Checking login user role in razor page

Question

@if (Request.IsAuthenticated && User.Identity.Name=="administrator")
{
     <div id="sidebar">
        <div class="module">
        <ul class="menu">
                            <li>@Html.ActionLink("Home", "Index", "Home")</li>
                            <li>@Html.ActionLink("About", "About", "Home")</li>
                            <li>@Html.ActionLink("Contact", "Contact", "Home")</li>
                        </ul>
         </div>
         <div class="mainContent">
             Hello, @User.Identity.Name !
         </div>
     </div>

This is my layout if the user is authenticated as administrator but this sort of check looks no good, I need to check the role of the user not his name.

Here is the controler method

    public ActionResult AuthenticatedUserLayout(string username) 
    {
        var lst=userContext.UserProfiles.ToList();
        var user = lst.Select(u => u.UserName == username);

        if(IsAdmin(Session["LoginUser"].ToString())) return View(user); else return Index();
    }

I also find that return View(user) is no good, because I don't know how to make any use of that user.

`@if (Request.IsAuthenticated && User.IsInRole("administrator"))` — codingbiz, Feb 19 '13 at 22:56

score 132 · Accepted Answer · edited Jun 04 '14 at 15:27

132

@if (Request.IsAuthenticated && User.IsInRole("Administrators"))
{
     <div id="sidebar">
        <div class="module">
           <ul class="menu">
              <li>@Html.ActionLink("Home", "Index", "Home")</li>
              <li>@Html.ActionLink("About", "About", "Home")</li>
              <li>@Html.ActionLink("Contact", "Contact", "Home")</li>
            </ul>
         </div>
         <div class="mainContent">
             Hello, @User.Identity.Name !
         </div>
     </div>
}

edited Jun 04 '14 at 15:27

FabioG

2,936
3
31
50

answered Feb 19 '13 at 22:57

Dave Alperovich

32,320
8
79
101

It's pity that not to support Authorize attribute like [Authorize(Role = "Administrator")] or [Authorize(Policy = "RequireAdministratorRole")] – Ozan BAYRAM Sep 18 '18 at 13:48
@OzanBAYRAM, you can use Authorize Attribute, it just wouldn't be as convenient. A better way may be to carry around a user object with permission. – Dave Alperovich Sep 18 '18 at 19:50
Thanks, @dave-alperovich, I noticed that I forgot to add page directive to cshtml file. This is why I could not make it work. – Ozan BAYRAM Sep 20 '18 at 05:27
Is there a way to check this based on Individual Permissions? – Jordan Lee Burnes Dec 04 '18 at 17:06
@JordanLeeBurnes, you can only check if user is an Admin – Dave Alperovich Dec 05 '18 at 23:50

score 29 · Answer 2 · answered Sep 19 '18 at 07:29

29

For ASP.NET Core Razor Pages

if (User.Identity.IsAuthenticated && User.IsInRole("Administrator"))

answered Sep 19 '18 at 07:29

Ozan BAYRAM

2,780
1
28
35

score 14 · Answer 3 · edited Mar 29 '15 at 22:09

14

Dave's answer is correct. I would suggest that you consider using a property on your model called IsAdministrator or CanSeeSidebar and treat answering that question as domain logic.

The view should work only with the model. Looking at the thread, reading from a database, are the same in respect that they answer domain questions. All those types of questions should be answered before your controller hands the model off to the view.

edited Mar 29 '15 at 22:09

Dave Alperovich

32,320
8
79
101

answered Feb 20 '13 at 00:55

Honorable Chow

3,097
3
22
22

3

Isn't that hard if you want to put this on a shared view - which with a navigation you almost certainly will? – niico Jul 07 '17 at 10:51

Stephen · Answer 4 · 2023-04-23T01:05:35.787

Here's another method that can be done directly on the razor page. You just need access to the UserManager and RoleManager.

Note: My implementation uses custom user and role classes. If you don't have custom user or role classes, then replace all instances of <User> with <IdentityUser> and <Role> with <IdentityRole>.

This provides the ability to have direct access to the actual role object for each assigned role within the razor page which is helpful if you have custom fields attached to the role like I have.

@inject SignInManager<User> SignInManager
@inject UserManager<User> UserManager
@inject RoleManager<Role> RoleManager

@{
    List<Role> UserRoles = null;

    if(SignInManager.IsSignedIn(User)){
        UserRoles = (from Role R in RoleManager.Roles.ToList() where User.IsInRole(R.Name) select R).ToList();
    }
}

@if (SignInManager.IsSignedIn(User))
{
    //Show the user's role(s)'
    @if (UserRoles != null)
    {
        @foreach (Role Role in UserRoles)
        {
            <p>@Role.Name</p>
        }
    }
} else
{
    <p>Please log in</p>
}

Checking login user role in razor page

4 Answers4

Linked