ASP.NET MVC Roles without database (and without role provider)

Question

I have a super simple ASP.NET MVC application that uses RpxNow (OpenID) to allow users to login. I now want to let users edit their own account and provide administrator access to edit anyone's account.

I have two separate "Edit Account" views:

• ~/account/edit/
• ~/account/edit/1

The first loads the account details based on the logged in user. The second loads the account details using the supplied AccountId. The first would be for standard users, and the second for an administrator.

Firstly I need to define the roles (User, Admin) and then I need to assign a user account (or multiple) to that role.

Then I need to check the role in the controller. I like this concept:

http://schotime.net/blog/index.php/2009/02/17/custom-authorization-with-aspnet-mvc/

So, down to the questions:

1. Is there a simple way to define a list of roles in the web.config?
2. Is there a simple way to define which users are in which roles in the web.config?
3. Is there a way to do this WITHOUT using Membership / Role providers?
4. Am I approaching this from the wrong perspective? Should I be partioning the application into two branches and securing them based on folder authorisation?

Answer 1

I'm not a friend of storing authorization data in web.config. I prefer storing it in database or other xml files.

Have a look at Xml Membership / Role Provider. This uses Membership / Role for reading userdata but it shows a way storing and reading user authorization data from xml files.

Braching the application woulded move the issue and not solve.

Answer 2

Remember that the entire permissions plumbing still really revolves around IPrincipals, the Role/Membership providers are just window dressing to allow most applications to not have to write that plumbing code. In this case, you could easily add a database-backed (or just static if the list is short enough) list of roles and a list of users in roles and query that. Wrap it up behind a custom IPrincipal and stuff that puppy in there at the appropriate place and you are golden.