title: Claim based authorization design for conditional edit operation in ASP.NET MVC App
body: <p>Designing an ASP.Net MVC application authorization using claim based model. Lets say that we have an object called - Product. Typically, there are 4 different actions - Create, Edit, Delete and View. Authorization is done using ClaimsAuthorize attribute.</p>
  
  <pre><code>[Authorize]
  public class ProductController : Controller
  {
  
       [ClaimsAuthorize("Product", "VIEW")]
       public List&lt;Product&gt; GetProducts()
       {
           // ....
       }
  
       [ClaimsAuthorize("Product", "CREATE")]
       public Product CreateNewProduct(Product product)
       {
           //....
       }
  }
  </code></pre>
  
  <p>But in my case, I have to support different types of EDIT permissions:</p>
  
  <ol>
  <li><p>Some Users can Edit the product if the same user has created the Product originally </p></li>
  <li><p>Some users can Edit the product if the Product belongs to a specific category and the user also has access to the same category</p></li>
  <li><p>Some users can Edit all the products (this is the normal Product Edit operation)</p></li>
  </ol>
  
  <p>How do you elegantly authorize all these Edit operations (preferably attribute driven as shown above) and at the same time I want to keep the authorization code separate from the normal MVC controller code and business logic.</p>
  
  <p>[Above code sample is not syntactically correct, I just made it up for the purpose of explaining this question]
  Let me know your thoughts.</p>