title: Best Practices for Roles vs. Claims in ASP.NET Identity
body: <p>I am completely new to the use of <code>claims</code> in <code>ASP.NETIdentity</code> and want to get an idea of best practices in the use of <code>Roles and/or Claims</code>.</p>
  
  <p>After all this reading, I still have questions like...</p>
  
  <p>Q: Do we no longer use Roles?<br/>
  Q: If so, why are Roles still offered?<br/>
  Q: Should we only use Claims?<br/>
  Q: Should we use Roles &amp; Claims together?<br/></p>
  
  <p>My initial thought is that we "should" use them together.  I see <code>Claims</code> as sub-categories to the <code>Roles</code> they support.</p>
  
  <p><strong>FOR EXAMPLE:</strong><br/>
  <em>Role:</em> Accounting<br/>
  <em>Claims</em>: CanUpdateLedger, CanOnlyReadLedger, CanDeleteFromLedger<br/></p>
  
  <p>Q: Are they intended to be mutually exclusive?<br/>
  Q: Or is it better to go Claims ONLY and "fully-qualify" you claims?<br/>
  Q: So what are the best practices here?<br/></p>
  
  <p><strong>EXAMPLE: Using Roles &amp; Claims Together</strong><br/>
  Of course, you would have to write your own Attribute logic for this...</p>
  
  <pre><code>[Authorize(Roles="Accounting")]
  [ClaimAuthorize(Permission="CanUpdateLedger")]
  public ActionResult CreateAsset(Asset entity)
  {
      // Do stuff here
  
      return View();
  }
  </code></pre>
  
  <p><strong>EXAMPLE: Fully-Qualifying Your Claims</strong><br/></p>
  
  <pre><code>[ClaimAuthorize(Permission="Accounting.Ledger.CanUpdate")]
  public ActionResult CreateAsset(Asset entity)
  {
      // Do stuff here
  
      return View();
  }
  </code></pre>