Grouping roles in custom membership provider in ASP.Net MVC 2

Maybe I'm using the wrong terms, but I've been Googling for two days and just can't find anything on this: grouping roles/permissions. Or maybe I don't quite understand membership in t开发者_如何学JAVAhe ASP.Net model.

Currently I have a homegrown authentication system in a PHP site, with users, permissions, and roles. Each role (such as "User" or "Technician") is made up of individual permissions (such as "Add New User" or "Close Ticket"). The site is MVC-based, so when the controller action is called, it looks for a basic permission. If not found, it displays an unauthorized page. When it searches for permissions, it looks inside the role groups. However, a user can be a part of the "User" role and have additional permissions without being part of another role.

How would that translate over to MVC2?

The website has a database tables for the user, user_to_permissions, user_to_roles, permissions, roles, and roles_to_permissions. I think the relationships are pretty self-explanatory. I think I'll need to maintain my own database tables for the users, so I'll have custom forms to add/update their info, and obviously a custom login routine.

Can this even work?

RoleProvider "roles" are really just permissions. You can roll them up and present them however you like in your UI (see, for example, AzMan and AuthorizationStoreRoleProvider), but that's up to you. They're not really hierarchical.