Using ASP.NET roles to represent different access levels

Question

I need to design a system that will control access to certain information. The requirement from the user is to use access levels e.g.

Level 1 - Support
Level 2 - Manager
Level 3 - Senior Manager
Level 4 - Department Head
etc.

If a certain piece of information is marked as Level 1, then all roles should be able to view that piece of information. If it is marked as level 3, then only the Senior Manager and Department Head can view it, but the Manager and Support roles can't view it.

Questions

• When I assign the access level to a piece of information, will I have to assign multiple roles to it in order for me to achieve this functionality?
• Is there a better way of doing this?

Answer 1

you need to implement form authentication with and add your roles/level in web.config, which Role can get which page.

<location path="yourPage.aspx">
    <system.web>
            <authorization>
                <deny users="?"/>
                <allow roles="Manager"/>
                <deny users="Department Head"/>
            </authorization>
    </system.web>

For details plz check these URLs http://msdn.microsoft.com/en-us/library/aa480476.aspx http://devhood.com/tutorials/tutorial_details.aspx?tutorial_id=85

if you want to hide some specific information on page against specific role, you can do this like...

if (System.Web.HttpContext.Current.User.IsInRole("Support"))
        {
            pnl.Visible = false;//try to put your user specific details in panel to hide/show
        }

Answer 2

Map your roles to a global enum such that the order of the enum represents the priority of access for example:

public enum SecurityGroup
{
    Support, Manager, SeniorManager, DepartmentHead
}

Obviously these roles should match your Provider roles. You would then use Enum.Parse to cast the value from GetRolesForUser like so:

var currentUserSecurityGroup = (SecurityGroup)Enum.Parse(typeof(SecurityGroup), Roles.GetRolesForUser(username));

Now, you can check the relative position against your group:

if ( currentUserSecurityGroup <= SecurityGroup.SeniorManager )
   // do stuff