Role base access on UI controls in ASP.NET MVC

Question

I am building an application where same page can be visited by multiple user of different roles, for example

Administrator can update all fields
Initiator can insert data in all controls of the page except comments box
Reviewer can only insert data in comments box
Guide can only read data on the screen, no access to update anything on screen

Only thing that came in my mind so far is that I should make custom Html helpers where I will accept role as a parameter and check the role and accordingly add disable or enable classes to the control. Application will have hundreds of pages, but some pages might have different access to different roles. Please provide a solution where I can achieve this specific page & role base access control and without much compromising with performance.

Any help or suggestion will be appreciated. Thank you.

Have you tried taking a look at [the docs](https://learn.microsoft.com/en-us/aspnet/core/security/authorization/views?tabs=aspnetcore2x)? — Clint, Dec 14 '17 at 18:53
(This may vary slightly from core and MVC, but the general principle should apply, and adding a custom helper could bridge the gap) — Clint, Dec 14 '17 at 18:54
@Clint thank you for your valuable input but if I use this I need to use `@if ((await AuthorizationService.AuthorizeAsync(User, Model, Operations.Edit)).Succeeded)` for each and every control, and as I mentioned I need to do such thing in more than 100s of pages, a generic solution where I don't have write this code on every control will be better. — , Dec 14 '17 at 19:04
Given your permissions aren't as fine-grained as every control, surely you could test these once per page, and have the results form part of your model? Or at the very least as a variable declared on the page? That way you could just test against the variable. Cumbersome regardless, I know, but I do not believe there is a simple way of applying these rules to all controls. — Clint, Dec 14 '17 at 19:09
I hope someone might have done something similar in their project, and ready to advice me to achieve this. — , Dec 14 '17 at 19:14

joym8 · Accepted Answer · 2017-12-15T18:23:16.753

1

Do you really want to hide the controls that a user is not authorized to update? Or simply show unauthorized error (return new HttpUnauthorizedResult();) when they hit the save/update button. If you prefer the latter, here is one way of doing this:

Your razor views will not use any authorization code.
Create a group/role something like "All Authorized X app"
Create groups/roles for individual functions, like "X Administrators", "X Initiators", "X Reviewers" and "X Guides"
Add all groups/roles in third bullet into the second one
Decorate your controllers like [Authorize ("Roles="All Authorized X app")]
Within your save/update actions, use if(User.IsInRole("X Administrators")) or if(User.IsInRole("X Reviewer"))

edited Dec 15 '17 at 18:23

answered Dec 15 '17 at 17:44

joym8

4,014
3
50
93

I dont want to hide controls but I want to restrict user to update anything on those controls, or you can say disable those fields. As I mentioned in question, iniside a single view some roles will have access to some UI control and other roles will have access to some other UI controls. – Dec 16 '17 at 09:02
"iniside a single view some roles will have access to some UI control and other roles will have access to some other UI controls" The design I've described will allow you to do this. – joym8 Dec 21 '17 at 02:33

score 0 · Answer 2 · answered Aug 16 '23 at 09:22

I faced the same issue and after a lot of search i didn't find any simple way so i try to find my way

1- after we create the user we put this user in a group this group has permission for the pages and the buttons inside every single page in the system

2- users have two permission types: a- Master user: have full access to the system pages and buttons
b- Normal user: have limited access to pages and buttons inside the page

3- in my HTML view first thing I do is find all buttons in the view using var buttons = document.getElementsByTagName('button'); in this way, i collect all buttons

then in $(document).ready() function i do my job using ajax like this

$.ajax({
    url: '@Url.Action(MyFunction, ControllerName)',
    method: 'GET',
    success: function (data) {
      for (var i = 0; i < buttons.length; i++) {
          var button = buttons[i];
          var name = button.getAttribute('name');
          if (name == "Add" && data.AddPer == 0) {
              $("#" + button.getAttribute('id')).addClass("disabled");
          } 
          else if (name == "Print" && data.PrintPer == 0) {
              $("#" + button.getAttribute('id')).addClass("disabled");
          } else if (name == "Edit" && data.EditPer == 0) {
              $("#" + button.getAttribute('id')).addClass("disabled");
          }
      }
    },
            error: function () {
                // Handle errors if needed
            }
});

what I am doing is after I collect all buttons I get my permission from my database and give the button's name then in my for loop i try to know if this button is Add button and the user have permission for this button or not if not I add class disabled for this button else I don't do any thing for the button

Note: give your buttons a name like I do

I want to say I can customize my solution and make it in a separate javascript file and call it inside your HTML View and pass the parameter you need.

Role base access on UI controls in ASP.NET MVC

2 Answers2