ASP.Net MVC & Membership
I would really appreciate some feedback on what I am trying to achieve:
Problem:
- I would like to authorize the user of my application for one action on the controller. For example, a user can perform a "save" action on my controller class if they have the required authorization.
- In a project I am working on, role creation and authorization is done by the client deployment team, not under my control. So, I am programming a "checkpoint" that can be assigned to a role / user, while my application only needs to check this checkpoint.
- How do I get the concept of a breakpoint in ASP.Net MVC? More specifically, how do I enable / disable buttons in the view based on custom permissions on the controller?
My decision:
- Ref .: http://weblogs.asp.net/fredriknormen/archive/2008/03/12/asp-net-mvc-framework-2-interception-and-creating-a-role-action-filter.aspx - in as a starting point
- Instead of creating a role filter as described in the link above, I will have a ControlPointFilter class that will receive the model and check for authorization.
- I have an issue in the View class and I am currently passing a collection of breakpoints that the user has access to in the ViewData [] collection.
- In the View class I check if the associated breakpoint is present in the ViewData collection (which I don't like - I want the code to be minimal in the View class)
- Another problem, if the actual breakpoint name is given in an attribute for the controller class, where / how can I pass those attributes to the view and still keep the view clean?
Hope it helps and appreciates your time / effort to answer this!
Solar
a source to share
One possible solution for this is to translate breakpoints into view attributes into actions in your controller (maybe these are the same things, although it is not clear from your question). The idea would be to translate your checkpoint into meaningful viewing directions like "AllowEdit", "AllowSave", "AllowDetailedView", etc. This will become the input to the ViewData.
Use the base controller class to extend the controller and provide it with a ControlPoint collection. Ask the filter to populate this collection in the controller. Ask the base controller's OnActionExecuted method to use this collection, and in the case of ViewResult, fill the ViewData with the appropriate values for the view directive collection. Individual controller actions can also use the ControlPoint collection to determine whether to provide data for individual views based on whether the view will provide additional data or not.
In your opinion, rely not on the breakpoints themselves, but on the view directions as defined by the underlying controller. This is how you decouple the views from the checkpoint logic. Views are only used to view data in ways that make sense for the view, not for permission-based data that makes sense in the context of the application. The view doesn't care how or why a particular directive is set, it only needs to display appropriately based on the directive's value.
a source to share
Hmm, could you just create a templating system to assign roles to users? That is, create a custom "Power User" template that has the roles "CustomerService" and "ConfigurationEditor" and then use the role system as normal (ie Roles.IsUserInRole (username, fieldname))?
For actions, you then use
[Authorized(Roles="CustomerService,CustomerServiceAdmin")]
public ActionResult Edit(...)
{
}
For views, you use
<% if (Roles.IsUserInRole(Context.User.Name, "CustomerService")) %>
a source to share