Question

I have a complicated question, at least for me :), and it’s more architecture than coding, i would say.

Ok, I am creating a MVC website. I have a wcf service and that’s my only way of communication with my database, business objects, etc.

• Website (MVC)
• Hosting Layer (WCF)
• Service Layer (interface and impletementation for the WCF – class library)
• Business Layer (class library)
• Data Layer (Plinqo – L2S)
• Framework (class library – here i have my custom membership)

in other words, in my web.config at the mvc layer i don’t have any connection string, just the web service mambo jambo. i have the default membership and role provider not implemented.

I implemented a custom Membership and Role Provider. BUT, i use it at the service layer level (i declared it at the WCF’s web.config) It means that, from the MVC i call my webservice client’s validate method (client.ValidateUser(User)) and it’s then when i do my Membership.ValidateUser(username, password).

If you need to know the reasons i did it this way, i will add it. Just ask me.

My question… In my Controllers, when i add the roles attributes to my methods, i know it’s going to fail because mvc is going to try to use whatever membership and role provider is in the webconfig… of course, i haven’t implemented it at the mvc level, but at the wcf. so it’s going to pop a notImplemented error. i haven’t tried but is my guts feeling. SHOULD I IMPLEMENT IT in my mvc and then from this custom membership and role provider call my wcf (database call) and remove it my current membership provider and role provider?

i know it’s all tricky and confusing. if you have any doubts, let me know.

thank you so much.

Answer 1

You have to create a custom implementation of the Authorize filer and override the OnAuthorization method where you have to make the WCF call and do all the work.

http://geekswithblogs.net/brians/archive/2010/07/08/implementing-a-custom-asp.net-mvc-authorization-filter.aspx