To authorize all users, just omit using the [Authorize] attribute alltogether. To authorize authenticated users, use the [Authorize] attribute. To authorize specific roles or users, that is when you'll have [Authorize (Users = "someuser")] or [Authorize (Roles = "somerole")].