Implementing role-based authorization using .NET MVC 5
<p>I would like to implement a role-based authorization in my web application that I'm building. The way I imagined to make this is to create 3 tables in my DB like following:</p>

<pre><code>1. Roles
2. UserRoles (many to many table)
3. Users 
</code></pre>

<p>After that each user would have a role assigned to him. Now... My question is, How do I permit or forbid access to specific views/controllers inside my .NET MVC application. I've stumbled upon this:</p>

<pre><code>[Authorize(Roles = "HrAdmin, CanEnterPayroll")]
[HttpPost]
public ActionResult EnterPayroll(string id)
{
    //  . . . Enter some payroll . . . 
}
</code></pre>

<p>The Authorize property seems to be limiting the specific controllers/actions to specific roles... But what if I read the user roles from the table UserRoles like in my case?? How is my application gonna know what role does the User have on the system ??</p>

<p>Can someone help me out with this ?</p>