I have searched around and I can't find any particular answer that addresses what I am asking but no doubt it will have been mentioned already somewhere.

I know that when you inherit from an abstract System.Web.Security.RoleProvider you override this method public abstract string[] GetRolesForUser(string username);

and as the name of the method (GetRoles) and it's return value (string[]) implies, more than 1 role can be returned for a single user, but it could also be restricted to a single item array through a custom role provider.

In my situation I am implementing this in a .NET MVC web app and using a custom .NET role provider, and I have a decision to make as to whether I should allow a user to be in more than 1 role at a time.

I am looking for any general reasons for/against doing this (most specifically implementation reasons).

Most of the points I can think are app domain specific, here are a couple...

  • Deciding which role permissions take priority i.e. what to do when 1 role authorizes a particular action and another is supposed to deny it but both roles are assigned to the same user.
  • Whether to allow users to switch in and out of their roles or to only ever assign 1 role to them and have an administrator change this.

but is there any particularly bad reason why you should avoid giving a user multiple roles at a time? Is it better to give a user only 1 role?


Roles are one of those things that is strongly domain-dependent. In other words, you assign someone to a Role because that's the role they play IRL.

If you don't allow roles to overlap, you can find yourself in the uncomfortable position of creating "hybrid" roles that encompass multiple responsibilities, for example creating a role that solely describes the "QA Supervisor/Code Administrator/Floor Sweeper" guy.

If you allow multiple roles, you can just assign those three roles, and you're done.

Resolving role conflicts is easy enough; you just decide which one takes precedence, or you assume "deny" unless a specific permission is granted. Users don't normally assign roles to themselves; someone higher up in the food chain has to do that.

  • Thanks. What I meant by role switching was that if a user is assigned to 3 roles out of 10 roles.. then you might give them the ability to switch between those 3 at will, its not however something I would feel comfortable with unless the switching was performed in a controlled area of the app, otherwise it could cause issues with steps in a process. – Pricey Jan 14 '14 at 22:12
  • Roles define what someone has access to, not what they are doing at any given moment. – Robert Harvey Jan 14 '14 at 22:13
  • Is there generally no real issue regarding implementation with MVC and the windows authorization related features when it comes to supporting multiple roles then? your answer gives me the impression that there isnt – Pricey Jan 14 '14 at 22:13
  • What real issue might you be referring to? The only real issue that I can think of is that it can be difficult to know exactly what resources someone really has access to, given the roles they are assigned to. Most systems with role-based security solve this by providing a page that lists all of the resources that a particular person has access to, based on the roles they are assigned. – Robert Harvey Jan 14 '14 at 22:16
  • I haven't implemented it before in MVC so I couldn't tell you, I was just probing for any tips. Your answer is fine and I can choose later whether to allow multiple roles based on when I get more requirements about the roles i.e. if I end up with roles like "Manager", "Manager with some admin access", "Manager with slightly more admin access", "Manager with full admin access", then its probably better to apply multiple roles to the user i.e. "Manager" + "basic administrator" – Pricey Jan 14 '14 at 22:26

protected by gnat Sep 1 '15 at 4:42

Thank you for your interest in this question. Because it has attracted low-quality or spam answers that had to be removed, posting an answer now requires 10 reputation on this site (the association bonus does not count).

Would you like to answer one of these unanswered questions instead?

Not the answer you're looking for? Browse other questions tagged or ask your own question.