title: Simple yet Dynamic MVC Authentication & Role Bases Access
body: <p>I've recently migrated from traditional ASP.Net web-form based development to MVC2 and I've been looking for the best practices and norms that MVC can leverage to create a long-term maintainable web solution.</p>
  
  <p>I've arrived at the implementation of Authentication and RBAC(role based access). I had simple static RBAC in past to avoid complexity but now with MVC I expect better options and more control over the traditional approach. Membership APIs have been a default for ASP.Net security but it needs many DB objects and it also didn't had easy way to altering its behavior like adding properties to User or overriding some of its default features.</p>
  
  <p><strong>To summarize</strong>, in past I had to avoid the Membership API and go with my own simple Userservice layer approach to achieve simple security &amp; RBAC. I had page level access-control and I handled it from within a base-class (Pagebase) from which all the web-form pages were derived. I just had to pass some role parameters to configure security for a page. Our user and role maintenance are pretty simple and I don't need things like security question, hash-password, salt, etc.. atleast not till now.</p>
  
  <blockquote>
    <p>Now, with MVC - I need something similar with 
    central control. I can have either
    Controller level and/or Action level
    authorization([Authorize] or my
    custom). I can deploy 'Authorization
    filter'(like action filter). I'm also
    want to go for a dynamic RBAC. I want
    to use the Membership features but I
    don't want its tables and avoid other
    extra things mentioned above.</p>
  </blockquote>
  
  <p>Static Membership API based approach: <a href="https://stackoverflow.com/questions/1356102/role-based-security-asp-net-mvc">Role based security asp.net mvc</a></p>
  
  <p>I've learned that I can <strong>override the Membership provider as well as the Role Provider</strong> to gain total control of the background processing and leverage the features of Membership API and RBAC that sit on top of it.</p>
  
  <p>For example, </p>
  
  <blockquote>
    <p><strong>Custom Membership Providers</strong></p>
    
    <ul>
    <li><a href="http://www.codeproject.com/KB/aspnet/CustomMembershipProviders.aspx" rel="nofollow noreferrer">http://www.codeproject.com/KB/aspnet/CustomMembershipProviders.aspx</a></li>
    <li><a href="http://mattwrock.com/post/2009/10/14/Implementing-custom-Membership-Provider-and-Role-Provider-for-Authinticating-ASPNET-MVC-Applications.aspx" rel="nofollow noreferrer">http://mattwrock.com/post/2009/10/14/Implementing-custom-Membership-Provider-and-Role-Provider-for-Authinticating-ASPNET-MVC-Applications.aspx</a></li>
    </ul>
    
    <p><strong>Implementing a Role Provider</strong>  </p>
    
    <ul>
    <li><a href="http://msdn.microsoft.com/en-us/library/8fw7xh74.aspx" rel="nofollow noreferrer">http://msdn.microsoft.com/en-us/library/8fw7xh74.aspx</a></li>
    <li><a href="http://msdn.microsoft.com/en-us/library/tksy7hd7.aspx" rel="nofollow noreferrer">http://msdn.microsoft.com/en-us/library/tksy7hd7.aspx</a></li>
    </ul>
  </blockquote>
  
  <p>I've come all this way and I want to make sure that I'm on the right path and that the approach will gradually lead me to dynamic RBAC which I can expose to Admin level users to configure RBAC. Here're my requirements -</p>
  
  <ol>
  <li>I hope using Membership API will be worth with MVC and allow me to override its default implementation.</li>
  <li>I don't want any extra tables. I want to keep it to minimal User/Role tables wihtout unwanted special fields.</li>
  <li>I can use my own Service layer approach to access and manage tables in DB - no Membership defaults.</li>
  <li>If too complex I can do with static RBAC for now but in future I want to have a dynamic RBAC.</li>
  <li>I'm inclined to use Membership API only because I see it can provide useful attributes which otherwise I'd have to deploy myself.</li>
  <li>Hope it won't get messy, follow my DAL/service layer and allow controller level &amp; action level RBAC.</li>
  </ol>
  
  <p>Pls guide me and share your suggestions.</p>
  
  <hr>
  
  <p><strong>EDIT 1:</strong>
  I found some more from SO: (says to roll out our own)</p>
  
  <ul>
  <li><a href="https://stackoverflow.com/questions/757452/which-authentication-and-authorization-schemes-are-you-using-and-why">Which authentication and authorization schemes are you using - and why?</a></li>
  <li><a href="https://stackoverflow.com/questions/4837103/asp-net-mvc-alternative-to-role-provider">ASP.NET MVC - Alternative to Role Provider?</a></li>
  </ul>