.net MVC 4 Authorization (Membership)

Question

During my first steps in .NET MVC 4 I'm creating a web site and I would like to implement users authentication/authorization.

In my implementation I would like to be able to link controls to roles. For example, if I have 2 Roles in my system : Admin and User, the in some view say I have 3 inputs:

            <input class="search-field rounded" id="field1" type="text"/>
            <input type="submit" name="submit"/>

            <input class="search-field rounded" id="field2" type="text"/>
            <input type="submit" name="submit"/>

            <input class="search-field rounded" id="field3" type="text"/>
            <input type="submit" name="submit"/>

I would like that an Admin will be able to see and edit all 3 fields in this view, but a User should only see 2 of them, and be able to edit one of them (this is just an example).

So basically, I would like to be able to define permissions for controls, and a role should be consisted of a collection of permissions (If you can think of a better approach I would love to hear it).

So those are my constraints, and I see quite a few packages out there (such as Fluent Security, and Security Guard) that relates to the subject, but I'm not quite sure which is best to tackle my challenge if at all.

Is there a best practice to overcome this demand?

Any help is highly appreciated.

Answer 1

I ended up creating my own custom membership provider and role provider.

In my Role Provider I added a method

public bool UserHasPermission(string username, string permission) {...}

And in my view I'm doing:

@{
    var roleProvider = Roles.Provider as MyCustomRoleProvider;
    bool addressEditPermission = roleProvider.UserHasPermission(User.Identity.Name, "addressEditPermission");
}

Then I can manipulate my control:

@Html.TextBoxFor(model => model.Name, new { @readonly = addressEditPermission })

You just need to make sure your control has overloads that take HTML attributes.

I hope this helps someone..