Authentication & Authorization in MVC5 - asp.net-mvc-5

Question

I have recently started to explore ASP.NET MVC and came across a scenario. I want to have expert's opinion over its implementation approach in MVC
Scenario:
We have two users classes:
Normal users
Power users
Normal users can only enter transactional data which pertains to their work area. For example, if there exists two work areas (W1 & W2) and user 1 is mapped to work area W1 then he can only enter transactional data of W1. Whereas, if user 2 is mapped to both work areas (i.e. W1 & W2) then the user can enter transactional data of any of the areas.
Power users , as name suggest, are super user. They can enter transactional data of any work area and can change Master Data of the application as well.
I want to use Windows Authentication for user authentication and for authorization I want to have a table in DB where domain user ids(AD) of users are mapped to relevant work areas along with their user type (normal/power).
My question is how this could be done in ASP.NET MVC5. Any lead towards its solution or pointer to any relevant article/tutorial will be highly appreciated.
Further to this, if I want to generate dynamic menu (each menu item is mapped to corresponding Action) at the time of authentication based on the authenticated user type then how it can be done.
Thanks for your time.

Answer 1

Based on my understanding of your question, you want to authenticate users with Active Directory, then authorize with local authorization mechanism.
If so, you could use OWIN cookie authentication middleware in ASP.NET MVC 5.
It has few moving pieces, so I created a sample application at GitHub. The followings are the database diagram and two main classes.
OwinAuthenticationService
private readonly HttpContextBase _context;
private const string AuthenticationType = "ApplicationCookie";
public OwinAuthenticationService(HttpContextBase context)
{
_context = context;
}
public void SignIn(User user)
{
IList<Claim> claims = new List<Claim>
{
new Claim(ClaimTypes.Sid, user.Id.ToString()),
new Claim(ClaimTypes.Name, user.UserName),
new Claim(ClaimTypes.GivenName, user.FirstName),
new Claim(ClaimTypes.Surname, user.LastName),
};
foreach (string roleName in roleNames)
{
claims.Add(new Claim(ClaimTypes.Role, roleName));
}
ClaimsIdentity identity = new ClaimsIdentity(claims, AuthenticationType);
IOwinContext context = _context.Request.GetOwinContext();
IAuthenticationManager authenticationManager = context.Authentication;
authenticationManager.SignIn(identity);
}
public void SignOut()
{
IOwinContext context = _context.Request.GetOwinContext();
IAuthenticationManager authenticationManager = context.Authentication;
authenticationManager.SignOut(AuthenticationType);
}
Startup.cs
You also need to configure Startup for all those to happen.
[assembly: OwinStartup(typeof(YourApplication.Startup))]
namespace YourApplication
{
public class Startup
{
public void Configuration(IAppBuilder app)
{
app.UseCookieAuthentication(new CookieAuthenticationOptions
{
AuthenticationType = "ApplicationCookie",
LoginPath = new PathString("/Account/Login")
});
}
}
}
Usage
Then you can start using [Authorize] attribute in Controller and Action methods.
[Authorize(Roles = "Power Users")]
public class UsersController : Controller
{
// ...
}