c# - Can user authorization be set on a per-controller basis in web.config? (cannot use AuthorizeAttribute) -

i have web api 2 app using windows auth. have multiple controllers , in web.config authorization:

<system.web>     <compilation debug="true" targetframework="4.5" />     <httpruntime targetframework="4.5" />     <authentication mode="windows" />     <authorization>       <allow users="allowedusersandgroups" />       <deny users="?" />     </authorization>     <sessionstate mode="off" />   </system.web> 

this "blanket" authorization works great, but have 2 specific controllers need lock down differently: want specify different users authorized hit these 2 controllers.

the obvious answer use [authorize()] attribute on controller classes, cannot use attribute because using per-environment (dev-uat-prod) xml transforms web.config , need able change users authorized on these controllers in each environment.

so, possible specify authorization individual controllers in web.config file?

i open other solutions long allow authorizing different users when app deployed in each environment (dev-uat-prod).

thanks!

in our environment use approach:

the names of active directory groups stored in app-settings. these names different per environment.

next created subtype of authorizeattribute called authorizewritersattribute this:

public class authorizewritersattribute : authorizeattribute  {     public      {         roles = configurationmanager.appsettings["solutionname:authorizedwriters"];         // removed dependency on configurationmanager brevity suffices.     } } 

finally apply attribute our controllers:

[authorizewriters] public class blogcontroller : controller {     .... } 

we use ad-groups ad-accounts should work well.