Custom Role Module in mvc3

Question

0.00/5 (No votes)

See more:

hi, I am new in mvc3.
I will want to use multiple role based system. so i have create table 3 table for this user_master (user_id,user_name),
role_master(role_id,role-name),
role_to_user(role_id,user_id),
and i will create custom role module and i will get all user role but now how can i check this role. give me sample example for multiple role assign to one user and access view as per role.
for example user id 1 has role id:1,5,7,9.
and will check condition in view like this

<%if (User.IsInRole("delete role"))
{ %>
<button id="feedback-open-button" class="buttonStyle1" >New Company</button><% } %>
Thank you.

Posted 17-Apr-12 20:46pm

anilkumar_pandya

Add a Solution

1 solution

Add a Solution

Add your solution here

Treat my content as plain text, not as HTML

Preview 0

…

Existing Members

Sign in to your account

...or Join us

Download, Vote, Comment, Publish.

Your Email
Password
Forgot your password?

Your Email
This email is in use. Do you need your password?
Optional Password

I have read and agree to the Terms of Service and Privacy Policy
Please subscribe me to the CodeProject newsletters

When answering a question please:

Read the question carefully.
Understand that English isn't everyone's first language so be lenient of bad spelling and grammar.
If a question is poorly phrased then either ask for clarification, ignore it, or edit the question and fix the problem. Insults are not welcome.
Don't tell someone to read the manual. Chances are they have and don't get it. Provide an answer or move on to the next question.

Let's work to help developers, not make them feel stupid.

This content, along with any associated source code and files, is licensed under The Code Project Open License (CPOL)

Keith Barrow · Accepted Answer · 2012-04-17T23:16:00

OK. First I strongly suggest that you don't hand-roll this. Getting security right is very hard, even for an experienced hand.

You can continue to use the default providers that were available in ASP.NET (forms) applications. The main difference is that in MVC3 it is better to secure the action methods in code rather than paths in the Web.config (for instance the action can be called from very different URLs, depending on your ~~schemer~~schema).

.Net comes with a default provider for Sql (and many other backing-stores). The database can be registered with aspnet_regsql, so you don't need to create your own schema. You can also subclass the default providers (or write your own) if you want something other than the default behaviour.

Here are some resources for "classic" asp.net:
http://weblogs.asp.net/scottgu/archive/2006/02/24/ASP.NET-2.0-Membership_2C00_-Roles_2C00_-Forms-Authentication_2C00_-and-Security-Resources-.aspx[^]

ASP.NET Membership and Role Provider[^]

You config the membership and roles providers up just as yuo would for a vanilla ASp.NET, except for securing the paths. To secure an Action Method you decorate with authorize attributes:

[Authorize(Roles="RoleNameHere")]
public ActionResult Foo()
{
   ....
}

Note that the Authorize can also take Users="Usernamehere" and complex role trees can be built up if needed. Also your Razor if (User.IsInRole("delete role")) will work.

If you need to try this quickly, create an new MVC3 Internet application. Run ASPNET_regsql against your database and configure you system to use that database. Detailed instructions can be found here[^]

[Edit]
Fixed a spelling mistake that was too egregious to ignore. I now need to check the word egregious in the dictionary.