How to Show or hide controls based on roles - ASP.

Question

I m working on ASP.NET MVC 4 application.I have a dashboard and my users groups will be based on Windows Domain So I am using WIndows Authentication for authenticating users. I created sample applications which uses custom authentication by overrides functions AuthorizeAttribute, ActionFilterAttribute . Is this a good approach ?

1. Which attribute is best used for authentication ?

I have a dashboard. So I need to show or hide the controls based on roles. Suppose if there is 3 grids(table), If Admin is logs in, he can able see 3 grids(tables). But if Support user is log in he can see 2 grids (table) only.

My plan is to create partial views for each grid and so there will be an Action and Controller for each partial view. There will be a database and in that I will specify the actions which each group can perform. So that I can filter the requests.

2 How can I hide or show the partial views based on roles ?.

I tried some SO links, but all they are talking about 2,3 roles and it was hard coded. In my case roles may vary and we uses db to set up access for roles.

Thanks in advance.

Answer 1

Typically you would want to keep your views as clean as possible with little to no logic. I would suggest moving your role checking logic into a controller action and rendering a partial view based on the users role.

You can use ChildActions and the Html.Action extension method to get this wired up.

From MSDN:

A child action method renders inline HTML markup for part of a view instead of rendering a whole view. Any method that is marked with ChildActionOnlyAttribute can be called only with the Action or RenderAction HTML extension methods.

In your project, create a new Controller called Dashboard and added a single Action called BuildTable.

public class DashboardController : Controller
{
    [ChildActionOnly]
    public ActionResult BuildTable()
    {
        if (Roles.IsUserInRole("Administrator"))
        {
            return PartialView("_AdminTable");
        }

        return PartialView("_SupportTable");
    }
}

Include the following line in the view where you want the dashboard table to appear.

@Html.Action("BuildTable", "Dashboard")

Answer 2

You can use Following code for role based checking

@if(Request.IsAuthenticated)

{
    if(User.IsInRole("Admin"))
    {
     <Ul Class="SubMenuItem">

     <li> this menu item is for Admin role</li>
     </Ul>
    }
     if(User.IsInRole("User"))
    {
     <Ul Class="SubMenuItem">

     <li> this menu item is for User role</li>
     </Ul>
    }
}
@* For unknown user *@
else
{
     <Ul Class="SubMenuItem">
         <li> this menu item is for Unknown user</li>
     </Ul>
}

Answer 3

I have done something similar. The way I did it (may not be the best)

is to send a boolean back to the view

in the controller use:

bool showSection1 = true;
bool showSection2 = false;

ViewData["showSection1"] = showSection1;
ViewData["showSection2"] = showSection2;
/// may be better to use a viewmodel here rather than ViewData

then in the view:

@if((bool)ViewData["showSection1"])
{
    @{Html.RenderPartial("section1");}
}
@if((bool)ViewData["showSection2"))
{
    @{Html.RenderPartial("Section2");}
}

you will need to do the logic to set the boolean the way you want them but this should be a start.

you could also create a static method that returns the role and then get that value directly from the view. this may be bad form though.

@if(AppHelper.GetRole().equals("role1")){
    //show the partial
}

then create a class called AppHelper and a method called GetRole that returns the role of the user.