Question

In ASP.NET you can decorate a method as such

[Authorize(Roles="Moderator,Tester")]
Function ActionResult Foo()
{
   return View();
}

This will limit access to users that are in one of the roles specified.

I have a requirement where the user must be in all the roles specified. I can create a new role for this; But I was wondering if it is possible to decorate the method such, that the user must be part of all the roles specified?

Is this possible using the Authorise attribute or will I need to create my own?

Answer 1

Simply use The [Authorize] attribute multiple times:

[Authorize(Roles="Moderator")]
[Authorize(Roles="Tester")]
Function ActionResult Foo()
{
   return View();
}

This will require the user to be in both (or more) roles.