The only place I know of that a RoleProvider gets used is when you use an Authorize attribute. Where else can I use a RoleProvider and does it get invoked anywhere other than places I might specifically reference roles (I'm thinking similar to how the Login controls automatically use MembershipProvider)
Said in another way, if I write my own role management layer, but don't implement the actual RoleProvider contract, what built-in functionality in ASP.NET will I be missing out on?
Here are a few ways the built-in RoleProvider adds value:
1: The LoginView control uses roles to allow you to show different content to different roles. It will hook into the RoleProvider to do so.
Example of using roles with the LoginView control:
<asp:LoginView id="LoginView1" runat="server">
<RoleGroups>
<asp:RoleGroup Roles="author">
<ContentTemplate>
some content here based on if user is in 'author' role....
</ContentTemplate>
</asp:RoleGroup>
<asp:RoleGroup Roles="editor">
<ContentTemplate>
some content here based on if user is in 'editor' role....
</ContentTemplate>
</asp:RoleGroup>
</RoleGroups>
</asp:LoginView>
2: You can grant access to physical paths on the server (i.e. subfolders, etc.) by web.config settings, such as:
<configuration>
<location path="MemberPages">
<system.web>
<authorization>
<allow roles="members, administrators" />
<deny users="*" />
</authorization>
</system.web>
</location>
<!-- other configuration settings here -->
<configuration>
3: You can easily detect user roles and take actions in code, such as:
if (User.IsInRole("members"))
{
//do something
}
else
{
//do something else
}
The list goes on and on. This discussion has honestly been had many times - don't reinvent the wheel by creating your own role system. Just implement the abstract role provider and be done with it. Here is a good article on the background of Role Management in ASP.NET.
EDIT: After you clarified you actually want to know how the RoleProvider benefits you under MVC, here is what you are looking for:
Stright-forward answer to your question would be "No". RoleProvider or any other provider do not participate in main-stream pipeline of ASP.Net and ASP.Net request does not need any RoleProvider to fulfill the request.
Rather than putting the technical material, I'd answer a more philosophical answer and respect the efforts put in by KP in the answer.
RoleProvider is basically a functional add-on to ASP.Net that lets you work against your Role-system without having to know any functional details at run-time. ASP.Net 2.0 introduced a whole new way of dealing with users and roles. Rather then providing integrated user and role management they decided to make it extensible yet easy to use. They created a new pattern called "Provider" and shipped default providers for each functionality, like user, role and session. They are known as MembershipProvider, RoleProvider and SessionProvider. However, Microsoft does not restrict you to use only the providers shipped with ASP.Net 2.0. You can define your own MembershipProvider and declare them in web.config as default provider. The ProviderBase class would force you to implement each method to let your provide work cohesively and when you make them default from web.config, at runtime you need not know the details of the any target provider that you may have in the system. The client-code is consistent across any specific provider.
Hope this helps.
