Question: I am relatively new to MVC, and have just come across some pre-existing code. 

We have a UserService, which mainly contains CRUD operations, and perhaps, one or two business logic operations - all needed by our controllers. It encapsulates the context and the Membership. 

I was about to implement the ResetPassword operations, but I was not sure where to implement it; whether to implement it at the UserService or at the User Entity. 

---

*UserService*

```
bool ResetPassword(string username, string newPassword);

```

This would lead to my controller being:

```
ActionResult ResetPassword(string username, string newPassword)
{
  userService.ResetPassword(username, newPassword);
}

```

vs

*User*

```
bool ResetPassword(string newPassword)

```

This would lead to my controller being:

```
ActionResult ResetPassword(string username, string newPassword)
{
  var user = userService.GetUser(username);
  user.ResetPassword(newPassword);
}

```

Which approach is recommended?

Answer: 
Modularize the application and deploy to each client only those parts that he wants/has access to. There's many ways to do it (the most complete but heavyweight being OSGi), but the specifics depend on your circumstances and requirements. 

The quickest way to implement it might be to simply extract your extra functionality in separate JARs, and on deployment update the classpath appropriately.
It depends on the kind of application,kind of security you want and the number of people likely to use the application.

If the number of clients is not that big you can store their preference in some in memory data structure like a Map . Otherwise you can use file system or a DB depending upon the kind of security you want.