Forms authentication Of Asp.net

Question

I am working on Asp.net Application where I have 4 roles in my application. 1. Admin 2. User 3. Reseller 4. Affiliate. And I am Using Form Authentication for this everything was working fine for single role(User). But now i have 4 roles and I am not getting how to manage this. I have 4 folders for different Users. If i login with reseller account and if i change the url for user then its allowing me to access user part also. But i don't want this. I need in my app that user can access only his access area. Means If your reseller logged in then he can only access reseller pages or same folder nothing else.

Please help me to find this solution.

Answer 1

You can use the web.config to set the permission or you can also get more granular and decorate the class or method you want to lock down like this:

[PrincipalPermissionAttribute(SecurityAction.Demand, Role = @"Administrators")]

All of this is part of the role manager that you can set up. Start by reading this article that explains what to do.

Answer 2

There's two things to look at here. First of all, restricting access to each folder by role ought to be straightforward enough if you use <location> elements in your web.config e.g.

<location path="Resellers">
    <system.web>
        <authorization>
            <allow roles="Reseller"/>
            <deny roles="*"/>
       </authorization>
    </system.web>
</location>

<location path="Users">
    <system.web>
        <authorization>
            <allow roles="User"/>
            <deny roles="*"/>
       </authorization>
    </system.web>
</location>
...

Also in your individual pages, you can call the IsUserInRole function to check whether your user is in the correct role to access the page.

You might want to get hold of a copy of Beginning ASP.NET Security, it's got great information on how to do this.