<p>We are building a multi-tenant website in ASP.NET, and we must let each customer configure their own security model.  They must be able to define their own roles, and put users in those roles.  What is the best way to do this?</p>

<p>There are tons of simple examples of page_load events that have code like:</p>

<pre><code>  if (!user.InGroup("Admin")
       Response.Redirect("/NoAccess.aspx");
</code></pre>

<p>But that hard codes the groups and permissions in the code.  How can I make it user configurable?</p>

I would create a configuration system for the website that is easily managed in config-files. Where you could get typed members and use like this.
```
```
foreach(var group in ThisPageConfiguration.AcceptedRoleNames)
if (user.IsInRole(group))
...
```
```
Each customer could then configure their site in their configuration files... And every other type of things you'd want to configure.