Could I make dynamic render rely User Permissions in MVC 2 ?

Question

Hi. I make security system in mvc application. In MVC it must be done by AuthorizeAttribute and roles string via actions methods.

Could i make this stuff: instead of action resolve I want to make view where html parts are hidden depend on current user permission set (For example: save button are not visible if user not Administrator).

Answer 1

Brian - i don't think this is a good idea to 'hide' the admin parts. you basically then just expose to logic to anyone opening the html in 'view source' mode. it would be better to have an admin view and a 'normal' view and just do a case statement in the contoller action to deliver the appropriate view where required (still not the best option, but far better than hiding fields). better still, have a master view that contains partialviews which are only rendered if it's the correct user type etc..

just my 'view' on the topic.. jim

Answer 2

You can do either A or B

a) Create partial views for the various elements that change and do something like

<% if (HttpContext.Current.User.IsInRole("Administrator"))
   {
      Html.RenderPartial("AdminStuff");
   }
   else
   {
      Html.RenderPartial("RegularStuff");
   }
%>

b) Set the role in your viewdata/viewmodel and use it in the code (not recommended as the view should really contain no logic)

In the controller

ViewData["Admin"] = HttpContext.Current.User.IsInRole("Administrator");

In the view

<% if ((bool)ViewData["Admin"]) { %>
    <!-- Show admin stuff  -->
<% } %>

Answer 3

Within your views, you can do conditional checks, such as:

<% if (User.IsInRole("Admin")) { %>
    <a href="#">An Admin-only link</a>
<% } %>

In partial views, the User property is not exposed, but you can still do it:

<% var user = HttpContext.Current.User; %>

<% if (user.IsInRole("Admin")) { %>
    <a href="#">An Admin-only link</a>
<% } %>

Answer 4

Thanks to all for your answers. I see that view dynamic render is a bad practic in mvc applications. I'm used to think that there can be some libraries or templates.

BTW When i told to my PM that a string with roles is a common pattern he sad "Hard code!!!!". Now I'm designing some WCF service with will be an "Aplication Authoriser" ))).

Answer 5

Everyone here seems to forget that there is css for such stuff. You can do the thing you want very easily, at least I am doing at already, and it's working flawlessly.

Let me give you a simple example

1. Make sure your operations buttons/regions have defined css classes

css class: MODULE-OPERATION

e.g. Module User Operations: Add, Edit, Delete, List

<a href="/user/add" class="USER-ADD">Add User</a>

1. Whenever changing (adding/updating/deleting) roles, you generate a css file for each role e.g. You decide that only administrators can add users so this css is generated

   //admin_css.css

   .USER-ADD { display: none; }

2. Everytime the page is opened you check what role the user has, and based on the role, you load the css file in you header. So your gui correlates to the logic you have in your application without so much hassle.