Role-Based Authorization in ASP.NET Core

In the previous article, we discussed how to implement cookie-based authentication and learned how users can access our ASP.NET Core application via form-based login. After successful authentication, users are assigned an identity; authorization is the process that determines what actions these identities are permitted to perform. In this article, we will delve into ASP.NET Core’s role-based authorization mechanism.

What Is Role-Based Authorization?

Role-based authorization is an access control mechanism that simplifies authorization requirements by assigning users to predefined roles. Each role represents a set of permissions used to govern user access to specific resources and features.

For example, an online learning platform might define the following roles:

• Student
• Teacher
• Administrator

In this scenario, users in different roles have distinct access rights. For instance:

• Students can view courses,
• Teachers can publish courses and grades,
• Administrators can manage all users and courses.

Configuring Role-Based Authorization

To use role-based authorization in ASP.NET Core, ensure the required NuGet packages are installed. Typically, the Microsoft.AspNetCore.Identity package is already included. If not, install it using the NuGet Package Manager or CLI:

dotnet add package Microsoft.AspNetCore.Identity

Enabling Role Services

In the ConfigureServices method of Startup.cs, register role services:

public void ConfigureServices(IServiceCollection services)
{
    services.AddDbContext<ApplicationDbContext>(options =>
        options.UseSqlServer(Configuration.GetConnectionString("DefaultConnection")));

    services.AddIdentity<IdentityUser, IdentityRole>()
        .AddEntityFrameworkStores<ApplicationDbContext>()
        .AddDefaultTokenProviders();

    services.AddControllersWithViews();
}

Creating and Assigning Roles

You can create roles and assign users to them programmatically—for example, using RoleManager. Below is a sample implementation for seeding roles during application startup:

public class SeedData
{
    public static async Task Initialize(IServiceProvider serviceProvider)
    {
        var roleManager = serviceProvider.GetRequiredService<RoleManager<IdentityRole>>();
        var userManager = serviceProvider.GetRequiredService<UserManager<IdentityUser>>();

        string[] roleNames = { "Student", "Teacher", "Administrator" };
        IdentityResult roleResult;

        foreach (var roleName in roleNames)
        {
            var roleExists = await roleManager.RoleExistsAsync(roleName);
            if (!roleExists)
            {
                roleResult = await roleManager.CreateAsync(new IdentityRole(roleName));
            }
        }

        var user = await userManager.FindByEmailAsync("teacher@example.com");
        if (user != null)
        {
            await userManager.AddToRoleAsync(user, "Teacher");
        }
    }
}

Call SeedData.Initialize from Program.cs to ensure roles are created when the application starts.

Applying Role-Based Authorization

Once roles are created and users assigned, you can enforce role-based access at the controller or action level. For example:

[Authorize(Roles = "Administrator")]
public class AdminController : Controller
{
    public IActionResult Index()
    {
        return View();
    }
}

In this example, only users belonging to the Administrator role may access the Index action of AdminController.

Accessing User Roles from a Controller

Within a controller, you can check whether the current user belongs to a specific role using User.IsInRole(). For example:

public IActionResult Index()
{
    if (User.IsInRole("Teacher"))
    {
        // Render teacher-specific view or logic
        return View("TeacherView");
    }
    return View("DefaultView");
}

Summary

By following the steps above, we have successfully implemented role-based authorization in our ASP.NET Core application. This approach enables fine-grained access control based on user roles—making permission management clearer, more scalable, and easier to maintain.

In the next section, we’ll shift focus to logging, exploring fundamental logging concepts and how to effectively use logging capabilities in ASP.NET Core applications. This will help us better monitor application behavior and significantly improve troubleshooting efficiency.