asp.net mvc - MVC Skip Controller Authentication Use Action -

is possible bypass authorization role check on controller, enforce role check on action? i've spent bit of time researching , find shows how implement allowanonymousattribute. i'm using allowanonymousattribute , works great bypassing authorization action. isn't want. have controller requires roles. when particular action requested want skip roles @ controller level , verify user has roles designated on action.

here's code:

[authorize(roles="administrator")] public class memberscontroller : viewapicontroller<memberview> {     // list of actions....      [authorize(roles="apiuser")]             [httppost]     public void autopaypost([frombody] list<autopaymodel> autopaylist)     {         //....     } } 

the problem want users 'apiuser' role have access 'autopaypost' action. realize can remove class level authorize attribute, add every action method on controller, minus 'autopaypost' action. avoid because several of controllers inherit base class provides long list of actions require 'administrative' role. because of have override every base action, add authorize attribute overridden method, delegate call base class. work if later decide add functionality base class i'll have remember go memberscontroller , override new methods, add attribute etc...

it great if end result looked this:

[authorize(roles="administrator")] public class memberscontroller : viewapicontroller<memberview> {     // list of actions....      [authorize(roles="apiuser", ignorecontrollerroles=true)]             [httppost]     public void autopaypost([frombody] list<autopaymodel> autopaylist)     {         //....     } } 

do this, check if roles/users in roles , deny of them.

public class bypassauthorizeattribute : authorizeattribute {     protected override bool authorizecore(httpcontextbase httpcontext)     {         string[] roles = this.roles.split(',');         string[] users = this.users.split(',');           foreach (var r in roles)         {             if (httpcontext.user.isinrole(r.trim()))                 return false;         }          foreach (var u in users)         {             if (httpcontext.user.identity.name.equals(u))                 return false;         }          return base.authorizecore(httpcontext);     } } 

and decore controller/action this:

    [bypassauthorize(roles = "admin,test,testint", users = "tester")]     public actionresult edit(int id = 0)     {         foomodel foomodel = db.foomodels.find(id);         if (foomodel == null)         {             return httpnotfound();         }         return view(foomodel);     } 

hope you!