title: Custom authentication and authorization based on user rights
body: <p>Currently I’m developing an ASP.Net MVC 5 application with MS Sql server database.  I need to implement authentication and authorization based on ASP.Net identity 2.0. I just went through basic concepts of Identity and try to implement the same in my application. Since the database is already defined, I need to customize Identity a little bit. When I looked on to the database, tables are little bit different that I normally found in sample identity projects. </p>
  
  <p><img src="https://i.stack.imgur.com/BDcK3.png" alt="enter image description here"></p>
  
  <p>From the image you can see that there is a table named <strong>user group</strong> and defined set of rights to them based on module. The same rights will be accessible to the user by default. If you want to change any rights you can override it by setting permission in User Rights table.</p>
  
  <p>So my first question is, ASP. Net Identity with Custom Authorization and Authorization is the right method to implement a scenario like this? </p>
  
  <p>From the view perspective, I have to generate a menu based on user / user group rights and also want to enable / disable   buttons based on them. I was able to generate menu based on database values. But I need to authorize each and every client request and for that I think AuthorizeAttribute is the best option. Please suggest? Any good design patterns or post are appreciated.</p>