title: Handling different types of users in asp.net mvc
body: <p>I have 3 different types of users (with different roles) interacting on my web application, they all perform some task - some can be exactly the same e.g. create a quote others can be unique to that specific user e.g. sign off quote.</p>
  
  <p>For more clarity 3 types of users: Client, Supplier, Customer.</p>
  
  <p>Client or Customer can create a quote, however only the Customer can sign off a quote.</p>
  
  <p>How do I ensure my application allows clients to access client speficic controllers and suppliers to access supplier specific controllers or areas. Via Custom Attributes? Do I store the type of user inside a cookie? Is this safe? or Session state? As soon as someone logs onto the system I send back a LoggedOnDTO object on which I store Username, UserID, and type of user....</p>
  
  <p>NOTE: I went away from asp.net build in way of creating users, I have my own custom tables with my custom mechanism for logging into the system. I have a registered Model Bindiner that looks for the prefix and I send in a strongly typed object to each action...</p>
  
  <p>Sample code:</p>
  
  <pre><code>[HttpGet]
  public ActionResult AddComment(int quoteid, ClientUserDTO loggedonclientuser)
  {
  
  }
  
  [HttpGet]
  public ActionResult AddCommentSupplier(int quoteid, Supplier loggedonsuppluser)
  {
  
  }
  </code></pre>
  
  <p>EDIT: This method for some reason seems so much simpler... Is there something wrong with it? Any possible security issues? Threading?</p>
  
  <p>My session controller is:</p>
  
  <pre><code>if (_authService.isValidUser(model))
  {
     var data = _authService.GetAuthenticationCookieDetails(model);
     AuthenticateCookie.AddDetailsToCookie(data);
     return Redirect(Url.Action("Index", "Activity"));
  }
  </code></pre>
  
  <p>When I create my cookie... I can simple store "ClientUser", "Supplier" or whatever role they are inside the cookie.</p>
  
  <p>Then I can create an Attribute and read in the cookie data to see if they are a valid user e.g.</p>
  
  <pre><code>public class ClientAuthorizationAttribute : AuthorizeAttribute
      {
          public bool AlwaysAllowLocalRequests = false;
          protected override bool AuthorizeCore(System.Web.HttpContextBase httpContext)
          {
              if (AlwaysAllowLocalRequests &amp;&amp; httpContext.Request.IsLocal)
              {
                  bool authorized = false;
                  var result = UserDetails.GetTypeFromTicket(httpContext.User.Identity as FormsIdentity);
  
                  if (result.Equals("client", StringComparison.OrdinalIgnoreCase))
                  {
                      authorized = true;
                  }
                  //throw no access exception?
                  return authorized;
              }
              return base.AuthorizeCore(httpContext);
          }
      }
  </code></pre>
  
  <p>Register the attribute under my base controller and I have a simple working solution???</p>