title: Custom Authorize Attribute and Entity Framework
body: <p>I am implementing Action/Activity based authorization in my asp.net application. I am trying to make this a reusable library so that I can use it for other projects. I am using Entity Framework for Data Access.</p>
  
  <p>I was able to implement the functionality but not sure how to configure Entity Framework connection string for Authorize attribute.</p>
  
  <p>Custom Authorize Attribute:</p>
  
  <pre><code>public class AuthorizeAction: AuthorizeAttribute
  {
      private string _actions;
      private string[] _actionsSplit = new string[0];
  
      public string Actions
      {
          get { return _actions ?? String.Empty; }
          set
          {
              _actions = value;
              _actionsSplit = value.Split(',');
          }
      }
  
      protected override bool AuthorizeCore(System.Web.HttpContextBase httpContext)
      {
          string userid = string.Empty;
  
          if (httpContext == null)
          {
              throw new ArgumentNullException("httpContext");
          }
  
          IPrincipal user = httpContext.User;
          if(!user.Identity.IsAuthenticated)
          {
              return false;
          }
  
          userid = user.Identity.Name;
  
          if(_actionsSplit.Length &gt; 0)
          {
              AuthManager manager = new AuthManager();
              if (!manager.AuthorizeAction(_actionsSplit, userid)) //This will authorize the user against an action
                  return false;
          }
          return true;
      }
  </code></pre>
  
  <p>AuthManager class that I am using has a overload method to accept Entity Framework Connection String name for configuration file but I am not sure how can this be configurable or user supplied. </p>
  
  <p>AuthManager Code:</p>
  
  <pre><code>public class AuthManager
  {
      private string connectionConfigName = "AuthorizationContext";
  
      public AuthManager() { }
  
      public AuthManager(string connectionName)
      {
          connectionConfigName = connectionName;
      }
  
      /// &lt;summary&gt;
      /// Authorizes the actions against userid supplied
      /// &lt;/summary&gt;
      /// &lt;param name="actionNames"&gt;Comma seperated list of action names&lt;/param&gt;
      /// &lt;param name="userAlias"&gt;Unique user identifier&lt;/param&gt;
      /// &lt;returns&gt;True if user has access to atleast one of the actions supplies otherwise false&lt;/returns&gt;
      public bool AuthorizeAction(string[] actions, string userAlias)
      {
          using (AuthorizationContext context = new AuthorizationContext(connectionConfigName))
          {
              //List&lt;string&gt; actions = actionNames.Split(',').ToList&lt;string&gt;();
  
              var count = (from ur in context.UserRoles
                           join ra in context.RoleActions on new { Key1 = ur.RoleId, Key2 = ur.UserAlias } equals new { Key1 = ra.RoleId, Key2 = userAlias}
                           join a in context.Actions on ra.ActionId equals a.ActionId
                           where actions.Contains(a.ActionName) &amp;&amp; ra.Allow == true
                           select ur).Count();
  
              return (count &gt; 0);
          }
      }
  }
  </code></pre>
  
  <p>I looked at using RoleProvider but as I am not going to use any of the built in functionality not sure if that is a good idea. Please help.</p>