title: Multiple User Roles in Authorize
body: <p>I have a controller which can be accessed by user having admin privileges or nurse. Then on separate action I can do more strict if I want to. Right now what I have is something like this</p>
  
  <pre><code> [AuthorizeUser(UserRole = "Admin", OrganizationType = "Institution")]
  </code></pre>
  
  <p>It works fine. But I would something like</p>
  
  <pre><code> [AuthorizeUser(UserRole = "Admin,Nurse", OrganizationType = "Institution")]
  </code></pre>
  
  <p>AuthorizeUser is custom made authorization</p>
  
  <pre><code>public class AuthorizeUser : AuthorizeAttribute
  {
      public string UserRole { get; set; }
      public string OrganizationType { get; set; }
      protected override bool AuthorizeCore(HttpContextBase httpContext)
      {
          var isAuthorized = base.AuthorizeCore(httpContext);
          if (!isAuthorized)
          {
              return false;
          }
  
          return CheckOrganizationType
              .checkRole(this.UserRole, this.OrganizationType, Auth.CurrentUser);
      }
  }
  
     public static bool checkRole(String role, String organizationType, User user)
      {
          RolesType rt = null;
          OrganizationType ot = null;
          foreach (UserRoles ur in user.GetUserRoles())
          {
              rt = RolesType.Get(ur.organizationTypeId,ur.roleTypeId);
              ot = OrganizationType.Get(ur.organizationTypeId, "1");
          }
  
          if (rt != null &amp;&amp; rt.Name == role &amp;&amp; ot != null &amp;&amp; ot.Name == organizationType)
          {
              return true;
          }
          else
          {
              return false;
          }
      }
  </code></pre>
  
  <p>and then check if the current user has any of the defined roles. How can this be done? Any idea?</p>