Question

In our new very large MVC3 application, we have a security problem to solve. Our structure is that for each controller, there is one viewModel and one viewModelGenerator class. The viewModelGenerator class is responsible for building the viewModel from as many data tables as required.

Our issue is that each user is restricted to only seeing the data for their “office”. So we have to pass the users “office” information to each viewModelGenerator.

Is there a way to access the user profile data without having to pass it as a parameter from the controller? I could pass the value in via the constructor, but we are homing there is a cleaner way of doing it. I’ve seen posts on SO on how to get the user Identity, but not the full profile.

Answer 1

Our structure is that for each controller, there is one viewModel

That’s a wrong structure. You should have a view model per view and not a view model per controller.

Is there a way to access the user profile data without having to pass
it as a parameter from the controller?

No and it is not recommended to have a service layer which pulls such data. This data has to be pushed to the service layer from its owner (which is the UI layer)

This being said in ASP.NET MVC there are more MVCish ways to achieve user authorization. One example is to write a custom [Authorize] attribute which will be executed before each action and would verify if the user is authorized to access the information.