Data based entitlements/authorization in ASP.Net MVC 3

Question

My google skills are failing me on this. I'm looking for the "right way" to do data based entitlements in ASP.Net MVC (3).

With regular entitlements where one just need to know the user and the route can be done with the [Authorize] attribute, but this doesn't appear to work with data based entitlements b/c of the need to have a connection to the data store.

Is the obvious approach of inserting a check into the action methods the right way?

What is a "data based entitlement?" Do you mean "security" or "authorization?" Try looking for "table-based security in ASP.NET MVC". — Robert Harvey
– Robert Harvey, Commented May 23, 2011 at 0:15
stackoverflow.com/questions/1482135/custom-authorizeattribute — Robert Harvey
– Robert Harvey, Commented May 23, 2011 at 0:27

Robert Harvey · Accepted Answer · 2011-05-23 00:28:59Z

1

Is the obvious approach of inserting a check into the action methods the right way?

That's what I do.

if (!userHasAuthorization)
   return view("Unauthorized");

It's by far the simplest way.

To make sure you only have to do "userHasAuthorization" once, you can put a method in your repository or service layer that checks for authorization, and use that in place of the boolean value userHasAuthorization.

edited May 23, 2011 at 0:28

answered May 23, 2011 at 0:20

Robert Harvey

182k48 gold badges349 silver badges516 bronze badges

Sign up to request clarification or add additional context in comments.

Comments

Slappy · Accepted Answer · 2011-05-23 00:19:52Z

0

Without knowing what "data based entitlements" are. I do believe that custom action filters will get you what you want. This lets you manage whatever you need around authorization with having the context of the route, user, etc. Gives more fine grained control. Also gives you the re usability so you dont need to plug if statements into your action methods.

http://msdn.microsoft.com/en-us/library/dd381609.aspx

answered May 23, 2011 at 0:19

Slappy

4,1022 gold badges33 silver badges42 bronze badges

2 Comments

Robert Harvey Over a year ago

I think what he's asking is: How do you look up authorization values from the database without tightly coupling your custom AuthorizeAttribute to the database? It's something I've often wondered myself. The custom AuthorizeAttribute does not have access to your repository, but by the time you've already entered the Action Method, it is too late.

Slappy Over a year ago

Then I would go with this approach I mentioned here, the custom action filter lets you return before entering the action method.

Andrew Cooper · Accepted Answer · 2011-05-23 00:20:43Z

0

You could create a custom action filter derived from the [Authorize] attribute that uses the data store to check authorization.

answered May 23, 2011 at 0:20

Andrew Cooper

32.7k5 gold badges86 silver badges124 bronze badges

1 Comment

Scott Weinstein Over a year ago

Any specifics on how to do that - meaning, how does one give the MyAuthorize class an instance of IDBConnection ?

Collectives™ on Stack Overflow

Data based entitlements/authorization in ASP.Net MVC 3

3 Answers 3

Comments

2 Comments

1 Comment

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

3 Answers 3

Comments

2 Comments

1 Comment

Your Answer

Sign up or log in

Post as a guest

Linked

Related