In this article, We'll look into how to create a new role, delete a role
and attach a user to a specific role in ASP.NET MVC using default Role
provider under System.Web.Security namespace.
The objective of this article is to explain how to work with Roles in ASP.NET MVC 4 +.
Here we are assuming that we have used the default ASP.NET MVC template (ASP.NET MVC 4 Web Application project type and Internet Application template) that automatically creates a database for us when we try to register for the first time and the default database tables it creates for roles are following
Picture - 1
The above code simply executes
Introduction
Authentication
(Login and Registration) is simple in ASP.NET MVC as the default project
template provides all the necessary controller code, model and view to
register and login. However adding roles and assigning roles to a
particular user seems to be lost in all these stuffs. In this article,
we will learn all that is related with Roles for a particular user in
ASP.NET MVC 4.
Objective
Assumption
Here we are assuming that we have used the default ASP.NET MVC template (ASP.NET MVC 4 Web Application project type and Internet Application template) that automatically creates a database for us when we try to register for the first time and the default database tables it creates for roles are following
- webpages_Roles
- webpages_UserInRoles
Creating a new role in ASP.NET MVC
In
order to create a new Role, the default template doesn't provide any
UI, so we have to build it our self. Below is the simple UI we have
built in Razor under Views/Account folder (In fact all views we
are going to work with in this article are in this folder). In this case
we have used a different Layout page as we do not want the default
website Layout to appear.
@{ ViewBag.Title = "RoleCreate"; Layout = "~/Views/Shared/_LayoutAdmin.cshtml"; } <div class="spacerBody"> </p> @Html.ActionLink("Roles", "RoleIndex") | @Html.ActionLink("Add Role to User", "RoleAddToUser")Role Create</h2> @using(Html.BeginForm()){ @Html.AntiForgeryToken() @Html.ValidationSummary(true)
Role name</div> @Html.TextBox("RoleName") </p> > } </div>
Picture - 1
Notice
that we have a simple TextBox in the above View with the name as
"RoleName" that we are going to use to create a new Role into our
database.
Below are two methods in our
AccountController.cs responsible for creating a new Role.[Authorize(Roles = "Admin")] public ActionResult RoleCreate() { return View(); } [Authorize(Roles = "Admin")] [HttpPost] [ValidateAntiForgeryToken] public ActionResult RoleCreate(string RoleName) { Roles.CreateRole(Request.Form["RoleName"]); // ViewBag.ResultMessage = "Role created successfully !"; return RedirectToAction("RoleIndex", "Account"); }
The first method simply renders the view provided the logged in user has Roles as "Admin" assigned to the database (because of
Authorize attribute in this method). So to get started first go to your database table "webpages_Roles" and insert and "Admin" role then map this role to the user id you are logged in with in the "webpages_UsersInRoles" table.
In above case, I am logged in to the application as "SheoNarayan" that has UserId as "2" in the
"UserProfile" table that is created by default by ASP.NET MVC project.
Now when Save button is clicked in Picture - 1, the 2nd method of the above code snippet fires and calls the
"Roles.CreateRole" method to create a role that is entered into the Textbox.Listing Roles in ASP.NET MVC
To list roles created in ASP.NET MVC, we have created another view called "RoleIndex" and here is the Razor code for this.
@{ ViewBag.Title = "Role Listing"; Layout = "~/Views/Shared/_LayoutAdmin.cshtml"; } </p> <div class="spacerBody"> @Html.ActionLink("Create New Role", "RoleCreate") | @Html.ActionLink("Add Role to User", "RoleAddToUser")Role Index</h2>
@foreach (string s in Model) {div> <div class="td"> <span onclick="return confirm('Are you sure to delete?')"> <a href="/Account/RoleDelete?RoleName=@s" class="delLink"><img src="/images/deleteicon.gif" alt="Delete" class="imgBorder0" /> Delete</a> </span> </div> </div> } </div> </div>@s </
In
this view, we are simply looping through the Model we are receiving
from the controller. The controller method that is responsible to render
all the roles are below.
[Authorize(Roles = "Admin")] public ActionResult RoleIndex() { var roles = Roles.GetAllRoles(); return View(roles); }
Roles.GetAllRoles() method that gives all roles from the webpages_Roles database table in the form of string array and returns to the view. The same is being used to list the roles on the view.
You must have noticed that we have also added a
Delete link against each Role so that we can delete a role too. The Delete link passes the Role name as querystring to the RoleDelete method of the controller, lets see that too.Delete a Role in ASP.NET MVC
To delete a role, we have just created a method in the controller named
"RoleDelete" and making sure that it gets executed only when an Admin user is trying to browse it.[Authorize(Roles = "Admin")] public ActionResult RoleDelete(string RoleName) { Roles.DeleteRole(RoleName); // ViewBag.ResultMessage = "Role deleted succesfully !"; return RedirectToAction("RoleIndex", "Account"); }
This method takes "RoleName" as parameter and calls
Roles.DeleteRole method to delete a role.
Note
that there is no method in the Roles class called "EditRole" or
"UpdateRole" so be careful while creating a new role and deleting a new
role.
Assigning a Role to the User in ASP.NET MVC
Now,
lets see how to assign a role to the user, to do that we have created a
simple form that has a TextBox to accept username and a DropDown that
lists all the roles from the database and it looks like below. In the
same view, we have also created another form that accepts username and
list all the roles associated with that username.
@{ ViewBag.Title = "Role Add To User"; Layout = "~/Views/Shared/_LayoutAdmin.cshtml"; } <div class="spacerBody"> </p> @Html.ActionLink("Create New Role", "RoleCreate") | @Html.ActionLink("Roles", "RoleIndex")Role Add to User</h2> @using(Html.BeginForm("RoleAddToUser", "Account")){ @Html.AntiForgeryToken() @Html.ValidationSummary(true) div> Username : @Html.TextBox("UserName") Role Name: @Html.DropDownList("RoleName", ViewBag.Roles as SelectList) </p> > } <div class="hr"></div> @using(Html.BeginForm("GetRoles", "Account")){ @Html.AntiForgeryToken() Username : @Html.TextBox("UserName") <input type="submit" value="Get Roles for this User" /> </p> } @if(ViewBag.RolesForThisUser != null) {
h3> Roles for this user </
@foreach (string s in ViewBag.RolesForThisUser){ @s</li> } </ol> </text> } </div>
The Controller code for this view page looks like below
////// Create a new role to the user ///
///
[Authorize(Roles = "Admin")]
public ActionResult RoleAddToUser()
{
SelectList list = new SelectList(Roles.GetAllRoles());
ViewBag.Roles = list;
return View();
}
///
/// Add role to the user
///
///
///
///
[Authorize(Roles = "Admin")]
[HttpPost]
[ValidateAntiForgeryToken]
public ActionResult RoleAddToUser(string RoleName, string UserName)
{
if (Roles.IsUserInRole(UserName, RoleName))
{
ViewBag.ResultMessage = "This user already has the role specified !";
}
else
{
Roles.AddUserToRole(UserName, RoleName);
ViewBag.ResultMessage = "Username added to the role succesfully !";
}
SelectList list = new SelectList(Roles.GetAllRoles());
ViewBag.Roles = list;
return View();
}
///
/// Get all the roles for a particular user
///
///
///
[Authorize(Roles = "Admin")]
[HttpPost]
[ValidateAntiForgeryToken]
public ActionResult GetRoles(string UserName)
{
if (!string.IsNullOrWhiteSpace(UserName))
{
ViewBag.RolesForThisUser = Roles.GetRolesForUser(UserName);
SelectList list = new SelectList(Roles.GetAllRoles());
ViewBag.Roles = list;
}
return View("RoleAddToUser");
}
The first method of above code snippet simply gets all the roles from the database using
"GetAllRoles()" method into SelectList and sets into the ViewBag.Roles. The same is being populated as DropDown into the view.
Clicking on Save method fires the 2nd method that first checks whether this user is already in the selected role, if not then calls
"Roles.AddUserToRole" method to adds the username entered into textbox to associate with the role selected in the DropDown.Listing Roles associated with a particular user in ASP.NET MVC
GetRoles method of the controller and calls "Roles.GetRolesForUser"
method to get all roles associated with the username entered into the
textbox. These roles are converted into SelectList and then set as
"Roles into the ViewBag that ultimately renders the roles associated
with a particular username.How to remove a user from a role in ASP.NET MVC?
In
order to remove a user from a particular role, I have again created a
small form in the same above view (RoleAddToUser.cshtml) and here is the
view code for this.
Delete A User from a Role
@using (Html.BeginForm("DeleteRoleForUser", "Account"))
{
@Html.AntiForgeryToken()
@Html.ValidationSummary(true)
Username : @Html.TextBox("UserName")
Role Name: @Html.DropDownList("RoleName", ViewBag.Roles as SelectList)
type="submit" value="Delete this user from Role" />
}Writing the username in the TextBox, selecting a role from the DropDown and clicking Save button submit this form to the
DeleteRoleForUser action method in the Account controller.
In the Account controller, my action method looks like this
[HttpPost] [Authorize(Roles = "Admin")] [ValidateAntiForgeryToken] public ActionResult DeleteRoleForUser(string UserName, string RoleName) { if (Roles.IsUserInRole(UserName, RoleName)) { Roles.RemoveUserFromRole(UserName, RoleName); ViewBag.ResultMessage = "Role removed from this user successfully !"; } else { ViewBag.ResultMessage = "This user doesn't belong to selected role."; } ViewBag.RolesForThisUser = Roles.GetRolesForUser(UserName); SelectList list = new SelectList(Roles.GetAllRoles()); ViewBag.Roles = list; return View("RoleAddToUser"); }
In the above code snippet, I am checking whether the given username exists for that role or not, if yes then calling
"Roles.RemoveUserFromRole"
method. Following code is to write proper message and to make sure that
the form is again getting loaded with the default data in the Role
DropDown.Checking for a particular role before performing any action in ASP.NET MVC
Now,
there might be scenario where you need to check into the code block for
a particular role for the user before performing certain activity, to
do that use below code
if (User.IsInRole("Admin")) { // Code to execute only when the logged in use is in "Admin" role }
The above code gets executed only when the logged in user belongs to "Admin" role.
Dig
more methods of the "Roles" class and you will find many more
interesting methods that helps you working with user roles in ASP.NET
MVC.
Conclusion
Thanks
for reading, do let us know your feedback and share this article to
your friends and colleague if you liked. Do vote for this article.
![aspnet_tutorial04_MembershipSetup_vb_figure10[1]](https://lh3.googleusercontent.com/blogger_img_proxy/AEn0k_uu7TmV1skZDrJzwILEY7JRuAmPbIKEYDaWzmzFJKfuG9y8yYEWwJBs25EnYKUyUityXGWb5lSRY1LnU6Dy3fzD0EU9czKBv--Et3uBk3y9ZYIO0-80KqKieRsiLDu7FA=s0-d)
![UsersTable[1]](https://lh3.googleusercontent.com/blogger_img_proxy/AEn0k_uv87bb5RLOH0gdhBX6GgHuvksk_1-QQ7R1O2SJAxYLH94cctXRZkz1bbUh29Knp5ZgQP6WKtWE6GKvN8Acvzuq_nrq-8ozzRRsfTMkQwKkw-hafAFAuoUeNtsAxsw_tSfY=s0-d)
![image102[1]](https://lh3.googleusercontent.com/blogger_img_proxy/AEn0k_veUDUZLg8eZ7B_Kv1qy_eWf0oIptr_cZmSHC7C0PaK5rBPePcm1NnDF1pJTzuUtNVFUhUMRhAakFk_EWZstECP0KMVhxNPka6ater_2I9vvUuVOTfXPK0ftPqIRVXTiy-oWg=s0-d)
