How do I serve up an Unauthorized page when a user is not in the Authorized Roles?

Question

I am using the Authorize attribute like this:

[Authorize (Roles=\"Admin, User\")]
Public ActionResult Index(int id)
{
    // blah
}

Answer 1

You could do this in two ways:

1. Specify the error the HandleError-attribute, and give a view that should be shown:

   [HandleError(ExceptionType = typeof(UnAuthorizedException), View = "UnauthorizedError")]

You can specify several different ExceptionTypes and views

2. Create a custom ActionFilter, check there for credentials, and redirect to a controller if the user is unauthorized.: http://web.archive.org/web/20090322055514/http://msdn.microsoft.com/en-us/library/dd381609.aspx