I have web api project with windows authentication. It all works good and I know who the user is but then I would like to add custom logic to check if user is allowed to access given controller.

I can see in docs that probably I should use role based authentication but the problem is that I don’t know where to put the logic to add roles to given user (it is specific to project based on some Active Directory group membership, I have the code to get all those groups).

Probably I should add some kind of middleware or filter where for each request I would set all roles and then use embeded built in mechanizm for marking controllers with attributes for which is enabled based on what roles.

So question is how to create that middleware, filter to setup all roles for given request (probably first time user enters it will make a call to active directorey and then cache it but it is implementation detail, those roles can be set up in config file as well).