ASP.NET MVC Roles without database (and without role provider)
asp.net-mvc, configuration, roles
Solution
I'm not a friend of storing authorization data in web.config. I prefer storing it in database or other xml files.
Have a look at Xml Membership / Role Provider. This uses Membership / Role for reading userdata but it shows a way storing and reading user authorization data from xml files.
Braching the application woulded move the issue and not solve.
Problem
I have a super simple ASP.NET MVC application that uses RpxNow (OpenID) to allow users to login. I now want to let users edit their own account and provide administrator access to edit anyone's account. I have two separate "Edit Account" views: - ~/account/edit/ - ~/account/edit/1 The first loads the account details based on the logged in user. The second loads the account details using the supplied AccountId. The first would be for standard users, and the second for an administrator. Firstly I need to define the roles (User, Admin) and then I need to assign a user account (or multiple) to that role. Then I need to check the role in the controller. I like this concept: http://schotime.net/blog/index.php/2009/02/17/custom-authorization-with-aspnet-mvc/ So, down to the questions: - Is there a simple way to define a list of roles in the web.config? - Is there a simple way to define which users are in which roles in the web.config? - Is there a way to do this WITHOUT using Membership / Role providers? - Am I approaching this from the wrong perspective? Should I be partioning the application into two branches and securing them based on folder authorisation?