title: How to override Authorize attribute in ASP.MVC 5 with multiple authorization conditions?
body: <p>I am implementing authorization/authentication in a MVC project. They problem I am facing is that there are many conditions for a login user like <code>roles</code>, <code>positions</code>, <code>permissions</code> and some others. I thought the best way is to override <code>AthorizeAttribute</code> and set all logic in there by passing the data as string arrays in constructor and validate them but I do have more than 100 permissions and more than 40 positions which makes this attribute almost useless because I can not write in every action for example 60 position etc.</p>
  
  <p>I thought I could group them somehow but I can see it is not a good point because all actions are dynamic and I would make tons of groups for <code>user permissions</code> and <code>user positions</code>. </p>
  
  <p>I red in some posts for creating a base controller to make all validations there but I am using ASP.NET Identity and I don`t like going in 'old' fashion way...</p>
  
  <p>If anybody had any situation like that before I would be grateful if you share your solution!</p>
  
  <p><strong>EDIT - Adding code example</strong></p>
  
  <pre><code>public class XAuthorizeAttribute : AuthorizeAttribute
  {
      public XAuthorizeAttribute() { }
  
      public XAuthorizeAttribute(params string[] roles)
      {
          Roles = string.Join(",", roles.Select(x =&gt; x));
      }
  
      protected override void HandleUnauthorizedRequest(AuthorizationContext filterContext)
      {
          bool isAuthenticAttribute =
              (filterContext.ActionDescriptor.IsDefined(typeof(XAuthorizeAttribute), true) ||
              filterContext.ActionDescriptor.ControllerDescriptor.IsDefined(typeof(XAuthorizeAttribute), true)) &amp;&amp;
              filterContext.HttpContext.User.Identity.IsAuthenticated;
          if (!isAuthenticAttribute) return;
          UrlHelper urlHelper = new UrlHelper(filterContext.RequestContext);
          if (filterContext.HttpContext.User.Identity.IsAuthenticated)
          {
              IdentityManager.SignInManager.AuthenticationManager.SignOut(
                  DefaultAuthenticationTypes.ApplicationCookie, DefaultAuthenticationTypes.ExternalCookie);
          }
          filterContext.Result = 
              new RedirectResult(urlHelper.Action("Index", "Home", new {area = ""}));
          base.HandleUnauthorizedRequest(filterContext);
      }
  }
  </code></pre>
  
  <p>Here is the action...</p>
  
  <pre><code>[XAuthorize("Administrator", "articlelists", "HOD Engineering", "HOD Interior"....)]
  public ActionResult Index()
  {
      return View("Index");
  }
  </code></pre>
  
  <p>As you can see I only put 4 roles, just imagine putting 60 roles and permissions etc.... This is just a demo to get the idea because in my project I do not have only roles as I do have here.</p>