissions to the profile and then put the profile to the user, this would be the simplest way to do it. However, I don’t know how to do this by checking whether the method/controller is allowed or not by the profile to have access as for example to lower an account q would be just the Admin profile that could do, or as a low sale that the Advanced Profile could Fz tbm along with the Administrator.

How to do that ? What do you suggest ?

Answer 1

Thinking of a very simple solution you could use the Filter of ASP.NET.

Database

You can have 3 tables, one of users, another of profile, and another user profile.

Controller

You will annotate your classes or methods with the filter name, here you will tell which profiles will have access to the class.

[PerfilFiltro(Perfil = "Vendas")]

Filter class

Dai in the filter class, you will access the database to check whether or not the user has the profile to access the class.

public class PerfilFiltro : ActionFilterAttribute { 
     public override void OnActionExecuting(ActionExecutingContext filterContext)
     {
        if (!filterContext.ActionParameters.ContainsKey(Perfil))
        {
            string Usuario = filterContext.HttpContext.Session["NomeUsuario"].ToString();

            // o parâmetro Perfil é o perfil anotado na classe

            // use sua logica para buscar o perfil vinculado a este usuario
            // caso ele não tenha acesso você pode redireciona-lo para uma 
            // pagina de erro/ou sem permissão.
        }
     }   
}