Authorize Attribute, filter by Roles AND just one other userID

Question

How can I include a user regardless of his role, dependent on a matching userID, and not always same user:

 [Authorize(Roles="Group1") AND userID=uniqueID]

Answer 1

You could write a custom Authorize filter (implement IAuthorizationFilter)

Your custom Authorize filter could take the userId as a parameter.

Something like

public class 
    YourAuthorizeFilterAttribute : AuthorizeAttribute,  IAuthorizationFilter
{
    public string UserId { get; set; }

    public void OnAuthorization(AuthorizationContext filterContext)
    {
        if(filterContext.HttpContext.User.Identity.Name != UserId && 
            !filterContext.HttpContext.User.IsInRole(base.Roles))
        {
            filterContext.Result = new RedirectResult("/Account/LogOn");
        }
    }
}

Then use your own filter like so

[YourAuthorizeFilter(UserId = "theuser", Roles ="Group1")]

Kindness,

Dan

Answer 2

You won't be able to do this with the default AuthorizeAttribute. You will need to extend AuthorizeAttribute with a custom class that adds the user behavior. Typically it uses named users, but you could provide an alternative. Normally if you supply both Users and Roles, it will require that the user be in the list of users and have one of the indicated roles.

public class UserOrRoleAuthorizeAttribute : AuthorizeAttribute
{
    public int? SuperUserID { get; set; }

    protected override bool AuthorizeCore( HttpContextBase httpContext )
    {
         if (base.AuthorizeCore( httpContext ))
         {
             var userid == ...get id of current user from db...
             return userid == this.SuperUserID;
         }
         return false;
    }
}

Used as:

[UserOrRoleAuthorize(Roles="Admin",SuperUserID=15)]
public ActionResult SomeAction() ...

Note that you could also add in some way of specifing where to look for the id for this action, .i.e.,

 Table="Admins",Column="AdminID",MatchProperty="Company",MatchParameter="company"

then put some code into the attribute to look up the value in the property table and column and comparing it to the specified RouteValue entry instead of hard-coding it.