Custom RoleProvider, Authorization, EF DB First and ASP.NET

Question

how to make Custom RoleProvider, Authorization and ASP.NET MVC

Ankusha Rana · Answer

My solution was to create a custom role provider. Here are the steps I took, in case anyone else needs help later: Create your custom user and role classes using Microsoft.AspNet.Identity.EntityFramework; using System; using System.Collections.Generic; using System.Linq; using System.Web; namespace Security.Models.Security { public class AppRole : IdentityRole { } } and using Microsoft.AspNet.Identity.EntityFramework; using System; using System.Collections.Generic; using System.Linq; using System.Web; namespace Security.Models.Security { public class AppUser : IdentityUser { } } Set up your database context using Microsoft.AspNet.Identity.EntityFramework; using Security.Models.Security; using System; using System.Collections.Generic; using System.Data.Entity; using System.Linq; using System.Web; namespace Security.Models.DAL { public class UserContext : IdentityDbContext { public UserContext() : base("UserContext") { Database.SetInitializer (new CreateDatabaseIfNotExists ()); } } } Create your role provider and implement the following methods using Security.Models.DAL; using System; using System.Collections.Generic; using System.Linq; using System.Web; using System.Web.Security; namespace Security.Models.Security { public class AppRoleProvider : RoleProvider { public override string[] GetAllRoles() { using (var userContext = new UserContext()) { return userContext.Roles.Select(r => r.Name).ToArray(); } } public override string[] GetRolesForUser(string username) { using (var userContext = new UserContext()) { var user = userContext.Users.SingleOrDefault(u => u.UserName == username); var userRoles = userContext.Roles.Select(r => r.Name); if (user == null) return new string[] { }; return user.Roles == null ? new string[] { } : userRoles.ToArray(); } } public override bool IsUserInRole(string username, string roleName) { using (var userContext = new UserContext()) { var user = userContext.Users.SingleOrDefault(u => u.UserName == username); var userRoles = userContext.Roles.Select(r => r.Name); if (user == null) return false; return user.Roles != null && userRoles.Any(r => r == roleName); } } } } Edit your web.config to set up the database connection and role provider reference and ... ... In package manager console, enable migrations enable-migrations In the newly created Configurations.cs set up the user/role stores and managers and configure the user manager validator to accept '\' characters namespace Security.Migrations { using Microsoft.AspNet.Identity; using Microsoft.AspNet.Identity.EntityFramework; using Security.Models.Security; using System; using System.Data.Entity; using System.Data.Entity.Migrations; using System.Linq; internal sealed class Configuration : DbMigrationsConfiguration { public Configuration() { AutomaticMigrationsEnabled = true; ContextKey = "Security.Models.DAL.UserContext"; } protected override void Seed(Security.Models.DAL.UserContext db) { // Set up the role store and the role manager var roleStore = new RoleStore (db); var roleManager = new RoleManager (roleStore); // Set up the user store and the user mananger var userStore = new UserStore (db); var userManager = new UserManager (userStore); // Ensure that the user manager is able to accept special characters for userNames (e.g. '\' in the 'DOMAIN\username') userManager.UserValidator = new UserValidator (userManager) { AllowOnlyAlphanumericUserNames = false }; // Seed the database with the administrator role if it does not already exist if (!db.Roles.Any(r => r.Name == "Administrator")) { var role = new AppRole { Name = "Administrator" }; roleManager.Create(role); } // Seed the database with the administrator user if it does not already exist if (!db.Users.Any(u => u.UserName == @"DOMAIN\admin")) { var user = new AppUser { UserName = @"DOMAIN\admin" }; userManager.Create(user); // Assign the administrator role to this user userManager.AddToRole(user.Id, "Administrator"); } } } } In package manager console, ensure the database is created and seeded update-database Create a custom authorization attribute that will redirect to an access denied page on failure using System; using System.Collections.Generic; using System.Linq; using System.Web; using System.Web.Mvc; namespace Security.Models.Security { public class AccessDeniedAuthorizationAttribute : AuthorizeAttribute { public override void OnAuthorization(AuthorizationContext filterContext) { base.OnAuthorization(filterContext); if(filterContext.Result is HttpUnauthorizedResult) { filterContext.Result = new RedirectResult("~/Home/AccessDenied"); } } } } You're done! You can now create an access denied page (in this case ~/Home/AccessDenied) and apply the attribute to any action, e.g. using Security.Models.Security; using System; using System.Collections.Generic; using System.Linq; using System.Web; using System.Web.Mvc; namespace Security.Controllers { public class HomeController : Controller { ... [AccessDeniedAuthorizationAttribute(Roles = "Administrator")] public ActionResult SecureArea() { return View(); } public ActionResult AccessDenied() { return View(); } ... } } Hope this helps someone in the future. Good luck!