ASP.Net MVC: Where the user role is checking against supplied roles
<p>i am trying to getting hold on role and claim based auth.</p>

<p>just reading this article <a href="http://www.dotnetcurry.com/aspnet-mvc/1102/aspnet-mvc-role-based-security" rel="nofollow">http://www.dotnetcurry.com/aspnet-mvc/1102/aspnet-mvc-role-based-security</a></p>

<p>suppose a user login and he has sale role but action he try to access for admin role but i found no code where user role and supplied roles are compare to know user has admin role or not. see this area</p>

<pre><code>private void IsUserAuthorized(AuthorizationContext filterContext)
        {
            // If the Result returns null then the user is Authorized 
            if (filterContext.Result == null)
                return;

            //If the user is Un-Authorized then Navigate to Auth Failed View 
            if (filterContext.HttpContext.User.Identity.IsAuthenticated)
            {

               // var result = new ViewResult { ViewName = View };
                var vr = new ViewResult();
                vr.ViewName = View;

                ViewDataDictionary dict = new ViewDataDictionary();
                dict.Add("Message", "Sorry you are not Authorized to Perform this Action");

                vr.ViewData = dict;

                var result = vr;

                filterContext.Result = result;
            }
        }

[AuthLog(Roles = "Manager")]
public ActionResult Create()
{
    var Product = new ProductMaster();
    return View(Product);
}

[AuthLog(Roles = "Sales Executive")]
public ActionResult SaleProduct()
{
    ViewBag.Message = "This View is designed for the Sales Executive to Sale Product.";
    return View();
}
</code></pre>

<p>suppose a <strong>user1</strong> with role <strong>"Sales Executive"</strong> try to access <strong>Create action</strong> then where it is compare the <strong>user1</strong> has no role called Manager in code?
how this is happening ? who is doing things behind the curtain?</p>

<p>please help me to understand this only where this checking is done in code that <strong>user1 has manager role or not</strong> ?</p>

<p>thanks</p>