[Authorize]public ActionResult TestAuthorize(){ return View();}[Authorize(Users="test1,test2")]public ActionResult TestAuthorize(){ return View();}[Authorize(Roles="Admin")]public ActionResult TestAuthorize(){ return View();}

// Summary://     When overridden, provides an entry point for custom authorization checks.//// Parameters://   httpContext://     The HTTP context, which encapsulates all HTTP-specific information about//     an individual HTTP request.//// Returns://     true if the user is authorized; otherwise, false.//// Exceptions://   System.ArgumentNullException://     The httpContext parameter is null.protected virtual bool AuthorizeCore(HttpContextBase httpContext);//// Summary://     Called when a process requests authorization.//// Parameters://   filterContext://     The filter context, which encapsulates information for using System.Web.Mvc.AuthorizeAttribute.//// Exceptions://   System.ArgumentNullException://     The filterContext parameter is null.public virtual void OnAuthorization(AuthorizationContext filterContext);

public class CustomAuthorizeAttribute : System.Web.Mvc.AuthorizeAttribute{public new string[] Roles { get; set; }protected override bool AuthorizeCore(HttpContextBase httpContext){if (httpContext == null) {throw new ArgumentNullException("HttpContext");}if (!httpContext.User.Identity.IsAuthenticated) {return false;}if (Roles == null) {return true;}if (Roles.Length == 0){return true;}if (Roles.Any(httpContext.User.IsInRole)){return true;}return false;}public override void OnAuthorization(System.Web.Mvc.AuthorizationContext filterContext){string controllerName = filterContext.ActionDescriptor.ControllerDescriptor.ControllerName;string actionName = filterContext.ActionDescriptor.ActionName;string roles = GetRoles.GetActionRoles(actionName, controllerName);if (!string.IsNullOrWhiteSpace(roles)) {this.Roles = roles.Split(new string[] { "," }, StringSplitOptions.RemoveEmptyEntries);}base.OnAuthorization(filterContext);}}

   public class GetRoles{public static string GetActionRoles(string action, string controller) {XElement rootElement = XElement.Load(HttpContext.Current.Server.MapPath("/")+"ActionRoles.xml");XElement controllerElement = findElementByAttribute(rootElement, "Controller", controller);if (controllerElement != null){XElement actionElement = findElementByAttribute(controllerElement, "Action", action);if (actionElement != null){return actionElement.Value;}}return "";}public static XElement findElementByAttribute(XElement xElement,string tagName, string attribute){return xElement.Elements(tagName).FirstOrDefault(x => x.Attribute("name").Value.Equals(attribute,StringComparison.OrdinalIgnoreCase));}}

<?xml version="1.0" encoding="utf-8" ?>
<Roles><Controller name="Home"><Action name="Index"></Action><Action name="About">Manager,Admin</Action><Action name="Contact">Admin</Action></Controller>
</Roles>

filters.Add(new CustomAuthorizeAttribute());