How to authorize users more than once using custom authorize attribute?
<p>I have a custom authorize attribute class to check <code>isAuthorize</code> twice.</p>

<p><strong>What I want :</strong></p>

<p>1) It will check first if the user is <code>super admin</code> or not. If he is , then he will be <code>authorized</code>.</p>

<p>2) If <code>he is not</code> , then it will check if he has a role named "<code>Deal User</code>". If <code>he is not</code> then he will be <code>unauthorized</code>.</p>

<p>3) Now if the user <code>is in</code> a "<code>Deal User</code>" role , I want to check the user whether the user own the deal or not. So I check into database if the user owns that deal . If <code>he owns</code> , then he will be <code>authorized</code>. Otherwise he will be <code>Unauthorized</code>. </p>

<pre><code>public class DealManageCustomAuthorizeAttribute : AuthorizeAttribute

{

    private static ApplicationDbContext Context = new ApplicationDbContext();
    private static UserStore&lt;ApplicationUser&gt; userStore = new UserStore&lt;ApplicationUser&gt;(Context);
    private UserManager&lt;ApplicationUser&gt; userManager = new UserManager&lt;ApplicationUser&gt;(userStore);

    private enum Result
    {
        Authorize,
        Unauthorize,
        InternalServerError
    }

    public override void OnAuthorization(HttpActionContext actionContext)
    {

        var result = AuthorizeRequest(actionContext);
        if (result == Result.Authorize)
        {
            return;
        }
        else
        {
            HandleUnauthorizedRequest(actionContext);
        }

    }

    protected override void HandleUnauthorizedRequest(System.Web.Http.Controllers.HttpActionContext actionContext)
    {
        //Code to handle unauthorized request
        base.HandleUnauthorizedRequest(actionContext);
    }

    private Result AuthorizeRequest(System.Web.Http.Controllers.HttpActionContext actionContext)
    {
        base.Roles = "Super Admin";
        bool authorized = base.IsAuthorized(actionContext);
        if (!authorized)
        {
            try
            {

                base.Roles = "Deal User";

                bool auth = base.IsAuthorized(actionContext);

                if (!auth)
                {
                    return Result.Unauthorize;
                }

                Uri uri = actionContext.Request.RequestUri;
                Guid dealId = new Guid(HttpUtility.ParseQueryString(uri.Query).Get("dealId"));
                string userId = HttpContext.Current.User.Identity.GetUserId();

                var retval = new Deal(Common.Common.TableSureConnectionString).CheckDealByIdAndUserId(dealId, userId);

                if (retval)
                {
                    return Result.Authorize;
                }
                return Result.Unauthorize;
            }
            catch (Exception)
            {
                return Result.InternalServerError;
            }
        }
        return Result.Authorize;
    }

}
</code></pre>

<blockquote>
  <p><strong>I wrote the code and it is working. But I want to know whether it is the</strong>
  <strong>correct way to authorize users ?</strong></p>
</blockquote>