Access by roles at controller level -

is possible mvc allow whole controller accessed 1 role except 1 or few methods accessed role?

where methods belong staff except method3 can access both clients , staff. below:

    [authorize(roles = "staff")]     public class staffcontroller : controller     {         public staffcontroller()         {         }         public actionresult method1()         {         }         public actionresult method2()         {         }         [authorize(roles = "staff, customer")]         public actionresult method3()         {         }     } 

or scenario belong staff except method3 exclusively accessible clients, below:

    [authorize(roles = "staff")]     public class staffcontroller : controller     {         public staffcontroller()         {         }         public actionresult method1()         {         }         public actionresult method2()         {         }         [authorize(roles = "customer")]         public actionresult method3()         {         }     } 

however, above don't work. in both cases, clients still don't have access method3.

greatly appreciate help!

i suspect checks controller authorisation first, never gets chance check specific actions authorisation.

one solution authorise both roles, @ class level, , restrict access on specific methods staff.

e.g.

[authorize(roles="staff,customer")] public class staffcontroller : controller {     [authorize(roles="staff")]     public staffcontroller()     {     }     [authorize(roles="staff")]     public actionresult method1()     {     }     [authorize(roles="staff")]     public actionresult method2()     {     }     public actionresult method3()     {     } } 

another option restrict (i.e. opposite of authorize) using custom attribute on answer asp.net mvc: opposite of [authorise] mention goes against "refuse default" principal of mvc security.