Custom Authentication and Authorization for different user types in asp.net mvc - asp.net

Question

I’m working on a project where there are different three user types (Admin, Parent, and Teacher) that access the website. The users log in by providing their credentials and selecting their type as shown the image below
I wanted to provide a custom authentication and authorization for the users. By using the methods in this tutorial, I extended MemberShipProvider class for each user type and overrode the ValidateUser method and ended up with three classes named AdminAuthProvider, ParentAuthProvider and TeacherAuthProvider. Here is the code in the ValidateUser method in AdminAuthProvider
public override bool ValidateUser(string username, string password)
{
if (string.IsNullOrEmpty(username) || string.IsNullOrEmpty(password))
{
return false;
}
using (var db = new pscsEntities())
{
return db.Admins.Any(admin => admin.username.Equals(username) && admin.password.Equals(password));
}
}
The code for ValidateUser in the other two classes is the same.
My Questions are
- Is there a better way of doing the authentication in a single class rather than three classes which extend the same classes?
- How can I provide authorization roles in this scenario?
For the second question, the above tutorial suggests extending the RoleProvider class and overriding its methods. What I can’t seem to figure out how to override the GetRolesForUser method as it only takes a single string parameter which is the username of the currently logged in user. I’m a bit confused here.
If it helps here is the table diagrams for the three users in the database

Answer 1

Your solution seems to conflate two related but distinct functions: authentication and authorization.
Authentication tells you who the user is. Authorization normally occurs after authentication and tells you what the user can do, typically expressed as a list of one or more roles. Under this traditional model, you would have a single table for all three types of users and only one means of authenticating them. Once authenticated, the database will tell you what kind of roles the user has (teacher, student, or admin). Based on the roles, the web site would expose different feature sets.
Under your model, the expression of the user's roles is wound up in the authentication process. Indeed, the user himself tells you his roles as part of the authentication process. This is unusual design and is brittle for a number of reasons. For example, imagine a new type of user role (for example "teacher's assistant.") Given your current design you'd have to add a fourth DB table and domain object management functions for the new table, as well as a fourth wrapper class for the authentication code. Your design also precludes users who have more than one role (what if I'm both an admin and a teacher?)
I would suggest you revisit this design and allow the user to provide only user name and password and allow the system to determine if he is a student, teacher, or admin, or some combination of these. With this design you would need only one authentication class and GetRolesForUser would make a lot more sense.