5

I am working on Asp.net Application where I have 4 roles in my application. 1. Admin 2. User 3. Reseller 4. Affiliate. And I am Using Form Authentication for this everything was working fine for single role(User). But now i have 4 roles and I am not getting how to manage this. I have 4 folders for different Users. If i login with reseller account and if i change the url for user then its allowing me to access user part also. But i don't want this. I need in my app that user can access only his access area. Means If your reseller logged in then he can only access reseller pages or same folder nothing else.

Please help me to find this solution.

Improve this question

5 Answers 5

Reset to default
1

You can use the web.config to set the permission or you can also get more granular and decorate the class or method you want to lock down like this:

[PrincipalPermissionAttribute(SecurityAction.Demand, Role = @"Administrators")]

All of this is part of the role manager that you can set up. Start by reading this article that explains what to do.

Improve this answer
Sign up to request clarification or add additional context in comments.

Comments

1

There's two things to look at here. First of all, restricting access to each folder by role ought to be straightforward enough if you use <location> elements in your web.config e.g.

<location path="Resellers">
    <system.web>
        <authorization>
            <allow roles="Reseller"/>
            <deny roles="*"/>
       </authorization>
    </system.web>
</location>

<location path="Users">
    <system.web>
        <authorization>
            <allow roles="User"/>
            <deny roles="*"/>
       </authorization>
    </system.web>
</location>
...

Also in your individual pages, you can call the IsUserInRole function to check whether your user is in the correct role to access the page.

You might want to get hold of a copy of Beginning ASP.NET Security, it's got great information on how to do this.

Improve this answer

3 Comments

Wont that deny all Roles and then stop?
@Lazarus Possibly... I can never remember all the ins and outs of setting up the authorization element. Have swapped them round.
I believe they are processed in order of definition :)
0

You need to set the appropriate authentication settings in a web.config file for each folder you are restricting access to, i.e.

<authorization>
  <deny users="?" />
  <allow roles="Administrators" />
  <deny users="*" />
</authorization>

Will allow access only to validated users with the role of "Administrators".

Improve this answer

2 Comments

You don't need the Deny Anonymous users. You only need the Allow roles and Deny All.
True but does shortcut the validation a little, why attempt a Role lookup on an anonymous user.
0

In each of the folders you have to place a web.config file that restricts access to the role in question. For example, in the resellers folder you have a web.config containing:

<authorization>
  <deny users="*"/>
  <allow roles="Resellers"/>
</authorization>

And so on for the other folders.

Improve this answer

1 Comment

Wont that hit the Deny all users and stop?
0

use like below code:

<location path="Users">
        <system.web>
            <authorization>
                <allow roles="Users"/>
                <deny users="*"/>
            </authorization>
        </system.web>
    </location>
Improve this answer

Comments

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.