I use a custom AuthorizationFilter like the followings:
public class ActionAuthorizeAttribute : AuthorizeAttribute {
protected override bool AuthorizeCore(Syste
> namespace dene.kontroller {
> public class daAttribute: AuthorizeAttribute
> {
> private Entities db = new Entities();
> private readonly string[] allowedroles;
> public daAttribute(params string[] roles)
> {
> this.allowedroles = roles;
> }
>
>
> protected override bool AuthorizeCore(HttpContextBase httpContext)
> {
> bool authorize = false;
> foreach (var role in allowedroles)
> {
> if (role == HttpContext.Current.User.Identity.Name)
> {
>
> if (role!= null)
> {
> authorize = true;
> }
> }
>
>
> }
> return authorize;
> }
>
>
> protected override void HandleUnauthorizedRequest(AuthorizationContext filterContext)
> {
>
> FormsAuthentication.SignOut();
> filterContext.Result = new HttpUnauthorizedResult();
> }
>
> } }