Rolebased Login Page Access in MVC

Step 1: Create Table.

query

CREATE TABLE [dbo].[Roles](
[RoleID] [int] IDENTITY(1,1) NOT NULL,
[ROleName] [varchar](50) NOT NULL,
PRIMARY KEY CLUSTERED
(
[RoleID] ASC
)WITH (PAD_INDEX = OFF, STATISTICS_NORECOMPUTE = OFF, IGNORE_DUP_KEY = OFF, ALLOW_ROW_LOCKS = ON, ALLOW_PAGE_LOCKS = ON) ON [PRIMARY]
) ON [PRIMARY]
GO
SET ANSI_PADDING OFF
GO
/****** Object: Table [dbo].[UserRoles] Script Date: 7/4/2015 5:55:16 PM ******/
SET ANSI_NULLS ON
GO
SET QUOTED_IDENTIFIER ON
GO
CREATE TABLE [dbo].[UserRoles](
[UserRolesID] [int] IDENTITY(1,1) NOT NULL,
[RoleID] [int] NOT NULL,
[UserID] [int] NOT NULL,
PRIMARY KEY CLUSTERED
(
[UserRolesID] ASC
)WITH (PAD_INDEX = OFF, STATISTICS_NORECOMPUTE = OFF, IGNORE_DUP_KEY = OFF, ALLOW_ROW_LOCKS = ON, ALLOW_PAGE_LOCKS = ON) ON [PRIMARY]
) ON [PRIMARY]
GO
/****** Object: Table [dbo].[Users] Script Date: 7/4/2015 5:55:16 PM ******/
SET ANSI_NULLS ON
GO
SET QUOTED_IDENTIFIER ON
GO
SET ANSI_PADDING ON
GO
CREATE TABLE [dbo].[Users](
[UserID] [int] IDENTITY(1,1) NOT NULL,
[Username] [varchar](50) NOT NULL,
[Password] [varchar](50) NOT NULL,
[FirstName] [varchar](50) NOT NULL,
[LastName] [varchar](50) NULL,
[EmailID] [varchar](200) NULL,
PRIMARY KEY CLUSTERED
(
[UserID] ASC
)WITH (PAD_INDEX = OFF, STATISTICS_NORECOMPUTE = OFF, IGNORE_DUP_KEY = OFF, ALLOW_ROW_LOCKS = ON, ALLOW_PAGE_LOCKS = ON) ON [PRIMARY]
) ON [PRIMARY]
GO
SET ANSI_PADDING OFF
GO
SET IDENTITY_INSERT [dbo].[Roles] ON
GO
INSERT [dbo].[Roles] ([RoleID], [ROleName]) VALUES (1, N'Admin')
GO
INSERT [dbo].[Roles] ([RoleID], [ROleName]) VALUES (2, N'User')
GO
SET IDENTITY_INSERT [dbo].[Roles] OFF
GO
SET IDENTITY_INSERT [dbo].[UserRoles] ON
GO
INSERT [dbo].[UserRoles] ([UserRolesID], [RoleID], [UserID]) VALUES (1, 1, 1)
GO
INSERT [dbo].[UserRoles] ([UserRolesID], [RoleID], [UserID]) VALUES (2, 2, 2)
GO
SET IDENTITY_INSERT [dbo].[UserRoles] OFF
GO
SET IDENTITY_INSERT [dbo].[Users] ON
GO
INSERT [dbo].[Users] ([UserID], [Username], [Password], [FirstName], [LastName], [EmailID]) VALUES (1, N'knk', N'knk', N'sample', N'sample1', N'[email protected]')
GO
INSERT [dbo].[Users] ([UserID], [Username], [Password], [FirstName], [LastName], [EmailID]) VALUES (2, N'kumar', N'kumar', N'run', N'ran', N'[email protected]')
GO
SET IDENTITY_INSERT [dbo].[Users] OFF
GO

Step 2: Create a project.

Go to File, then New and click Project. Select ASP.NET MVC 4 Web Application and enter the project name, then click OK, select Empty, select View Engine Razor and press OK.

Step 3: Add model

using System;
using System.Collections.Generic;
using System.ComponentModel.DataAnnotations;
using System.Linq;
using System.Web;
namespace MvcApplication2.Models {
public class login {
[Required(ErrorMessage = "Username required.", AllowEmptyStrings = false)]
public string Username {
get;
set;
}
[Required(ErrorMessage = "Password required.", AllowEmptyStrings = false)]
[DataType(System.ComponentModel.DataAnnotations.DataType.Password)]
public string Password {
get;
set;
}
public bool RememberMe {
get;
set;
}
}
}

Step 4: Add Home Controller.

add controller

Home Contrtoller.cs

using System;
using System.Collections.Generic;
using System.Linq;
using System.Web;
using System.Web.Mvc;
namespace MvcAuthentication.Controllers {
public class HomeController: Controller {
[AllowAnonymous] //This is for Un-Authorize User
public ActionResult Index() {
return View();
}
[Authorize] // This is for Authorize user
public ActionResult MyProfile() {
return View();
}
[Authorize(Roles = "Admin")]
public ActionResult AdminIndex() {
return View();
}
[Authorize(Roles = "User")]
public ActionResult UserIndex() {
return View();
}
}
}

Step 5: Add view.

add

Index.cshtml;

@{
ViewBag.Title = "Index";
}
<h2>Index</h2>
<h3>Welcome Guest - This is for all the anonymous user</h3>
Myprofile.cshtml
@{
ViewBag.Title = "MyProfile";
}
<h2>My Profile</h2>
<h3>Welcome @(Request.IsAuthenticated ? HttpContext.Current.User.Identity.Name : "Guest") - This is for Authorized user </h3>

Userindex.cshtml

@{
ViewBag.Title = "UserIndex";
}
<h2>User Index</h2>
<div>Welcome @(Request.IsAuthenticated? HttpContext.Current.User.Identity.Name : "") (User) </div>

Admin.cshtml

@{
ViewBag.Title = "AdminIndex";
}
<h2>Admin Index</h2>
<div>Welcome @(Request.IsAuthenticated? HttpContext.Current.User.Identity.Name : "") (Admin)</div>

Step 6: Add Myaccount Controller:

MyAccountController.cs

using MvcAuthentication.Models;
using System;
using System.Collections.Generic;
using System.Linq;
using System.Web;
using System.Web.Mvc;
using System.Web.Security;
namespace MvcAuthentication.Controllers {
public class MyAccountController: Controller {
public ActionResult Login() {
return View();
}
[HttpPost]
[ValidateAntiForgeryToken]
public ActionResult Login(Login l, string ReturnUrl = "") {
//Here I am going to use Membership provider to validate user
if (ModelState.IsValid) {
var isValidUser = Membership.ValidateUser(l.Username, l.Password);
if (isValidUser) {
FormsAuthentication.SetAuthCookie(l.Username, l.RememberMe);
if (Url.IsLocalUrl(ReturnUrl)) {
return Redirect(ReturnUrl);
} else {
return RedirectToAction("Index", "Home");
}
}
}
ModelState.Remove("Password");
return View();
}
[Authorize]
public ActionResult Logout() {
FormsAuthentication.SignOut();
return RedirectToAction("Index", "Home");
}
}
}

Step 7: Add view Myaccount.

Login.cshtml;

@model MvcAuthentication.Models.Login
@{
ViewBag.Title = "Login";
}
<h2>Login</h2>
@using (Html.BeginForm()) {
@Html.ValidationSummary(true)
@Html.AntiForgeryToken()
<fieldset>
<legend>Login</legend>
<div class="editor-label">
@Html.LabelFor(model => model.Username)
</div>
<div class="editor-field">
@Html.EditorFor(model => model.Username)
@Html.ValidationMessageFor(model => model.Username)
</div>
<div class="editor-label">
@Html.LabelFor(model => model.Password)
</div>
<div class="editor-field">
@Html.EditorFor(model => model.Password)
@Html.ValidationMessageFor(model => model.Password)
</div>
<div class="editor-label">
@Html.LabelFor(model => model.RememberMe)
</div>
<div class="editor-field">
@Html.EditorFor(model => model.RememberMe)
@Html.ValidationMessageFor(model => model.RememberMe)
</div>
<p>
<input type="submit" value="Create" />
</p>
</fieldset>
}
<div>
@Html.ActionLink("Back to List", "Index")
</div>
@section Scripts {
@Scripts.Render("~/bundles/jqueryval")
}

Step 8: Add Entity Data Model.

table

Step 9: Add two cs Files.

MyRoleProvider.cs

using System;
using System.Collections.Generic;
using System.Linq;
using System.Web;
using System.Web.Caching;
using System.Web.Security;
namespace MvcAuthentication {
public class MyRoleProvider: RoleProvider {
private int _cacheTimeoutInMinute = 20;
public override void AddUsersToRoles(string[] usernames, string[] roleNames) {
throw new NotImplementedException();
}
public override string ApplicationName {
get {
throw new NotImplementedException();
}
set {
throw new NotImplementedException();
}
}
public override void CreateRole(string roleName) {
throw new NotImplementedException();
}
public override bool DeleteRole(string roleName, bool throwOnPopulatedRole) {
throw new NotImplementedException();
}
public override string[] FindUsersInRole(string roleName, string usernameToMatch) {
throw new NotImplementedException();
}
public override string[] GetAllRoles() {
throw new NotImplementedException();
}
public override string[] GetRolesForUser(string username) {
if (!HttpContext.Current.User.Identity.IsAuthenticated) {
return null;
}
//check cache
var cacheKey = string.Format("{0}_role", username);
if (HttpRuntime.Cache[cacheKey] != null) {
return (string[]) HttpRuntime.Cache[cacheKey];
}
string[] roles = new string[] {};
using(RBACEntities dc = new RBACEntities()) {
roles = (from a in dc.Roles
join b in dc.UserRoles on a.RoleID equals b.RoleID
join c in dc.Users on b.UserID equals c.UserID
where c.Username.Equals(username)
select a.ROleName).ToArray < string > ();
if (roles.Count() > 0) {
HttpRuntime.Cache.Insert(cacheKey, roles, null, DateTime.Now.AddMinutes(_cacheTimeoutInMinute), Cache.NoSlidingExpiration);
}
}
return roles;
}
public override string[] GetUsersInRole(string roleName) {
throw new NotImplementedException();
}
public override bool IsUserInRole(string username, string roleName) {
var userRoles = GetRolesForUser(username);
return userRoles.Contains(roleName);
}
public override void RemoveUsersFromRoles(string[] usernames, string[] roleNames) {
throw new NotImplementedException();
}
public override bool RoleExists(string roleName) {
throw new NotImplementedException();
}
}
}

MyMembershipProvider.cs

using System;
using System.Collections.Generic;
using System.Linq;
using System.Web;
using System.Web.Security;
namespace MvcAuthentication {
public class MyMembershipProvider: MembershipProvider {
public override string ApplicationName {
get {
throw new NotImplementedException();
}
set {
throw new NotImplementedException();
}
}
public override bool ChangePassword(string username, string oldPassword, string newPassword) {
throw new NotImplementedException();
}
public override bool ChangePasswordQuestionAndAnswer(string username, string password, string newPasswordQuestion, string newPasswordAnswer) {
throw new NotImplementedException();
}
public override MembershipUser CreateUser(string username, string password, string email, string passwordQuestion, string passwordAnswer, bool isApproved, object providerUserKey, out MembershipCreateStatus status) {
throw new NotImplementedException();
}
public override bool DeleteUser(string username, bool deleteAllRelatedData) {
throw new NotImplementedException();
}
public override bool EnablePasswordReset {
get {
throw new NotImplementedException();
}
}
public override bool EnablePasswordRetrieval {
get {
throw new NotImplementedException();
}
}
public override MembershipUserCollection FindUsersByEmail(string emailToMatch, int pageIndex, int pageSize, out int totalRecords) {
throw new NotImplementedException();
}
public override MembershipUserCollection FindUsersByName(string usernameToMatch, int pageIndex, int pageSize, out int totalRecords) {
throw new NotImplementedException();
}
public override MembershipUserCollection GetAllUsers(int pageIndex, int pageSize, out int totalRecords) {
throw new NotImplementedException();
}
public override int GetNumberOfUsersOnline() {
throw new NotImplementedException();
}
public override string GetPassword(string username, string answer) {
throw new NotImplementedException();
}
public override MembershipUser GetUser(string username, bool userIsOnline) {
throw new NotImplementedException();
}
public override MembershipUser GetUser(object providerUserKey, bool userIsOnline) {
throw new NotImplementedException();
}
public override string GetUserNameByEmail(string email) {
throw new NotImplementedException();
}
public override int MaxInvalidPasswordAttempts {
get {
throw new NotImplementedException();
}
}
public override int MinRequiredNonAlphanumericCharacters {
get {
throw new NotImplementedException();
}
}
public override int MinRequiredPasswordLength {
get {
throw new NotImplementedException();
}
}
public override int PasswordAttemptWindow {
get {
throw new NotImplementedException();
}
}
public override MembershipPasswordFormat PasswordFormat {
get {
throw new NotImplementedException();
}
}
public override string PasswordStrengthRegularExpression {
get {
throw new NotImplementedException();
}
}
public override bool RequiresQuestionAndAnswer {
get {
throw new NotImplementedException();
}
}
public override bool RequiresUniqueEmail {
get {
throw new NotImplementedException();
}
}
public override string ResetPassword(string username, string answer) {
throw new NotImplementedException();
}
public override bool UnlockUser(string userName) {
throw new NotImplementedException();
}
public override void UpdateUser(MembershipUser user) {
throw new NotImplementedException();
}
// Here In this example we will use only ValidateUser method, we will see remaining later like create user,
//update user change password and more
public override bool ValidateUser(string username, string password) {
//Will write code for validate user from our own database
using(RBACEntities dc = new RBACEntities()) {
var user = dc.Users.Where(a = > a.Username.Equals(username) && a.Password.Equals(password)).FirstOrDefault();
if (user != null) {
return true;
}
}
return false;
}
}
}

Step 10: Web Config File.

code