ASP NET MVC authentication

Question

What better way to separate permissions for logged in users? Would it be using annotations and roles? Because I want to release certain pages and certain functions depending on the permission of the logged in user.

Someone could better inform me how it could be done and if you have any example.

The permission table I have in the database is a table with an ID and a Name only, ai in the user table has a field that gets the name of the permissions separated by comma.

Answer 1

Basically, by writing your own authorization attribute. For example:

[AttributeUsage(AttributeTargets.Method | AttributeTargets.Class, Inherited = true, AllowMultiple = true)]
public class MeuAuthorize : AuthorizeAttribute
{
    private String[] _permissoes;
    private MeuProjetoContext contexto = new MeuProjetoContext();

    public CustomAuthorizeAttribute(params String[] permissoes) 
    {
        _permissoes = permissoes;
    }

    protected override bool AuthorizeCore(HttpContextBase httpContext)
    {
        var baseReturn = base.AuthorizeCore(httpContext);

        var permissoesReturn = false;
        var permissoesUsuario = contexto.Permissoes.Where(p => p.Usuario.Nome == httpContext.User.Identity.Name).Select(p => NomePermissao).ToList();
        permissoesReturn = permissoesUsuario.Intersect(_permissoes.OfType<String>().ToList()).Any();

        return permissionsReturn || baseReturn;
    }
}

Use:

[MeuAuthorize("Usuário", "Gerente", "Administrador")]
public ActionResult MinhaAction() { ... }

Can be used without parameters, just to check if you are logged in:

[MeuAuthorize]
public ActionResult MinhaAction() { ... }