Custom Authorize attribute using session variables

Question

I've got a classic asp website running inside an MVC 4 application. So to access areas of the classic asp website the user needs to log in using a classic asp login page. At this point they are authenticated within the system. Their userid, security level and authentication are stored in the classic asp session variables.

I then have the log in information from the session put into the ASP.Net session using the same variable names.

I'm trying to create a custom Authorize attribute to use the .NET session variables authentication, userid and securitylevel and then check against a database table to check if the user has permissions to access the section of the site. I want to be able to use this custom attribute in place of [Authorize] to lock down my controllers and views as required.

I'm unsure where to begin here as I'm new to ASP.NET MVC and c#.

Answer 1

I figured out how to do this. I created a custom attribute that inherits from [Authorize] and inside it I set some custom logic to interrogate the session to check for prior authentication. I will create a model for the individual rights at each site the user is attached to and will interrogate the database for those rights rather than reading in from the session.