title: Best approach to user roles with an intranet application
body: <p>I'm developing an ASP.NET MVC intranet website which needs to have a few different user roles (admin, editor, writer, etc.) and the backend uses SQL Server. I read <a href="http://weblogs.asp.net/scottgu/pages/Recipe_3A00_-Implementing-Role_2D00_Based-Security-with-ASP.NET-2.0-using-Windows-Authentication-and-SQL-Server.aspx" rel="nofollow">this post</a> by scottgu about role-based security and used that as a starting point.  The steps I followed were:</p>
  
  <p>Configured a DB using the asp_regsql.exe application
  Set the authentication mode to windows</p>
  
  <pre><code>&lt;authentication mode = "Window" /&gt;
  </code></pre>
  
  <p>Added a connection string entry to the Web.config, </p>
  
  <pre><code>&lt;connectionStrings&gt;
    &lt;add name="SqlRoleManagerConnection" 
         connectionString="Data Source=localhost; Initial Catalog=aspservicedb; Integrated Security=SSPI;" /&gt;
  &lt;/connectionStrings&gt;
  </code></pre>
  
  <p>Added a roleManager entry to the Web.config  section,</p>
  
  <pre><code>&lt;roleManager enabled="true" defaultProvider="sqlRoleManager"&gt;
    &lt;providers&gt;
      &lt;clear /&gt;
      &lt;add name="sqlRoleManager" type="System.Web.Security.SqlRoleProvider"
           connectionStringName="SqlRoleManagerConnection"
           applicationName="MyApplication" /&gt;
    &lt;/providers&gt;
  &lt;/roleManager&gt;
  </code></pre>
  
  <p>Added some role code into the Application_Start() method of the Global.asax.cs file,</p>
  
  <pre><code>if (!Roles.RoleExists("Editor"))
  {
     Roles.CreateRole("Editor");
  }
  if (!Roles.RoleExists("Writer"))
  {
     Roles.CreateRole("Writer");
  }
  if (!Roles.RoleExists("SiteAdmin"))
  {
     Roles.CreateRole("SiteAdmin");
     Roles.AddUserToRole("MYCOMPUTER\\Matt", "SiteAdmin");
  }
  </code></pre>
  
  <p>Modified my controllers to use the roles:</p>
  
  <pre><code>[Authorize(Roles = "SiteAdmin")]
  public class SiteAdminController : Controller
  {
      .
      .
      .
  }
  </code></pre>
  
  <p>And this all seems to work at this point but I'm wondering if there is a better approach to handing roles or if there are problems with this approach.  It's easy to convince oneself that the approach is a good one because it worked but I'd like to take a different approach <em>now</em> rather than later if this isn't the best approach to solving the problem.  Elsewhere I'd read someone say this was "hack" but never really qualified why he wouldn't solve the problem this way.  Your thoughts?  Do you have a better what to solve this?</p>