Restricting access to a Model property from an ODataController

0
votes

I am wondering how I can restrict access to certain model properties in OData controller based on User roles.

For e.g. I have a class called Users as below:

Public class Users
{
    public int Id { get; set; }

    public string FirstName { get; set; }

    public string LastName { get; set; }

    public string SSN { get; set; }
}

And I have an ODataController called UsersODataController as below:

[EnableQuery]
public IQuerable<Users> GetUsersOData ()
{
    return db.Users.AsQueryable();
}

How can I make GetUsersOData method to return SSN property only when accessed by Admin users? I was able to implement the $filter and $select functionality in a regular MVC controller and return SSN property only for Admin users. However, when I query the odata url (for e.g. http://localhost/UsersApplication/odata/UsersOData) I get all the properties including the SSN. Is it possible to apply the filter logic in UsersODataController itself so that the odata url returns the SSN property only for Admin Users?

1
c#asp.netodata

1 Answers

0
votes

Maybe you can use OpenType Feature in WebAPI/OData, and put SSN property in result besed on role. Example E2E test.

Public class Users
{
    public int Id { get; set; }

    public string FirstName { get; set; }

    public string LastName { get; set; }

    public IDictionary<string, object> DynamicProperties { get; set; }
}