Where to mention Accessdenied page in form Authentication

Question

I have implement Form Authentication

 <location path="Admin">
 <system.web>
  <authorization>
    <deny users="?"/>
    <allow roles="Admin" />
    <deny roles="systemAdmin"/>
  </authorization>
  </system.web>
 </location>

Since in above mentioned rights, Admin can have access to Admin folder and systemAdmin can't have.

I have make custom Accessdenied page where I am showing message to user he has not permission to access this page

Now the issue is, If systemAdmin try to hit Admin folder page, he will be redirected to AccessDenied.apsx page. (please Note: both user are authenticated, 1 user have permission to some folder and other user have permission to other folder. I don't want to put check in each page)

where to specify accessdenied page redirection ?

Thanks

Answer 1

I haven't seen in option to redirect to AccessDenied page in web.config.

I am using following code in common base page.

 if (!Page.IsPostBack)      
 {           
     if (Request.IsAuthenticated )
         // This is an unauthorized, authenticated request...                
         Response.Redirect("~/Unauthorized.aspx");      
 }

update:

I just played around little bit

<authentication mode="Forms">
    <forms loginUrl="/login/Login.aspx" />
</authentication>

With above settings, if systemAdmin visits admin pages, he will get redirected to login page. There you can put some logic, if user already logged in, then redirect to access denied page.

Let me know if this helps you or not.

Answer 2

Sadly the default access mechanisms don't differentiate between between a 401 Unauthorized and a 403 Forbidden.

If you don't want to implement Saar's solution of using a common base page - and have all your admin pages inherit from the base page class, an alternative option would be to write the logic in your login page - check to see if the user is already logged in (Request.IsAuthenticated) and display a message stating that they don't have permission to view the pages.

You should probably also change the Response.StatusCode to 403 and the Response.StatusMessage to "Forbidden"