For an application, I’ve users which have a profile. This application is only “with invitation”, and I need that the user fills its profile before doing anything else.
I’ve a “IsCompleted” boolean attribute on its profile, so I’ve no problem to know if the user has to finish its inscription or not.
But how can I create something which check, on all page that the user has to be authenticated, that the user must be completed?
I thought to create an custom AuthorizeAttribute(in fact I’ve already one custom, which check some roles), but I don’t know if it’s the right place to make this kind of controls, and how can I distinct in the HandleUnauthorizedRequest if the request has been rejected because the login wasn’t valid or because the user didn’t fullfilled it’s informations?
You could either:
a) Put them into a ‘limited’ role until they enter their profile, and let the base authorisation code handle it, then add them to a ‘full’ role on entry of details.
b) Override the OnActionExecuting method in your controllers (or better on base controller that you use), to check to see if the user has entered their profile, before processing the rest of the action.