Ok, this first part is purely advise on style so ignore it if you wish. The way you do it works, but textbooks suggest a different style. At the beginning of your loop, change the "If no ID to read, return" followed by "If ID not read successfully, return" to "If card is ready to read" and "If card read successfully". You move the closing brace then toward the end of the routine. This provides a "single point of exit" for the loop function. Again, purely style.
Now, lets get started making the program do what you want. You are currently reading the ID and then looping through it byte for byte to A: display it on the Serial monitor, and B: concatenate up a String. That may work well in other environments, but on the Arduino String is not recommended, especially with a lot of concat being done because the Arduino doesn't manage String memory well.
The library/class you are using provides the data type for the native ID. It would be better to leave the IDs in that native form. Understandably, you would need a way to compare the ID read to a list of valid IDs. I have never used this library/class but am willing to assist with the comparison if you agree with this suggestion.
My next suggestion is that you define a couple of global variables by declaring them at the top of the program, typically before the setup function. I would suggest three such variables.
bool isLocked = false; // Indicates if currently locked or open
xxx lockID; // ID which locked the case
xxx masterID; // ID for the Master card
I have used xxx here because, as I said, I am unfamiliar with the library/class. Instead of xxx you would need to put in the native data type for ID cards that the library/class provides for you. If you can't figure that out, I'll see if I can find it for you.
After having sucessfully reading an ID, if the case is unlocked (!isLocked), lock it and set lockID = ID that was read. else If the case is locked and the ID is a match, open it and set isLocked back to false. The same applies if you read the Master ID.
So, now, determine if my advise is worth following and implement as much of it as you can. If it still isn't right for you, post the code again and I or others will again provide some tips.
Again, I apologize if I sounded condescending.