Question

I have an issue to do with roles in mvc 3 vb.net app..Say I have Admin, Developer, PowerAdmin roles.. if I want to restrict view options based on roles I have been using a if statement in the view to hide the link all together such as:

 @If HttpContext.Current.User.IsInRole("Admin") And Request.IsAuthenticated Then
 @<li><a href="@Url.Content("~/Admin/")">Administrative Tools</a></li>
 End If

I am also decorating controller actions with authorize in places. The Problem is this say I have several actions that should only be available to say a user who is in all three roles or even 2 of the roles in any combination.. Would I simply nest the if statements in the view to hide those view items? What about controller functions.. Is it possible to decorate controller functions with something like

   <Authorize(Roles:="Admin" + "PowerAdmin")>

and then have that function only accessible by someone with both roles????

Answer 1

simple write two separate lines :

<Authorize(Roles := "Admin")> _
<Authorize(Roles := "PowerAdmin")> _