title: MVC 3 Authorize custom roles
body: <p>I am new MVC 3 user and I am trying to make admin through SQL database. 
  First of all, I have Customer entity and admin can be defined through admin field which is boolean type in Customer entity.
  I want to make to access admin only in Product page, not normal customer. 
  And I want to make [Authorize(Roles="admin")] instead of [Authorize].
  However, I don't know how can I make admin role in my code really.
  Then in my HomeController, I written this code.</p>
  
  <pre><code>public class HomeController : Controller
  {
  
      [HttpPost]
      public ActionResult Index(Customer model)
      {
          if (ModelState.IsValid)
          {
              //define user whether admin or customer
              SqlConnection conn = new SqlConnection(ConfigurationManager.ConnectionStrings["rentalDB"].ToString());
              String find_admin_query = "SELECT admin FROM Customer WHERE userName = '" + model.userName + "' AND admin ='true'";
              SqlCommand cmd = new SqlCommand(find_admin_query, conn);
              conn.Open();
              SqlDataReader sdr = cmd.ExecuteReader();
              //it defines admin which is true or false
              model.admin = sdr.HasRows;
              conn.Close();
  
              //if admin is logged in
              if (model.admin == true) {
                  Roles.IsUserInRole(model.userName, "admin"); //Is it right?
                  if (DAL.UserIsVaild(model.userName, model.password))
                  {
                      FormsAuthentication.SetAuthCookie(model.userName, true);
                      return RedirectToAction("Index", "Product");
                  }
              }
  
              //if customer is logged in
              if (model.admin == false) {
                  if (DAL.UserIsVaild(model.userName, model.password))
                  {
                      FormsAuthentication.SetAuthCookie(model.userName, true);                   
                      return RedirectToAction("Index", "Home");
                  }
              }
                  ModelState.AddModelError("", "The user name or password is incorrect.");
          }
          // If we got this far, something failed, redisplay form
          return View(model);
      }
  </code></pre>
  
  <p>And DAL class is</p>
  
  <pre><code> public class DAL
  {
      static SqlConnection conn = new SqlConnection(ConfigurationManager.ConnectionStrings["rentalDB"].ToString());
  
      public static bool UserIsVaild(string userName, string password)
      {
          bool authenticated = false;
          string customer_query = string.Format("SELECT * FROM [Customer] WHERE userName = '{0}' AND password = '{1}'", userName, password);      
          SqlCommand cmd = new SqlCommand(customer_query, conn);
          conn.Open();
          SqlDataReader sdr = cmd.ExecuteReader();
          authenticated = sdr.HasRows;
          conn.Close();
          return (authenticated);
      }
  }
  </code></pre>
  
  <p>Finally, I want to make custom [Authorize(Roles="admin")]</p>
  
  <pre><code>[Authorize(Roles="admin")]
  public class ProductController : Controller
  {
    public ViewResult Index()
      {
          var product = db.Product.Include(a =&gt; a.Category);
          return View(product.ToList());
      }
  }
  </code></pre>
  
  <p>These are my source code now. Do I need to make 'AuthorizeAttribute' class?
  If I have to do, how can I make it? Could you explain to me? I cannot understand how to set particular role in my case.
  Please help me how can I do. Thanks.</p>