A role is a named group assigned to users so authorization rules can evaluate their permissions. Role-based access control separates basic users, moderators, and administrators instead of treating every authenticated user as an administrator. section 9.4
Configure roles through a practical authorization flow:
- Create users representing the supported user types, such as TestModerator and TestAdministrator. section 9.4.1
- Define role names as constants, then create missing IdentityRole records through RoleManager.CreateAsync. section 9.4.2
- Assign users with UserManager and verify that each assignment does not already exist. section 9.4.3
- Copy each user’s roles into JWT claims so authorization middleware can inspect them on later requests. section 9.4.4
- Restrict endpoints with role-aware authorization, using Moderator for updates and Administrator for deletes and database seeding. section 9.4.5
Listing 9.12 /Controllers/SeedController.cs file: AuthData method
[HttpPost]
[ResponseCache(NoStore = true)]
public async Task<IActionResult> AuthData()
{
int rolesCreated = 0;
int usersAddedToRoles = 0;
if (!await _roleManager.RoleExistsAsync(RoleNames.Moderator))
{
await _roleManager.CreateAsync(
new IdentityRole(RoleNames.Moderator)); #1
rolesCreated++;
}
if (!await _roleManager.RoleExistsAsync(RoleNames.Administrator))
{
await _roleManager.CreateAsync(
new IdentityRole(RoleNames.Administrator)); #1
rolesCreated++;
}
var testModerator = await _userManager
.FindByNameAsync("TestModerator");
if (testModerator != null
&& !await _userManager.IsInRoleAsync(
testModerator, RoleNames.Moderator))
{
await _userManager.AddToRoleAsync(testModerator,
RoleNames.Moderator); #2
usersAddedToRoles++;
}
var testAdministrator = await _userManager
.FindByNameAsync("TestAdministrator");
if (testAdministrator != null
&& !await _userManager.IsInRoleAsync(
testAdministrator, RoleNames.Administrator))
{
await _userManager.AddToRoleAsync(
testAdministrator, RoleNames.Moderator); #2
await _userManager.AddToRoleAsync(
testAdministrator, RoleNames.Administrator); #2
usersAddedToRoles++;
}
return new JsonResult(new
{
RolesCreated = rolesCreated,
UsersAddedToRoles = usersAddedToRoles
});
}
Use the AuthData seeding method as a compact implementation pattern: create missing roles, find users, and add users to roles. section 9.4.2
Verify the authorization matrix
Login as TestUser, TestModerator, and TestAdministrator through SwaggerUI, place each JWT in the Authorize dialog, and call the moderator and administrator test endpoints. TestUser receives 401 for both; TestModerator receives 200 for the moderator endpoint and 401 for the administrator endpoint; TestAdministrator receives 200 for both. section 9.4.6
Keep role creation and assignment in a dedicated authentication-seeding endpoint rather than mixing them with board-game data seeding. Add future roles, such as SuperAdmin, to the constants and extend the seeding logic. section 9.4.2 section 9.5.1
