How to authenticate users entering Dynamic Data admin area in ASP.NET MVC site?

Question

Hello!

I have an ASP.NET MVC 1.0 front-end site that is working well, and features as part of it, a Dynamic Data section that I'm using as the back-end admin area for the site.

I haven't messed about too much with authentication yet, but this seems like quite a logical web-site design for any new .NET sites being put together these days. I'm hoping someone might have some advice to share on how to lockdown the Dynamic Data section of a site (Dynamic Data uses plain old ASPX pages) using Froms Authentication, while leaving the MVC front end components freely browsable.

FYI - the site is hosted on Win2k3/IIS6.0, and the server does not have MVC installed, so I'm including the DLLs in the \bin directory and using the routing engine to append the .aspx suffx onto the controllers, so as IIS can understand the MVC parts of the site.

Thanks...

Bernard.

Answer 1

You should be able to lock those pages down in the same way you'd lock down pages in a standard asp.net site - add the folder name in a location block in a web.config:

<!--
  The location element is only needed if this is in root web.config.
  You could also create a web.config in the folder containing the dynamic data
  pages and just have the elements from system.web
-->
<location path="DynamicDataFolder">
  <system.web>
    <authorization>
      <allow roles="Admin"/>
      <deny users="*"/>
    </authorization>
  </system.web>
</location>

This assumes that you've set up the Membership and Roles providers - there are examples of these in the default MVC project and created a login page.

Answer 2

Hey Bernard,

Were you able to accomplish this? I have the same issue on my end. Need to lock access to the pages to admin.

Also, how can i insert Userid to the CreatedBy, Modifiedby columns for each record in the table.

Thanks

Manny [email protected]