How do I allow multiple roles to see a page when using a custom RoleProvider in ASP.Net

Question

I have created my own Role Provider because I found the one that ASP.Net provides to be way too bulky in terms of tables in the database. I found implementing a custom RoleProvider to be quite easy.

My only problem is that right now I cannot have multiple roles for a page. I saw somewhere that at the top of your class you need to "anotate it" with some security code. This is what I have

[PrincipalPermission(SecurityAction.Demand, Role="Admin")]

If I try to include multiple roles by using a comma separated list I get errors. If i try to specify multiple role keys then I also get errors. Do i Need to specify multiple PrinicipalPermissions by any chance?

I have very little experience with ASP.Net's role management. Can someone point me in the right direction or at some good literature.

Answer 1

Hi, you can add the PrinicpalPermission attribute multiple times.

[PrincipalPermission(SecurityAction.Demand, Role="Admin")]
[PrincipalPermission(SecurityAction.Demand, Role="AnotherRole")]

Answer 2

Question:

Are you trying to require multiple "AND" roles (You must have both role a and b assigned to do this), or are you trying to impliment multiple "OR" roles (Any of these roles is acceptable).

If it's an AND, you can do it with multiple filters

[System.AttributeUsage(System.AttributeTargets.Method | System.AttributeTargets.Interface | System.AttributeTargets.Class, AllowMultiple = true)]
public sealed class PrincipalPermission: ActionFilterAttribute, IAuthorizationFilter

The key element above is AllowMultiple, which lets you do this:

[PrincipalPermission(SecurityAction.Demand, Role="Admin")]
[PrincipalPermission(SecurityAction.Demand, Role="Programmer")]
public ActionResult MyPage()

If it's OR, then you'll either need to do it with one filter (pass an array of role strings), or use a derived controller with some logic such to the effect that the filters don't actually block access, they only set an "Allowed" flag in the controller to true if any one of the roles is ok. The controller would then need to check the flag before proceeding further.