c# - How to handle authorization in an application? -

i have authentication portion of asp.net 3.5 web application complete. know more common authorization patterns.

may present current authorization structure:

i have database "module" , "operation" tables. modules represent systems in application , operations represent actions 1 able perform within system.

customer, order, billing defined module. "operation" related module: customer.add, customer.delete customer operations.

each user has role has access operations, depending on role.

please note page menus generated based on user's access, , users not see modules , operations not have access to.

---

my questions begin how implement authorization scheme here, possibly using existing pattern or technique.

how , when should secure module, , check authorization of user perform operation on said module?

i have not implemented yet, here 1 way thought of:

1. user clicks on operation: module: customers | operation: add
2. in click event @ user's role, verify user can perform operation, fire operation or direct user accordingly.

please pardon obscure nature of question. not sure ask here.

i looking see how people handle authorization, , how people allow / disallow access business methods. not sure declarative security need, or if simple example provided above way go.

there many options me here , possibilities seem endless. please let me know if there models or patterns can handle authorization inside of application.

if want start small.

first implement functionality along lines of public bool user.hasrightsfor(module m, action a) overloads. can static because can current user system.

you can ask if user has right current action/module/whatever , act accordingly.

it similar have thought of exception of not @ roles , decice directly return result. can solve internals later , system easier modify.

you can integrate such system (e.g.) asp.net role-based authorization.