Question

Which methods help the roleprovider determine whether a user is assigned a role or set of roles ?

Answer 1

Multiple roles can be done as such: [CustomAuthorize(Roles = "Administrator, User")] But seeing you've written this code I'd think you'd know this already?

If all you want to do is keeps Users from getting in your create/edit/delete functions, why not use the default authorisation functions? meaning, put [CustomAuthorize(Roles = "Administrator")] above edit/create/delete and [CustomAuthorize(Roles = "Administrator, User")] above anything else...

I'm guessing the IsUserInRole gets called on authorisation? This method should take a string[] roleName array, and not just a string.