Implementing Rights Using an ASP.NET Identifier

Question

We are currently working on a small ASP.NET MVC 5 application using ASP.NET Identity. This allows us to support different projects and their tasks. We recently implemented basic authentication so that we can register a user with our site and log in with them.

We want to be able to manage access rights based on the project, so that we can tell each user that he has read, written, administered, or did not have permissions for the specified project.

My first thought was that we can create a simple new table in our database that preserves user rights. But I feel that there may be a built-in way to achieve this using ASP.NET Identity.

So my question is which way should we follow - manually create a new table for administering rights or use something built-in provided by ASP.NET Identity.

Answer 1

use something built into ASP.NET Identity

The only things you could use are claims or roles, and both are not made for what you want IMO.

So, I would go with my own table, which associates the project with the user, for example:

public class UserProjectRights { [Key] public ApplicationUser User { get; set; } [Key] public Project Project { get; set; } public AccessRight Right { get; set; } } 

Then, whenever you perform certain actions when a certain right is required, you need to check it. There are several ways you could do this. In my application, I created "authorization extensions" as follows (I defined a common interface for all "access rights" to "reuse" this method):

 public static bool? CanView(this ApplicationUser user, Project project) { var userRight = project.Rights.FirstOrDefault(r => r.User == user); return userRight == null ? (bool?)null : userRight.Right.HasFlag(AccessRight.View); } 

Assuming AccessRight is an enum like:

 [Flags] public enum AccessRight { View, Edit, Admin } 

Then in your logic you can do something like the following:

 if (user.CanView(project) == true) { // show project } 

Did I use bool? , so I can implement different "default behavior", as I know, if null returned, then no right is defined.