Question

I current have the following attribute decorating one of the action method.

[Authorize(Roles = "Admin")]
public ActionResult DoAdminTask()
{
//Do something

   return View();
}

Currently, only users in the Admin role can invoke this method, but this will change. Is there anyway I can store a list of authorised roles in a config file, rather than hard coding it into the source?

EDIT: Roles will change over time, and more than 1 role will need access.
i.e. Users in either role A OR role B can access.

Answer 1

No way to do this with the standard authorize attribute, but you could extend the authorize attribute with your own custom authorize attribute and have it use a configuration file to determine the mapping between controller/action and the set of roles.