c# - Redirecting unauthorized controller in ASP.NET MVC -

i have controller in asp.net mvc i've restricted admin role:

[authorize(roles = "admin")] public class testcontroller : controller {    ... 

if user not in admin role navigates controller greeted blank screen.

what redirect them view says "you need in admin role able access resource."

one way of doing i've thought of have check in each action method on isuserinrole() , if not in role return informational view. however, i'd have put in each action breaks dry principal , cumbersome maintain.

create custom authorization attribute based on authorizeattribute , override onauthorization perform check how want done. normally, authorizeattribute set filter result httpunauthorizedresult if authorization check fails. have set viewresult (of error view) instead.

edit: have couple of blog posts go more detail:

• http://farm-fresh-code.blogspot.com/2011/03/revisiting-custom-authorization-in.html
• http://farm-fresh-code.blogspot.com/2009/11/customizing-authorization-in-aspnet-mvc.html

example:

    [attributeusage( attributetargets.class | attributetargets.method, inherited = true, allowmultiple = false )]     public class mastereventauthorizationattribute : authorizeattribute     {         /// <summary>         /// name of master page or view use when rendering view on authorization failure.  default         /// null, indicating use master page of specified view.         /// </summary>         public virtual string mastername { get; set; }          /// <summary>         /// name of view render on authorization failure.  default "error".         /// </summary>         public virtual string viewname { get; set; }          public mastereventauthorizationattribute()             : base()         {             this.viewname = "error";         }          protected void cachevalidatehandler( httpcontext context, object data, ref httpvalidationstatus validationstatus )         {             validationstatus = oncacheauthorization( new httpcontextwrapper( context ) );         }          public override void onauthorization( authorizationcontext filtercontext )         {             if (filtercontext == null)             {                 throw new argumentnullexception( "filtercontext" );             }              if (authorizecore( filtercontext.httpcontext ))             {                 setcachepolicy( filtercontext );             }             else if (!filtercontext.httpcontext.user.identity.isauthenticated)             {                 // auth failed, redirect login page                 filtercontext.result = new httpunauthorizedresult();             }             else if (filtercontext.httpcontext.user.isinrole( "superuser" ))             {                 // authenticated , in superuser role                 setcachepolicy( filtercontext );             }             else             {                 viewdatadictionary viewdata = new viewdatadictionary();                 viewdata.add( "message", "you not have sufficient privileges operation." );                 filtercontext.result = new viewresult { mastername = this.mastername, viewname = this.viewname, viewdata = viewdata };             }          }          protected void setcachepolicy( authorizationcontext filtercontext )         {             // ** important **             // since we're performing authorization @ action level, authorization code runs             // after output caching module. in worst case allow authorized user             // cause page cached, unauthorized user later served             // cached page. work around telling proxies not cache sensitive page,             // hook our custom authorization code caching mechanism have             // final on whether page should served cache.             httpcachepolicybase cachepolicy = filtercontext.httpcontext.response.cache;             cachepolicy.setproxymaxage( new timespan( 0 ) );             cachepolicy.addvalidationcallback( cachevalidatehandler, null /* data */);         }       }