asp.net mvc - MVC 4 - RoleProvider to manage authenticated users permissions with different scopes -

here problem mvc 4 internet project using forms authentication. lets have hotels , want authorized users accessing each under different roles.

so user logs in. dropdownlist selects target hotel , application´s security responds accordingly.

i need [authorize(roles = "administrator")] in hotel scope.

my first aproach inheriting authorizeattribute , override authorizecore shown in thread

from there httpcontext.session["hotelid"] , query userrolesinhotel table. said, should have own roles table structure similiar userid, roleid, hotelid. simpleroleprivider comes short task , forced create customeroleprovider. roleprovider methods don´t handle params need hotelid when adding new role user.

for clarification:

1. user logs in user/password ->ok (simplemembershipprovider)
2. authenticated user selects hotel 1 -> user "administrator" hotel 1.
3. authenticated user change hotel 2 -> user "user" in hotel 2

i can have number of hotels.

1. user -> hotel 1 -> { "administrator", "user"}
2. user -> hotel 2 -> { "user" }
3. user -> hotel 3 -> { "owner" }
4. user -> hotel 4 -> { "administrator" }

the list of roles same.

i´ve been struggling implementation couple of days , couldn´t come pratical solution. thougths appreciated.

thanks!

this did:

• added defaultbuildingid user profile.

• then created customroleprovider , overrided getrolesforuser method this

  public override string[] getrolesforuser(string username) {     if (httpcontext.current.session != null)     {         var user = _userrepository.getbyname(username);          if (!user.isactive)         {             throw new applicationexception(string.format("some message {0}", username));         }          if (httpcontext.current.session["buildingid"] == null)         {             var building = _buildingrepository.get(user.defaultbuildingid);             if (building == null)             {                 throw new applicationexception("error message");             }              httpcontext.current.session["buildingid"] = building.buildingid;         }          int buildingid = convert.toint32(httpcontext.current.session["buildingid"]);         return _userrepository.getrolesforuserinbuilding(user.userid, buildingid).toarray();     }      throw new applicationexception("error message."); } 

  • added custom authorizeattribute

    protected override bool authorizecore(httpcontextbase httpcontext) { var authorized = base.authorizecore(httpcontext); if (!authorized) {     return false; }  var repo = unitymanager.resolve<iuserrepository>(); var buildingid = (int)httpcontext.session["buildingid"]; var username = httpcontext.user.identity.name; var user = repo.getbyname(username); var userrolesinbuilding = repo.getrolesforuserinbuilding(user.userid, buildingid);  foreach (var role in roles.split(',')) {     if (userrolesinbuilding.contains(role.trim()))     {         return true;     } }  return false; 

    }

  • and how use @ controller or action level.

    [buildingathorize(roles = "administrators")]

i added ddl layout let user change building , set new buildingid overriding value @ session/db. way user can work in different hotels during same session , access areas , functionality has particular hotel.