Question

Is there an integrated way in asp.net mvc 3, to permit authentification and actions based on the time of the day ?
For example, if it’s 18:00 o’clock, users that belong to a specific role are not allowed to log in or if they are already authenticated, they will be automatically logged out or not being able to do actions.

I guess in the log in method I could check for user role and time of day and then on each action, I will also check for role and time of day and permit but is there and easier way to accomplish this ?

UPDATE:
I guess there is no easier way to just set the time and user/roles so I ended up implementing the answer(solution).

Answer 1

You could write a custom Authorize attribute and override the AuthorizeCore method in which you would perform the necessary check:

public class MyAuthorizeAttribute : AuthorizeAttribute
{
    protected override bool AuthorizeCore(HttpContextBase httpContext)
    {
        var authorized = base.AuthorizeCore(httpContext);
        if (!authorized)
        {
            return false;
        }

        // At this stage standard authorization passed =>
        // you could now check the user roles in the database
        // and the time of the day and return true or false from here

        ...
    }
}

and now all that’s left is decorate your controllers/actions with this custom attribute.