You're looking at the difference between Authentication and Authorization. What you're looking for is two things, first off using a Role Provider, and secondly using the AuthorizeAttribute.
The MS guidance on role Providers is here:
Implementing a Role Provider[
^]
There is an article on CP that describes one possible implementation here:
ASP.NET MVC 5 Identity: Extending and Modifying Roles[
^]
And finally, once you have a role provider, you can lock down items by controller or by action with the AuthorizeAttribute:
[Authorize(Roles="Admin,User")]
public class AccountController : Controller
{
[Authorize(Roles="Admin")]
public ActionResult DeleteAccount(){...}
}
Submit an article or tip