ASP.NET MVC Membership: how can I create/configure it?

Question

Hi everyone!

I'm having a huge problem in understanding Membership with MVC. We have in our project controllers named "Admin" and "SuperAdmin" and they are restricted to some users.

Do I have to use the Authorize Roles attribute on each Action or can I use a ActionFilter to check if an user can view a certain page?

And if I have to user Roles attribute, do I have to configure each user on the ASP.NET Configuration tool? For example, "SuperAdmin" will be only a few users (around 3 at top), making easy to use ASP.NET Configuration tool and tells it who these users are. But "Admin" users will be many more... how can I configure them?

I'm totally lost!

I need a great clarifying on that!

Thanks a lot!!!

Answer 1

You can apply the AuthorizeAttribute to controllers as well as actions. If you apply it to the controller, each method will have its access restricted with respect to the attribute. You can also apply another instance of the attribute to individual actions to further restrict access if necessary based on other roles. You will need to put the individual users in their roles for them to have access to role-controlled controllers/actions.