title: FormsAuthentication and database backed nested roles
body: <p>I am reading into the FormsAuthentication for migrating a legacy application. This application uses the following structure for roles/permissions of users:</p>
  
  <pre><code>class Account
  {
      public ISet&lt;Role&gt; Roles
      {
          get;
          set;
      }
  
      public static bool Has(Permission permission_)
      {
          foreach (Role role in Roles) {
              if (role.Permissions.Contains(permission_)) {
                  return true;
              }
          }
  
          return false;
      }
  
  }
  
  class Role
  {
      public ISet&lt;Permission&gt; Permissions
      {
          get;
          set;
      }
  }
  
  public enum Permission
  {
      ACCESS_COMPONENT_XYZ
      EDIT_FIELD_ABC
      VIEW_ENTITY_123
  }
  </code></pre>
  
  <p><code>Role</code>s are just a collection of permissions, and in the code itself, only the permissions are checked, e.g.</p>
  
  <pre><code>model.CanEditFieldAbc = account.Has(Permission.EDIT_FIELD_ABC);
  </code></pre>
  
  <p>All of this is backed by the database using NHibernate. Now, as I understand FormsAuthentication, this uses a "one-dimensional" approach to Roles. Meaning, that I only have one field in the AuthenticationToken to fill in my permissions.</p>
  
  <p>I believe that I need to somehow get all the permissions of the Account entity into the current authenticated token. My problem is: How do I do that? I understand how to authenticate, but not how to get my custom set of permissions (as strings e.g.) into that token?</p>
  
  <p>Currently my login controller looks like this:</p>
  
  <pre><code>// "Accounts" is a NHibernate repository on the base controller
  Account account = Accounts.Unique(form_.Name);
  
  if (account != null) {
      byte[] salt = Convert.FromBase64String(account.Salt);
      byte[] password = Convert.FromBase64String(account.Password);
  
      if (PWDTK.ComparePasswordToHash(salt, form_.Password, password)) {
          FormsAuthentication.SetAuthCookie(form_.Name, false);
          // How to get the complete set of "account.Roles -&gt; Permission" into the Cookie/Token?
      }
      else {
          throw new AuthenticateException("Wrong credentials");
      }
  }
  else  {
      throw new AuthenticateException("Wrong credentials");
  }
  </code></pre>
  
  <p>Of course, I could just fetch the current account from the database for every request and then I'd have the set of roles/permissions inside of it (thanks to nhibernate lazy loading etc.), but that seems wrong given that the FormsAuthenticate already provides something similar to this?</p>