title: How to properly customize an Attribute for custom security in MVC 4?
body: <p>In an intranet web application at my company, numerous operations have a granular, custom security system which is used in each action/http method in our MVC controllers.  Basically there are two enums; one is a set of actions that can be performed (this is extremely granular; practically every possible action has a corresponding value in the enum) and one is a set of our subcompanies.  For the context of this question, I will call these enums <code>Action</code> and <code>Company</code>.</p>
  
  <p>Each user in our system is associated to one <code>Company</code> and zero or more <code>Action</code>s.  Inside each method in our controllers, somewhere along the way there is a check for if the current user has the right <code>Action</code> and <code>Company</code> value to be using that feature.  Every controller has a "UserHelper" injected into it which contains the <code>Company</code> and list of <code>Action</code>s the authenticated user is associated with.</p>
  
  <p>Approaching it this way, there is a lot of code duplication in that every method is doing its own check on these enum values and reacting to violations when necessary.  I am hoping to reduce this all to a <code>System.Attribute</code> or <code>System.Web.Mvc.AuthorizeAttribute</code> which we can put on controllers or methods to automatically handle violations in a uniform way and not have to check for it within the methods.  Something akin to:</p>
  
  <pre><code>public class MyController : Controller
  {
      [RequireActionAndCompanyAttribute(Action = Action.MyMethod, Company = Company.AbcInc)]
      MyMethod()
      {
          // do stuff, but don't bother checking for the security values
      }
  }
  </code></pre>
  
  <p>As mentioned, I am assuming I can inherit from <code>System.Attribute</code> or <code>System.Web.Mvc.AuthorizeAttribute</code> for this purpose.  However, I'm struggling.  I'm not sure how to adapt <code>AuthorizeAttribute</code> to use our own internal security implementation (based on <code>Action</code> and <code>Company</code>) rather than one of the ASP.NET Membership systems.  And the plain old <code>System.Attribute</code> seems so vague that I'm thinking it wasn't designed for this kind of use at all.  I'm also not sure how I'm supposed to pass anything to the methods in the attribute.  When I put the attribute on a method, I just want to specify what <code>Action</code> and <code>Company</code> are required to continue, like in the code snippet above.  But then, how do I pass the user's actual values for these into the attribute's validation method?</p>