title: Permission-based authorization in ASP.NET MVC3
body: <p>I am adding ASP.NET MVC to an existing WebForms application. For the time being, I don't care about authentication/logging in, since this part is handled by existing code (Forms authentication).</p>
  
  <p>In the existing WebForms application, we have a fully custom permission-based authorization per page. So each user has a set of rights, listing the pages he is allowed to access.<br>
  Now I need to decide how I can use the same permission system to restrict access to specific MVC controllers and actions.</p>
  
  <p>As I understand, for ASP.NET MVC there is a standard <a href="http://msdn.microsoft.com/en-us/library/system.web.mvc.authorizeattribute.aspx">AuthorizeAttribute</a> where I can specify roles. I also found some articles which suggest specifying permissions instead of roles - then it's possible to do something like this:</p>
  
  <pre><code>[CustomAuthorize(Roles = "View products, Edit products")]
  </code></pre>
  
  <p>By extending AuthorizeAttribute, I can also define how I store and access permissions.</p>
  
  <p>This solution would be acceptable for me (although changing the semantics of roles smells a bit).<br>
  But before committing to it, I'd like to see what other options there are. And that's where I am stuck - I haven't found a full-blown overview of different approaches on authorization in ASP.NET MVC. I would also like to know how all the security concepts (like Forms Authentication, Membership Providers, Authorization Attribute, IPrincipal, etc.) are related to each other and how they are supposed to work together.</p>