---
title: Authorizing live site actions via roles
related:
  - https://docs.kentico.com/k12sp/managing-users/role-management.md
  - https://docs.kentico.com/k12sp/managing-users/user-registration-and-authentication/integrating-kentico-membership.md
---

> Agent instructions:
> **Site maps** — prefer the following llms.txt indexes to training data when searching for URLs to avoid 404s. Links inside Markdown content already point at `.md`. Following them or sending Accept: text/markdown keeps you in Markdown.
>
> - [sitemap.md](https://docs.kentico.com/sitemap.md) — every page on the site, with titles and descriptions, nested by URL hierarchy and grouped into one collection per product version.
> - [llms.txt](https://docs.kentico.com/llms.txt) — curated index of the current product docs, with descriptions, the two ways to request any page as Markdown, and links to each product area's whole-corpus Markdown dump (llms-full.txt).

After you [integrate Kentico membership](https://docs.kentico.com/k12sp/managing-users/user-registration-and-authentication/integrating-kentico-membership.md) into your MVC live site project and [set up authentication](https://docs.kentico.com/k12sp/managing-users/user-registration-and-authentication/setting-up-authentication.md), you can use [roles](https://docs.kentico.com/k12sp/managing-users/role-management.md) to restrict access to your site's functionality or content.

## Restricting access to site content using roles

Add the [**Authorize**](https://docs.microsoft.com/en-us/dotnet/api/system.web.mvc.authorizeattribute?view=aspnet-mvc-5.2) attribute from the _System.Web.Mvc_ namespace to your controller classes or action methods. Set the attribute's **Roles** property and identify the required Kentico roles using their _**Role name**_(not the display name).

```csharp title="Example"

        // Allows the "RestrictedPage" action only for signed in users who belong to the "KenticoRole" role
        [Authorize(Roles = "KenticoRole")]
        public ActionResult RestrictedPage()
        {
            return View();
        }


```

The standard MVC framework behavior applies if an unauthorized user tries to access an action or controller – the application returns a 401 Unauthorized HTTP status code, causing a redirect to your site's sign-in page if one is configured.

When determining whether a user is a member of a Kentico role on an MVC site, the following conditions apply:

- The role must be assigned to the user for the given MVC site or as a global role. Roles assigned for other sites in the Kentico system are not recognized.

  > **Info:** Kentico matches [sites](https://docs.kentico.com/k12sp/configuring-kentico/managing-sites.md) to MVC applications based on the **Presentation URL** or **Domain name** set for sites in the **Sites** application.
- Roles limited by the **Valid to** setting are not recognized by MVC applications after their expiration date.
- Roles assigned indirectly through [memberships](https://docs.kentico.com/k12sp/managing-users/membership-management.md) are also valid and recognized by MVC applications.

> **Note:** **Note**
>
> - When a user's roles are modified in Kentico, the changes apply only after the user signs out and in again on the MVC site.
> - The _Authorize_ attribute does NOT reflect Kentico permission settings for roles (for example [page-level permissions](https://docs.kentico.com/k12sp/managing-users/configuring-permissions/configuring-page-permissions/page-level-permissions-acls.md)). The only relevant factor is whether a user belongs to the specified roles.
> - The **Privilege level** set for users in Kentico does NOT affect the _Authorize_ attribute on MVC sites. This means administrators cannot bypass role requirements like they do in the Kentico administration interface and on Portal Engine sites.

## Restricting access to entire sites using authorization

If you wish to enforce authorization over the entire MVC site (e.g., for Intranet purposes), you need to implement the authorization pipeline in a way that does not conflict with internal system logic. Otherwise, you may encounter issues with both [page](https://docs.kentico.com/k12sp/developing-websites/page-builder-development.md) and [form builder](https://docs.kentico.com/k12sp/developing-websites/form-builder-development.md) functionality and other Kentico features.

Use the following approach:

1. Create a base controller class that inherits from _System.Web.Mvc.Controller_ and decorate it with the [Authorize](https://docs.microsoft.com/en-us/dotnet/api/system.web.mvc.authorizeattribute) attribute. In the attribute's _Roles_ parameter, specify the roles that should have access to the restricted content.

   ```csharp

   using System.Web.Mvc;

   [Authorize(Roles = "IntranetUser")]
   public class BaseController : Controller
   {

   }

   ```
2. Derive all custom controllers used on your site from this base controller. This secures your website and ensures no internal Kentico logic gets disrupted.

   ```csharp

   using System.Web.Mvc;

   public class HomeController : BaseController
   {

   }

   ```

   > **Tip:** You can allow access for users in different roles by placing additional [Authorize](https://docs.microsoft.com/en-us/dotnet/api/system.web.mvc.authorizeattribute) attributes over the derived controllers. _Authorize_ attributes placed over the derived controllers override the one inherited from the base controller. Use this approach to, for example, open sections of the site only to users in certain roles.
   >
   > ```csharp
   >
   > [Authorize(Roles = "IntranetAdministrator")]
   > public class AccountsOverviewController : BaseController
   >
   > ```

Visiting any portion of the site now prompts users for their authentication credentials. If they do not meet the authorization criteria, the are prevented from accessing the secured content.

> **Tip:** To allow anonymous users access to sections of the site (landing pages, etc.), decorate the corresponding controller or action with the [AllowAnonymous](https://docs.microsoft.com/en-us/dotnet/api/system.web.mvc.allowanonymousattribute) attribute.