Question

I’m creating a website where an Admin can add Teachers and Students, the admin should be able to specify what the Teacher can do when he’s in a particular Location.

Is it possible to extend the Authorize attribute to check in what Location the specific user is in? for example [Authorize(Roles = “Administrator”, Location=”ICT”)] ?

And if so, how can I extend this?

Thanks in advance.

Answer 1

And if so, how can I extend this?

By writing a custom authorize attribute:

public class MyAuthorizeAttribute : AuthorizeAttribute
{
    public string Location { get; set; }

    protected override bool AuthorizeCore(System.Web.HttpContextBase httpContext)
    {
        var result = base.AuthorizeCore(httpContext);
        if (!result)
        {
            return false;
        }

        // At this stage we know that the currently logged in user 
        // is authorized. Now you could use the Location property
        // to perform additional custom authorization checks and
        // return true or false from here

        string user = httpContext.User.Identity.Name;

        ...
    }
}

and then:

[MyAuthorize(Roles = "Administrator", Location = "ICT")]