使用自定义表在MVC和Web API中实现基于角色的授权

Question

I have inherited an application with database. The database has following tables related to authentication and authorization.

User Table

UserName

Password

UserTypeId

UserType Table

UserTypeId

UserTypeDesc

The User Type table stores the roles for the user eg Admin, Editor, etc.

If I want to implement authorization like below

[Authorize(Roles="Admin, Editor")]
    public IHttpActionResult GetOrders()
        {
          //Code here
        }

Where and what should I code so that the roles are available to the authorize attribute ?

Edit

I already have a database. So I cannot use the AspNetUserRoles or AspNetRoles tables. I need to set the roles using my custom tables.

Edit2

As asked by @Nkosi, here is code snippet of how authentication is implemented. The actual implementation calls the business layer service and performs encryption and other stuff but I have simplified the snippet

public HttpResponseMessage Authenticate(User user)
{ 
    var isValid = myRepository.Exists(a => a.UserName == user.UserName &&       a.Password == user.Password);
   if(isValid)
  {
    FormsAuthentication.SetAuthCookie(user.UserName,false);
   }
}

This method is called from the login page where user enters the UserName and Password

Answer 1

Your question was very easy. You just need to sync these 2 tables with AspNetUserRoles and AspNetRoles tables respectively. Actually, Authorize attribute by default checks these two tables. So your roles need to reflect in them. These tables are made by default by EF if you select MVC template project.

Answer 2

Using these Answers for reference

Having Trouble with Forms Authentication Roles

FormsAuthentication Roles without Membership

After having set the auth cookie on login like you did originally,

you do the following in your Global.asax.cs

protected void Application_AuthenticateRequest(object sender, EventArgs e)
{
    var authCookie = HttpContext.Current.Request.Cookies[FormsAuthentication.FormsCookieName];

    if (authCookie != null)
    {
        var ticket = FormsAuthentication.Decrypt(authCookie.Value);

        FormsIdentity formsIdentity = new FormsIdentity(ticket);

        ClaimsIdentity claimsIdentity = new ClaimsIdentity(formsIdentity);

        //get the user from your custom tables/repository
        var user = myUserRepository.GetUserByEmail(ticket.Name);
        if(user!=null){
            var userTypeId = user.UserTypeId;
            var role = myUserTypeRepository.GetUserTypeById(userTypeId);
            if(role != null) {
                //Assuming the roles for the user e.g. Admin, Editor, etc. 
                // is in the UserTypeDesc property
                claimsIdentity.AddClaim(new Claim(ClaimTypes.Role, role.UserTypeDesc));
            }
        }    
        ClaimsPrincipal claimsPrincipal = new ClaimsPrincipal(claimsIdentity);

        System.Threading.Thread.CurrentPrincipal = claimsPrincipal ;
        if (System.Web.HttpContext.Current != null) {
            System.Web.HttpContext.Current.User = claimsPrincipal ;
        }
    }
}

The nice thing about how they implemented it is that it handles Claims based roles using the ClaimsIdentity and ClaimsPrincipal objects, without putting the roles in the user's cookie. It also handles authentication in the Global.asax.cs file without having to resort to putting in custom authorize attributes.