Page History: MVC Template - ASP.NET MVC

Compare Page Revisions

4 3 2 1 0 Current 4 3 2 1 0

« Older Revision - Back to Page History - Newer Revision »

Page Revision: Wed, Jan 11, 2012, 12:17 PM

Table of Contents [Hide/Show]    Menu System          MenuItem Database Table          MenuItemRole Database Table    Controller Inheritance Tree          BaseController Class          LoginController Class          AuthorizedController Class          DataAuthorizedController Class          AppAuthorizeAttribute Class    Other Features

Menu System¶

Menu Database Tables

MenuItem Database Table¶

Column Name	Data Type	Description
MenuItemID	int not null identity(1,1)	Primary key for the table
DisplayText	varchar(10) not null	Text displayed to the user
Url	varchar(300) null	The URL to navigate to when the user clicks this menu item
ParentID	int null	MenuItemID of the parent menu item; if null, this item is a top-level item. Has foreign key against MenuItemID column.

MenuItemRole Database Table¶

A row exists in the MenuItemRole table for every MenuItem a specific role has access to.

Column Name	Data Type	Description
MenuItemID	int not null	Foreign key against MenuItem.MenuItemID
RoleID	uniqueidentifier not null	Foreign key against aspnet_Roles.RoleID

Controller Inheritance Tree¶

Controller Inheritance Diagram

BaseController Class¶

The BaseController class inherits from System.Web.Mvc.Controller class, and implements features common to all controllers in the site.

LoginController Class¶

The LoginController class inherits from BaseController and is used solely for security-related operations: logging in, logging out, changing your password, retrieving/resetting a forgotten password, impersonation, etc.

AuthorizedController Class¶

The AuthorizedController also inherits from the BaseController class and is used for all operations which the user needs to be authorized based solely on the URL requested. To this end, it is decorated with the AppAuthorize attribute.

DataAuthorizedController Class¶

The DataAuthorizedController class inherits from the AuthorizedController class. In additional to authorizing the user based on the URL requested, this class also implements a rudimentary data-driven authorization. For example, this could be used to prevent a sales manager from seeing an invoice from outside their sales region. This base class implements a single method: public abstract bool AuthorizeData(int), which is overridden in each derived class to indicate whether the current user has authorization to access the indicated data. For example, in an InvoiceController class, this might be implemented as public bool AuthorizeData(int invoiceID), which would implement whatever business rules are appropriate to determine whether the current user has authorization to accesss the indicated invoice.

AppAuthorizeAttribute Class¶

The AppAuthorizeAttribute class inherits from the System.Web.Mvc.AuthorizeAttribute class. In the public override void OnAuthorization method we implement authorization in two stages.

• Knowing the URL requested and the identity of the current user, we query the MenuItem and MenuItemRole table via a stored procedure to determine whether the current user has access to the requested URL.
  

• If the user has this authorization, and the controller in the current context inherits from DataAuthorizedController class, then the AuthorizeData method is called to determine if the user has data-driven authorization.
  

Other Features¶

• Set landing page based on user role
• Enable features based on user role
• Enable/show page elements based on user role