title: MVC3 Custom AuthorizeAttribute : how to pass in an object from controller
body: <p>I have an object that contains all login data, that's in my controller (it was programmed before switching to MVC3). </p>
  
  <p>I'm trying to add authorization to the site, so so far I have:</p>
  
  <pre><code>public LoginObject MyLoginObject
  {
     get;
     set;
  }
  
  [CustomAuthorization()]
  public ActionResult Index()
  {
   return View();
  }
  </code></pre>
  
  <p>and</p>
  
  <pre><code>public class CustomAuthorization : AuthorizeAttribute
  {
     protected override bool AuthorizeCore(HttpContextBase httpContext)
     {
      return true;
      //should be return myLoginObject.IsLoggedIn;
     }
  }
  </code></pre>
  
  <p>Is there anyway to pass MyLoginObject into the AuthorizeAttribute class? If not could I at least pass in a boolean from the object that specifies if the user is authorized or not?</p>
  
  <p><strong>Edit:</strong> My solution based on Zonnenberg's advice.</p>
  
  <pre><code>public class LoginObject : IPrincipal // Now extends IPrincipal 
  {
     ... //old code
     private class IdentityImpl : IIdentity
  {
    public string AuthenticationType
    {
      get;
      set;
    }
  
    public bool IsAuthenticated
    {
      get;
      set;
    }
  
    public string Name
    {
      get;
      set;
    }
  }
  
  public IIdentity Identity
  {
    get { return new IdentityImpl { AuthenticationType = "Custom Authentication", IsAuthenticated = this.IsLoggedIn, Name = this.Id}; }
  }
  }
  </code></pre>
  
  <p>Then I moved the instantiation of loginobject into CustomAuthorization</p>
  
  <pre><code>public override void OnAuthorization(AuthorizationContext filterContext)
  {
    // ... Set up LoginObject
      filterContext.RequestContext.HttpContext.User = myLoginObject;
  
    base.OnAuthorization(filterContext);
  }
  </code></pre>
  
  <p>So now logging in, is done inside the authorization, and I can call User to access the login from the controller.</p>