title: Custom role based authorization (without membership)
body: <p>I'm pretty new to MVC and developing an application with ASP.NET MVC 4. For authentication I'm using Windows Authentication with Active Directory in a domain. Next step is to authorize users (without using membership). Went through several articles and still to find a good approach. </p>
  
  <p>I have my own 3 database tables (<code>Users</code>, <code>Roles</code>, <code>UserRoles</code>) to maintain authorized users with several admin levels. It is many to many. For example, there may be an "admin" (full access to system with create rights), "data operator" (update rights only for a section) and "support user"(read only/ view only access). Since this is many to many - a user may be a "support user" as well as "data entry operator". </p>
  
  <p>For a particular section I need to control the access based on methods. For example, let say there is a controller called "InvoiceController". There may be methods as follows.</p>
  
  <pre><code>CreateNewInvoice() // Accessible only by admin
  
  UpdateInvoice(...) // Accessible for admin and data operator
  
  ViewInvoice(...) // Accessible for admin, data operator and support user
  </code></pre>
  
  <p>(Only the users exist in roles table can access the system. Access denied for others.)</p>
  
  <p>Please let me know how can I use authentication at method level based on the roles stored in the database. </p>