title: asp.net mvc user authentication/permission
body: <p>i'm new to asp.net mvc and starting the following project. The company wants an intra-net website for various groups of people to upload files to a database, run reports off the it and amend data in several master tables in the database. The company use Active Directory and do not want the users to log in again to use the web site. The website will have different sections for various groups and the user's access to a particular page should be controlled from a database.</p>
  
  <p>So far this is what i've come up with</p>
  
  <ol>
  <li>changed the membership provider to link to the active directory server (<a href="http://helios.ca/2009/05/04/aspnet-mvc-forms-authentication-with-active-directory/" rel="nofollow noreferrer">based on Mike's blog post</a>)</li>
  <li>removed AccountController and the Views/Account folder</li>
  <li>created a custom authentication class based on <a href="http://schotime.net/blog/index.php/2009/02/17/custom-authorization-with-aspnet-mvc/" rel="nofollow noreferrer">this link</a></li>
  </ol>
  
  <p>I need to pull from a table in the database, based on user's AD id, his "role" (int), then cast it into the relevant SiteRoles. Would implementing this query in CustomAuthorizeAttribute be adviseable? is there a better place to pull the data from the table and store it somewhere so it can be reused rather than having to run a database query every time AuthorizeCore is called (which will happen whenever a user invokes a controller/action)?</p>