title: MVC 3 dynamic authorization of multiple roles and users
body: <p>I recently starded developing for MVC 3 but have experience in both C# and ASP.NET since earlier. So i'll start with what i'm trying to accomplish. I've developed a small site for hosting articles. I've implemented SQLServer based membership managament to the site. Now i want to create a credentials system that restricts and allows the right users to create, delete and update articles. There is one simple solution to this and that is to do it like this:</p>
  
  <pre><code>[Authorize(Roles="Admin")]
      public ActionResult UpdateArticle(ArticleModel model, int articleid)
      {
          return View();
      }
  </code></pre>
  
  <p>Now this is really simple. I simply say that only members that are in the role "Admin" are allowed to update an article. But that's just to static. So i created a credentials table in my database that in the end tells me that "Article 5 can be edited by roles 1,2,3 &amp; 4 and by users A, b &amp; C". So far so good. But how would i implement that with the Authorize solution?</p>
  
  <p>I would like to do something like this:</p>
  
  <pre><code>[Authorize(getAuthorizedusers("update",this.articleid))]
  </code></pre>
  
  <p>where getAuthorizedusers returns which users and roles are authorized to update the article with the articleid that was passed to it.</p>
  
  <p>So I have (at least) two problems here:
  -Getting the Authorize method to accept multiple users and roles.
  -Passing the supplied articleid, that was sent to the UpdateArticle method, to the getAuthorizedusers method.</p>