asp.net - Converting Declaractive PrincipalPermission to Programmatic .Demand -

i have 2 roles this:

[principalpermission(securityaction.demand, role="domain\admin")] [principalpermission(securityaction.demand, role="domain\anotherrole")]

the problem inherited code specific domain, , want roles web.config file, can work on vm not in domain.

i have seen example this:

principalpermission permcheck = new principalpermission(                                      null,                                       @"domain\admin");  permcheck.demand(); 

since throws exception if user not in role, how change example allow either of 2 roles? use multiple iprincipal.isinrole() , throw own exception, seems there way use .demand method multiple roles.

update 12/21: sample code based on union link ladislav's answer below:

principalpermission ppadmin = new principalpermission(null, @"domain\admin"); principalpermission ppanother = new principalpermission(null, @"domain\anotherrole"); (ppadmin.union(ppanother)).demand(); 

but azman (suggested ladislav looks better more involved solution).

principalpermission has union method. method allows combining several principalpermissions before call demand. instead of using imperative permissions can check authorization manager (azman) , related role provider (authorizationstoreroleprovider). authorization manager allows defining abstract roles in application , assign real user groups , roles through mmc.