Search by name in ASP.NET Authorize Attribute - asp.net

Question

I am using ASP.NET Identity for Authorization, In the Role Table, I have roles like : 'Role 1','Role 2','Role 3','Role 4','Role 5','Role n'. It can be any numbers.
My requirement is that user having any of the role will be able to access the page.
[Authorize(Roles = "Role 1", "Role 2")] // In this example, Number of roles
//are known. But in my case, number of roles is not known.
public ActionResult Index()
{
return View();
}
Is there any way I can search for keyword "Role" only? Like SQL "%Role%" query.

Answer 1

AuthorizeAttribute does not have this feature, but you can derive a class from it and implement it yourself.
You can use this code
public class CustomAuthorizeAttribute : AuthorizeAttribute
{
public string RolePattern { get; set; }
protected override bool AuthorizeCore(HttpContextBase httpContext)
{
if (!base.AuthorizeCore(httpContext))
{
return false;
}
IPrincipal user = httpContext.User;
if (!user.Identity.IsAuthenticated)
{
return false;
}
ClaimsIdentity claimsIdentity = (ClaimsIdentity)user.Identity;
string[] roles = claimsIdentity.FindAll(claimsIdentity.RoleClaimType).Select(claim => claim.Value).ToArray();
if (!string.IsNullOrEmpty(RolePattern) && !roles.Any(role => Regex.IsMatch(role, RolePattern)))
{
return false;
}
return true;
}
}
And Add CustomAuthorize on your action
[CustomAuthorize(RolePattern = "^[a-zA-Z0-9]*Role[a-zA-Z0-9]*$")]
public ActionResult Index()
{
return View();
}

Answer 2

There's a way. If you want to authorize this Action with any role, you can just use [Authorize] without specifying the roles.
Another way is to create a static class with the roles as constants.
For example:
public static class RoleConstants
{
public const string RoleOne = "Role 1";
/////the other roles here
}
And outside of this class or even inside the class, you can define a static string to include the roles you want to use in the Authorize attribute:
public static string ALLROLES = RoleOne + "," + //other roles;
And in your [Authorize] attribute you can use:
[Authorize(Roles = RoleConstants.ALLROLES)]
public ActionResult Index()
{
return View();
}
But in your situation, I would recommend you to use my first example. Just the [Authorize] attribute without specifying the roles.