Authorization in a multi-homed environment

I have a system that is multi-homed, that is, our customers share a database. Us开发者_开发问答ing MVC Routing, I can pass the customer name as the first portion of the domain ({customer}.server.tld), and have it translated into a parameter to my controller actions.

Problems include:

Authorization: how can I do this transparently, so that developers making controller actions don't have to remember to do this, and someone not authorized will automatically receive a 403 if they are not authorized to view a particular customer?

Parameter passing: I don't want for every controller action to have a parameter called "customerId". The data has GUID primary keys, so customerId isn't required at the data access level.

What should I do here? I don't want a user changing the URL and getting access to all of our customers' data!

Have you considered using Windows Identity Foundation (WIF)? May sound like an overkill, but it will allow you to not only separate AuthN from AuthZ, but also have code logic (in one spot!) where you can check each customer claim (maybe based on route data) and act accordingly...Check out some of these links:

• Windows Identity Foundation Simplifies User Access for Developers
• A Guide to Claims–based Identity and Access Control
• WIF and MVC – How it works
• ASP.NET MVC 2 and authentication using WIF (Windows Identity Foundation)