title: Overriding OnAuthorization in ASP.NET MVC in base controller
body: <p>In my ASP.NET MVC application, I'm trying to figure out whether the user has access to a particular controller, restricted by the authorize data annotation as follows</p>
  
  <pre><code>[Authorize(Roles = "user")]
  </code></pre>
  
  <p>I'm attempting to override OnAuthorization in order to check:-</p>
  
  <ul>
  <li>If the request is authenticated (which works great)</li>
  <li>If the user is authorised to access the requested view (which doesn't work)</li>
  </ul>
  
  <p>My user roles are stored in a SessionManager object I've created - <code>SessionManager.ActiveUser.Roles</code></p>
  
  <p>Here's what I have in the form of pseudo-code but if anybody could help me get this right, I'd really appreciate it.</p>
  
  <pre><code>public class HomeBaseController : Controller
  {
      protected override void OnAuthorization(AuthorizationContext context)
      {
          if (context.HttpContext.User.Identity.IsAuthenticated)
          {
              // these values combined are our roleName 
  
              bool isAuthorised = context.HttpContext.User.IsInRole(context.RequestContext.HttpContext.User.Identity.); 
  
  
              if (!context.HttpContext.User.IsInRole(---the roles associated with the requested controller action (e.g. user)---))
              {
                  var url = new UrlHelper(context.RequestContext);
                  var logonUrl = url.Action("LogOn", "SSO", new { reason = "youAreAuthorisedButNotAllowedToViewThisPage" });
                  context.Result = new RedirectResult(logonUrl);
  
                  return;
              } 
          }
      }
  </code></pre>