title: How to authorize users more than once using custom authorize attribute?
body: <p>I have a custom authorize attribute class to check <code>isAuthorize</code> twice.</p>
  
  <p><strong>What I want :</strong></p>
  
  <p>1) It will check first if the user is <code>super admin</code> or not. If he is , then he will be <code>authorized</code>.</p>
  
  <p>2) If <code>he is not</code> , then it will check if he has a role named "<code>Deal User</code>". If <code>he is not</code> then he will be <code>unauthorized</code>.</p>
  
  <p>3) Now if the user <code>is in</code> a "<code>Deal User</code>" role , I want to check the user whether the user own the deal or not. So I check into database if the user owns that deal . If <code>he owns</code> , then he will be <code>authorized</code>. Otherwise he will be <code>Unauthorized</code>. </p>
  
  <pre><code>public class DealManageCustomAuthorizeAttribute : AuthorizeAttribute
  
  {
  
      private static ApplicationDbContext Context = new ApplicationDbContext();
      private static UserStore&lt;ApplicationUser&gt; userStore = new UserStore&lt;ApplicationUser&gt;(Context);
      private UserManager&lt;ApplicationUser&gt; userManager = new UserManager&lt;ApplicationUser&gt;(userStore);
  
      private enum Result
      {
          Authorize,
          Unauthorize,
          InternalServerError
      }
  
      public override void OnAuthorization(HttpActionContext actionContext)
      {
  
          var result = AuthorizeRequest(actionContext);
          if (result == Result.Authorize)
          {
              return;
          }
          else
          {
              HandleUnauthorizedRequest(actionContext);
          }
  
      }
  
      protected override void HandleUnauthorizedRequest(System.Web.Http.Controllers.HttpActionContext actionContext)
      {
          //Code to handle unauthorized request
          base.HandleUnauthorizedRequest(actionContext);
      }
  
      private Result AuthorizeRequest(System.Web.Http.Controllers.HttpActionContext actionContext)
      {
          base.Roles = "Super Admin";
          bool authorized = base.IsAuthorized(actionContext);
          if (!authorized)
          {
              try
              {
  
                  base.Roles = "Deal User";
  
                  bool auth = base.IsAuthorized(actionContext);
  
                  if (!auth)
                  {
                      return Result.Unauthorize;
                  }
  
                  Uri uri = actionContext.Request.RequestUri;
                  Guid dealId = new Guid(HttpUtility.ParseQueryString(uri.Query).Get("dealId"));
                  string userId = HttpContext.Current.User.Identity.GetUserId();
  
                  var retval = new Deal(Common.Common.TableSureConnectionString).CheckDealByIdAndUserId(dealId, userId);
  
                  if (retval)
                  {
                      return Result.Authorize;
                  }
                  return Result.Unauthorize;
              }
              catch (Exception)
              {
                  return Result.InternalServerError;
              }
          }
          return Result.Authorize;
      }
  
  }
  </code></pre>
  
  <blockquote>
    <p><strong>I wrote the code and it is working. But I want to know whether it is the</strong>
    <strong>correct way to authorize users ?</strong></p>
  </blockquote>