ASP.NET MVC: is there any other way apply to role to an application but decorating its controllers/actions with attributes?

When using WSAT with a ASP.NET webform application, it's possible to create a new role, add/remove users to/from it, and (most importantly) define rules that apply for that role; i.e. you have a folder tree that allows you to choose which folder you want to apply a particular rule regarding a certain role. So, you can do all your work without leaving the comfort of your WSAT.

With ASP.NET MVC I didn't find such functionality. Even if it's possible to add a new role from WSAT and add/remove users to/from it, I still need to go to my application code and decorate controllers and/or acti开发者_Python百科ons with attributes, like this:

[Authorize(Roles = "role1, role2, ...")]

So what the point of creating role with a tool just to go after touch the application code? Also, Let's say The administrator doesn't know how to write code and need to create role that's slightly different from the existing ones?

Is there any other way apply to role to an application but decorating its controllers/actions with attributes? I guess that's to do with the way the framework works. Anyway, I'd like to know if there's a way to deal with the fact developers need to go play with the code all the time.

Thanks for helping

Since MVC is extensible you can implement your own custom AuthorizeAttribute and search for the required roles in a database or an xml file.

Basically you would need to store the functionality a role is allowed to do (or not allowed to do) in a database/xml just like you would've done in a simple webforms app.

Then you create your custom Authorize filter which will check the database to see if the current action is allowed or not. So in a true sense there won't be many true Roles in the system.

To understand how to override Authorize filter , read this > http://schotime.net/blog/index.php/2009/02/17/custom-authorization-with-aspnet-mvc/