title: Customizing authorization in ASP.NET MVC
body: <p>My Controller class is decorated with an AuthorizeAttribute to protect the actions:</p>
  
  <pre><code>[Authorize(Roles = "User Level 2")]
  public class BuyController : Controller
  {
      ...
  }
  </code></pre>
  
  <p>Anytime an action is invoked, but the user is not in at least the role "User Level 2", the user is automatically redirected to the login page with a URL like this:</p>
  
  <p><a href="http://localhost:1436/Account/Login?ReturnUrl=%2fBuy" rel="nofollow noreferrer">http://localhost:1436/Account/Login?ReturnUrl=%2fBuy</a></p>
  
  <p>If the user is already logged in, but doesn't have the right security level, this is not an optimal behavior! It would make more sense to display a page which informs the user about the missing level instead of showing the login page.</p>
  
  <p>What can I do to customize this behavior?</p>
  
  <p>Is it possible to pass the required user level to the Login action somehow?</p>