ACL in ASP.NET MVC 3

Question

I am looking for a solution in asp.net mvc for acl like the cakephp is giving by her ACL component.

I want to create the acl so I can assign permission on role and user basis.

Thanks

Vientiane

I'm not familiar with CakePHP's capabilities, yet I must ask, why not use the [Authorize(Roles=..., Users=...)] attribute for controllers? – Nesto

Also, you might find this answer useful: #1335815 – Nesto

Answer 1

CakePHP's ACL is quite powerful. I haven't seen anything ready-to-use for MVC.NET that does something similar. For those of you who think that MVC.NET's AuthorizeAttribute is equivalent, please read the cakephp doc's and be enlightened. :)

Puisne

If you're going to build something custom, I'd spend a bit of time watching Zed Shaw's talk on ACLs: vimeo.com/2723800 . The important take away is that the rules themselves need to be clear and reviewable by quazi-technical humans. – Puisne

Answer 2

This tutorial: MVC3: Login System with the AuthorizeAttribute demonstrates how to use the AuthorizeAttribute with the Roles and Users, which is equivalent to ACL.

Tawny

It is not equivalent. ACL means that you'll look up the data entity that action needs and then lookup the permission dynamically. For example, if an action is ListFiles(string folder), you'd lookup the permission for the current user on the specified folder to resolve authorization. I don't think AuthorizeAttribute can do ACL. – Edify