Asp.Net Mvc Role Based Authentication And Claims Complete Guide

Step 1: Create an ASP.NET MVC Project

1. Open Visual Studio.
2. Create a New Project:
   • Go to File > New > Project.
   • Select ASP.NET Web Application (.NET Framework) and name the project RoleBasedAuthClaims (or any name you like).
3. Select MVC Template:
   • In the new project window, choose the MVC template with Authentication set to Individual User Accounts.

Step 2: Configure Identity Model

Ensure your ApplicationDbContext class looks something like this:

public class ApplicationDbContext : IdentityDbContext<ApplicationUser>
{
    public ApplicationDbContext()
        : base("DefaultConnection", throwIfV1Schema: false)
    {
    }

    public static ApplicationDbContext Create()
    {
        return new ApplicationDbContext();
    }
}

And make sure that the ApplicationUser class is defined as follows:

public class ApplicationUser : IdentityUser
{
    // Can add custom properties here
}

Step 3: Create Roles and Assign Roles to Users

Add role creation in your Seed method inside Configuration.cs:

using Microsoft.AspNet.Identity;
using Microsoft.AspNet.Identity.EntityFramework;
using System.Data.Entity;
using System.Linq;

public class Configuration : DbMigrationsConfiguration<RoleBasedAuthClaims.Models.ApplicationDbContext>
{
    public Configuration()
    {
        AutomaticMigrationsEnabled = true;
    }

    protected override void Seed(RoleBasedAuthClaims.Models.ApplicationDbContext context)
    {
        var roleManager = new RoleManager<IdentityRole>(new RoleStore<IdentityRole>(context));
        var userManager = new UserManager<ApplicationUser>(new UserStore<ApplicationUser>(context));

        if (!roleManager.RoleExists("Admin"))
        {
            var adminRole = new IdentityRole() { Name = "Admin" };
            roleManager.Create(adminRole);

            var user = userManager.FindByName("admin@gmail.com");
            if (user == null)
            {
                user = new ApplicationUser() { UserName = "admin@gmail.com", Email = "admin@gmail.com" };
                userManager.Create(user, "Qwerty1234!");
            }

            userManager.AddToRole(user.Id, "Admin");
        }

        if (!roleManager.RoleExists("User"))
        {
            var userRole = new IdentityRole() { Name = "User" };
            roleManager.Create(userRole);

            var user = userManager.FindByName("user@gmail.com");
            if (user == null)
            {
                user = new ApplicationUser() { UserName = "user@gmail.com", Email = "user@gmail.com" };
                userManager.Create(user, "Qwerty1234!");
            }

            userManager.AddToRole(user.Id, "User");
        }
    }
}

Run the migrations to apply the role changes:

• Open Package Manager Console
• Run Update-Database

Step 4: Implement Role-Based Authorization with Filters

Use [Authorize(Roles="")] attribute to limit access:

Create a simple controller with actions requiring different roles:

using Microsoft.AspNet.Identity;
using Microsoft.AspNet.Identity.EntityFramework;
using RoleBasedAuthClaims.Models;
using System.Web.Mvc;

public class RoleController : Controller
{
    public ApplicationDbContext _Context = new ApplicationDbContext();

    [Authorize(Roles = "Admin, User")]
    public ActionResult Common()
    {
        return View();
    }

    [Authorize(Roles = "Admin")]
    public ActionResult AdminOnly()
    {
        return View();
    }

    [Authorize(Roles = "User")]
    public ActionResult UserOnly()
    {
        return View();
    }
}

Step 5: Create Views for Actions

Create corresponding views in Views/Role folder for each action:

• Common.cshtml
• AdminOnly.cshtml
• UserOnly.cshtml

For example, the content of Common.cshtml could be:

<h2>Common</h2>
<p>This section is accessible by both Admin and User.</p>

And similarly for others:

<!-- AdminOnly.cshtml -->
<h2>Admin Only Section</h2>
<p>This section can only be accessed by Admin.</p>

<!-- UserOnly.cshtml -->
<h2>User Only Section</h2>
<p>This section can only be accessed by User.</p>

Step 6: Add Role Claims

Role claims can be used for more granular control over authorization.

Modify the Seed method to add claims to the "Admin" role:

protected override void Seed(RoleBasedAuthClaims.Models.ApplicationDbContext context)
{
    var roleStore = new RoleStore<IdentityRole>(context);
    var roleManager = new RoleManager<IdentityRole>(roleStore);

    if (!roleManager.RoleExists("Admin"))
    {
        roleManager.Create(new IdentityRole("Admin"));
        var role = roleManager.FindByName("Admin");
        role.Claims.Add(new IdentityRoleClaim
        {
            ClaimType = "Access",
            ClaimValue = "AdminPage"
        });
        roleManager.Update(role);
    }

    if (!roleManager.RoleExists("User"))
    {
        roleManager.Create(new IdentityRole("User"));
        var role = roleManager.FindByName("User");
        role.Claims.Add(new IdentityRoleClaim
        {
            ClaimType = "Access",
            ClaimValue = "UserPage"
        });
        roleManager.Update(role);
    }
    
    // ... user creation and assigning to roles
}

After running Update-Database, the roles will have these claims attached.

Step 7: Custom Claim-Based Authorization Filter

You can create a custom authorize filter to check claims rather than roles:

using Microsoft.AspNet.Identity;
using Microsoft.AspNet.Identity.EntityFramework;
using System.Security.Claims;
using System.Web.Mvc;

public class ClaimsAuthorizeAttribute : AuthorizeAttribute
{
    public string ClaimType { get; set; }
    public string ClaimValue { get; set; }

    protected override bool AuthorizeCore(HttpContextBase httpContext)
    {
        return httpContext.User.Identity.IsAuthenticated && HasRequiredClaim(httpContext.User);
    }

    private bool HasRequiredClaim(IPrincipal user)
    {
        var identityClaims = (ClaimsIdentity)user.Identity;
        var claims = identityClaims.Claims;
        return claims.Any(c => c.Type == ClaimType && c.Value == ClaimValue);
    }
}

Now you can use it in your controller actions:

public class HomeController : Controller
{
    [ClaimsAuthorize(ClaimType="Access", ClaimValue="AdminPage")]
    public ActionResult AdminContent()
    {
        return View();
    }

    [ClaimsAuthorize(ClaimType="Access", ClaimValue="UserPage")]
    public ActionResult UserContent()
    {
        return View();
    }
}

And again create corresponding views:

• AdminContent.cshtml
• UserContent.cshtml

Example content for each:

<!-- AdminContent.cshtml -->
<h2>Admin Content</h2>
<p>This content is accessible through Admin claim.</p>

<!-- UserContent.cshtml -->
<h2>User Content</h2>
<p>This content is accessible through User claim.</p>

Step 8: Verify Authentication and Authorization

Run the application and try accessing the following URLs:

• /Role/Common - Should be accessible by both logged-in Admin or User.
• /Role/AdminOnly - Should be accessible by Admin only.
• /Role/UserOnly - Should be accessible by User only.

Also, check claim-based access:

• /Home/AdminContent - Should be accessible through the claim "AdminPage".
• /Home/UserContent - Should be accessible through the claim "UserPage".

Additional Tips:

• Make sure that ApplicationUserManager in Startup.Auth.cs initializes user roles and claims correctly.
• For production applications, ensure proper error handling and user feedback mechanisms for unauthorized access.