title: How to extend AuthorizeAttribute and check the user's roles
body: <p>I am busy writing my own custom attribute for my action method called MyAuthorizeAttribute, I am still busy writing the code, here is my partial code:</p>
  
  <pre><code>[AttributeUsage(AttributeTargets.Method, AllowMultiple = false)]
  public class  MyAuthorizeAttribute : AuthorizeAttribute
  {
     public new Role Roles;
  
     public override void OnAuthorization(AuthorizationContext filterContext)
     {
        base.OnAuthorization(filterContext);
  
        if (Roles != 0)  // Did it this way to see what the value of Roles was
           return;
  
        // Here I am going to get a list of user roles
        // I'm doing my own database calls
  
        filterContext.Result = new HttpUnauthorizedResult();
     }
  }
  </code></pre>
  
  <p>Here is my Role enum:</p>
  
  <pre><code>public enum Role
  {
     Administrator = 1,
     SuperAdministrator = 2
  }
  </code></pre>
  
  <p>My action method:</p>
  
  <pre><code>[MyAuthorize(Roles = Role.Administrator|Role.SuperAdministrator)]
  public ActionResult Create()
  {
     return View();
  }
  </code></pre>
  
  <p>The reason why I did not use Roles = "Administrator,SuperAdministrator" was because the roles are hard-coded.  I don't want to have a 100 places to change if the role name changes.</p>
  
  <p>Given my method, when it gets to if (Roles != 0) then Roles total value is 3, how would I check to see if these 2 roles is in the list of user roles for a specific user?</p>
  
  <p>Am I doing it correct here?  If not how would I otherwise implement this?  It doesn't have to be the way that I did it in.</p>