Role-Based Access Control in ASP.NET Core with Example

Role-Based Access Control (RBAC) is a powerful authorization strategy that restricts access to application resources based on user roles. Roles (such as Admin, User, or Manager) make it easy to manage permissions across groups of users without manually assigning individual privileges. In ASP.NET Core, implementing RBAC is straightforward with built-in authorization features.

1. What Is Role-Based Access Control (RBAC)?

RBAC lets you organize users into roles and then control which parts of your application each role can access. For instance:

Admin — Full access to all sections
Manager — Access to management pages
User — Basic application access

Instead of hard-coding permissions, roles enable scalable, easy-to-manage authorization rules.

2. Setting Up Roles in ASP.NET Core

Role support is typically implemented using ASP.NET Core Identity, which manages users, passwords, roles, and more.

Enable Roles in Identity
In your Program.cs (or Startup.cs):

builder.Services.AddDefaultIdentity<IdentityUser>()
    .AddRoles<IdentityRole>()
    .AddEntityFrameworkStores<ApplicationDbContext>();

This registers user and role services.

Seed Roles
Use a seed method to create roles when the app starts:

public static async Task SeedRoles(RoleManager<IdentityRole> roleManager)
{
    string[] roleNames = { "Admin", "User", "Manager" };

    foreach (var roleName in roleNames)
    {
        if (!await roleManager.RoleExistsAsync(roleName))
        {
            await roleManager.CreateAsync(new IdentityRole(roleName));
        }
    }
}

Call this method from Main or wherever your application bootstraps.

3. Assigning Roles to Users

After users register, you’ll want to assign them roles — typically via admin UI or during seeding:

var user = await userManager.FindByEmailAsync("[email protected]");
if (user != null)
{
    await userManager.AddToRoleAsync(user, "Admin");
}

This ensures the user belongs to the Admin role.

4. Restricting Access Using Roles

ASP.NET Core authorization works through attributes that decorate controllers or actions.

Secure an Entire Controller

[Authorize(Roles = "Admin")]
public class AdminController : Controller
{
    public IActionResult Index()
    {
        return View();
    }
}

Only users with the “Admin” role can access AdminController.

Secure Individual Actions

public class ReportsController : Controller
{
    [Authorize(Roles = "Manager")]
    public IActionResult ManagerReport()
    {
        return View();
    }

    [Authorize(Roles = "User,Manager")]
    public IActionResult SharedReport()
    {
        return View();
    }
}

You can put multiple roles separated by comma — meaning any matching role is allowed.

5. Example: Simple RBAC in a MVC App

Step 1: Create a New MVC Project

dotnet new mvc -n RbacDemo

Add Identity support:

dotnet add package Microsoft.AspNetCore.Identity.EntityFrameworkCore

Step 2: Add Identity & Roles

In Program.cs, register Identity:

builder.Services.AddDbContext<ApplicationDbContext>(options =>
    options.UseSqlServer(builder.Configuration.GetConnectionString("DefaultConnection")));

builder.Services.AddDefaultIdentity<IdentityUser>()
    .AddRoles<IdentityRole>()
    .AddEntityFrameworkStores<ApplicationDbContext>();

Step 3: Create Some Roles

Seed roles at startup:

using (var scope = app.Services.CreateScope())
{
    var roleManager = scope.ServiceProvider.GetRequiredService<RoleManager<IdentityRole>>();
    await SeedRoles(roleManager);
}

Step 4: Protect Controller Actions

AdminController.cs

[Authorize(Roles = "Admin")]
public class AdminController : Controller
{
    public IActionResult Index()
    {
        return View();
    }
}

ManagerController.cs

[Authorize(Roles = "Manager")]
public class ManagerController : Controller
{
    public IActionResult Index()
    {
        return View();
    }
}

6. Testing and UI

After logging in as a user with a role, try accessing protected routes.
For role-specific UI, you can check the current user’s role in views:

@if (User.IsInRole("Admin"))
{
    <a href="/Admin">Admin Dashboard</a>
}

This shows navigation only to Admin users.

7. Advanced RBAC Concepts

While simple role attributes are often sufficient, ASP.NET Core also supports:

Policies – combine roles and other requirements
Claims-based authorization – more granular than roles
Custom handlers – for complex logic beyond roles

These allow fine-grained control in larger applications.

Conclusion

Role-Based Access Control in ASP.NET Core provides a flexible way to protect application resources. By defining roles, assigning users, and using authorization attributes, you can easily restrict access to pages, APIs, and features based on user responsibilities. This improves security and aligns application behavior with business rules — essential in multi-user systems.