title: Implementing role-based authorization using .NET MVC 5
body: <p>I would like to implement a role-based authorization in my web application that I'm building. The way I imagined to make this is to create 3 tables in my DB like following:</p>
  
  <pre><code>1. Roles
  2. UserRoles (many to many table)
  3. Users 
  </code></pre>
  
  <p>After that each user would have a role assigned to him. Now... My question is, How do I permit or forbid access to specific views/controllers inside my .NET MVC application. I've stumbled upon this:</p>
  
  <pre><code>[Authorize(Roles = "HrAdmin, CanEnterPayroll")]
  [HttpPost]
  public ActionResult EnterPayroll(string id)
  {
      //  . . . Enter some payroll . . . 
  }
  </code></pre>
  
  <p>The Authorize property seems to be limiting the specific controllers/actions to specific roles... But what if I read the user roles from the table UserRoles like in my case?? How is my application gonna know what role does the User have on the system ??</p>
  
  <p>Can someone help me out with this ?</p>