Adding support for privileges to an ASP.NET MVC application already supporting roles based authorization

Question

I currently have a system where there is a user table, a role table, and a user-roles association table, where one user can be associated to multiple roles (like Admin, BasicUser, etc.). I am able to authorize action methods based on these roles.

Now I want to add support for privileges so that action methods can be restricted based on those as well, rather than just by roles. For example, in a Controller, I may have an HTTPPost action that only someone with a "Write" privilege should be able to perform successfully.

What changes do I need to make so that I can assign privileges to roles? I.E., I want to select the "Admin" role to have the "Write" and "Read" privileges, while a "BasicUser" role will only have a "Read" privilege. This way, an Admin can access any method that is allowed by the Write privilege, while the BasicUser can not.

Answer 1

This could be as simple as hanging a few more fields onto the Role table, like CanRead and CanWrite. If you want it to be more sophisticated than that, add a RolePermission table with a Role foreign key.

See Also
Don’t Do Role-Based Authorization Checks; Do Activity-Based Checks.