AuthorizeAttribute with Roles but not hard-coding the Role values

Question

Is it possible to add the Roles but not hard-coding the values like:

[Authorize(Roles=\"members, admin\")]

I would like to retrieve these r

Answer 1

One solution would be to create an intermediate entity called "Group" where users are added to groups (eg: Admin, Support) and groups have set of Roles. (eg: Create users). This way you can hard code the Roles and configure the relationships between users and groups.

You would need to implement a custom Role Provider. Go through Implementing a Role Provider On MSDN

[Authorize(Roles="CreateUser")]
public ActionResult Create()
{

}

Answer 2

You can create your custom authorization attribute, that will compare user roles and roles from your configuration.

public class ConfigAuthorizationAttribute: AuthorizeAttribute
{
    private readonly IActionRoleConfigService configService;
    private readonly IUserRoleService roleService;

    private string actionName;

    public ConfigAuthorizationAttribute()
    {
        configService = new ActionRoleConfigService();
        roleService = new UserRoleService();
    }

    protected override void OnAuthorization(AuthorizationContext filterContext)
    {
        actionName = filterContext.ActionDescription.ActionName;
        base.OnAuthorization(filterContext);
    }

    protected override bool AuthorizeCore(HttpContextBase httpContext)
    {
        var availableRoles = configService.GetActionRoles(actionName); // return list of strings
        var userName = httpContext.User.Identity.Name;
        var userRoles = roleService.GetUserRoles(userName); // return list of strings
        return availableRoles.Any(x => userRoles.Contains(x));
    }
}

I hope it helps you.