title: How to control access to forms fields on a ASP.Net MVC 3 view?
body: <p><strong>Example</strong></p>
  
  <p>User "jtirado" is assigned role "HR-Assistant", can access route "mymvcapp/employeee/edit/1452" to edit employee (id:1452) data. </p>
  
  <p>Being "HR-Assistant", this user can change employee telephone number and e-mail, can view employee salary but not edit the amount.</p>
  
  <p>Telephone number, email, salary are dabatase fields and are represented/rendered by a "asp.net-mvc-control" or "HTML-control" on the View. So I want to restrict access to these controls based on user's role.</p>
  
  <p><strong>Previous experience</strong></p>
  
  <p>I've done this before for a classic 3-tier ASP.Net 3.5 web forms application, using a MasterPage, a BasePage class and a RoleBasedAccessControl database model.</p>
  
  <p>MasterPage builds the options menu the user has access according to his assigned role.</p>
  
  <p>BasePage class checks if the user has access to the required page, and if so, checks which controls (ex: DdlClientType, TxtLastName,ChkIsActive) the user can edit.</p>
  
  <p>This way, I don't have to use if-then sentences to check permissions and, I can create as many roles as I want, giving them any permissions, without having to change any C# code.</p>
  
  <p>I'm planning to use the same RoleBasedAccessControl database model for this new MVC app. </p>
  
  <p><strong>Problem</strong></p>
  
  <p>So my dubts are about how to implement the MasterPage and BasePage class using ASP.Net MVC 3 or if there's another way of achieving this, and if I should do it other way.</p>
  
  <p>It seems to me that ViewMasterPage is the MVC-equivalent to Web-Forms-MasterPages. I've also heard about Razor layout pages.</p>
  
  <p>Anyway, I suppose I should handle all of this in a Controller.</p>
  
  <p>I will be using:</p>
  
  <ol>
  <li>ASP.NET MVC 3.0 </li>
  <li>Razor</li>
  </ol>
  
  <p>I've checked these posts:</p>
  
  <p><a href="https://stackoverflow.com/questions/547049/asp-net-mvc-user-permissions-and-views">asp.net mvc user permissions and views</a></p>
  
  <p><a href="https://stackoverflow.com/questions/368904/best-practices-for-controlling-access-to-form-fields">Best Practices for controlling access to form fields</a></p>
  
  <p><a href="https://stackoverflow.com/questions/273534/best-practices-for-control-permissions">Best practices for control permissions?</a></p>
  
  <p><a href="https://stackoverflow.com/questions/452698/asp-net-mvc-master-pages">ASP.NET MVC Master Pages</a></p>
  
  <p><a href="http://www.codeproject.com/Articles/288631/Secure-ASP-NET-MVC3-applications" rel="nofollow noreferrer">Implement secure ASP.NET MVC applications</a></p>
  
  <p>But they don't fully fit my case.</p>