Implementing Role-Based Authorization in ASP.NET Core MVC

using Microsoft.AspNetCore.Identity;

using (var scope = app.Services.CreateScope())
{
    var roleManager = scope.ServiceProvider.GetRequiredService<RoleManager<IdentityRole>>();
    await RoleSeeder.SeedRolesAsync(roleManager);
}

Step 4: Assign Roles to Users

You can assign roles when creating a user:

var userManager = scope.ServiceProvider.GetRequiredService<UserManager<IdentityUser>>();

var adminUser = await userManager.FindByEmailAsync("[email protected]");
if (adminUser != null && !await userManager.IsInRoleAsync(adminUser, "Admin"))
{
    await userManager.AddToRoleAsync(adminUser, "Admin");
}

Step 5: Apply Role-Based Authorization in Controllers

You can restrict access at the controller or action level using the [Authorize] attribute.

Controller-Level Role Restriction

using Microsoft.AspNetCore.Authorization;
using Microsoft.AspNetCore.Mvc;

namespace YourApp.Controllers
{
    [Authorize(Roles = "Admin")] // Only Admins can access
    public class AdminController : Controller
    {
        public IActionResult Index()
        {
            return View();
        }
    }
}

Action-Level Role Restriction

[Authorize(Roles = "Manager,Admin")] // Either Manager or Admin can access
public IActionResult Reports()
{
    return View();
}

Step 6: Role Checks Inside Views

You can conditionally show UI elements based on roles:

@using Microsoft.AspNetCore.Identity
@inject SignInManager<IdentityUser> SignInManager
@inject UserManager<IdentityUser> UserManager

@if (User.IsInRole("Admin"))
{
    <a href="/Admin">Admin Panel</a>
}

Step 7: Policy-Based Roles (Optional)

Instead of hardcoding roles, you can use policies for cleaner role management.

In Program.cs:

builder.Services.AddAuthorization(options =>
{
    options.AddPolicy("RequireManager", policy =>
        policy.RequireRole("Manager", "Admin"));
});

In your controller:

[Authorize(Policy = "RequireManager")]
public IActionResult Dashboard()
{
    return View();
}

Security Best Practices

• Assign least privilege roles (users only get what they need).

• Avoid role name hardcoding in multiple places—use policies.

• Combine role-based authorization with claims-based checks for fine-grained control.

• Regularly audit user roles and access logs.

Conclusion

Role-based authorization in ASP.NET Core MVC is powerful and straightforward. By using Identity + Roles + [Authorize] attributes, you can secure your application at both the controller and view levels. For more complex scenarios, combine roles with policy-based and claims-based authorization.