ASP.Net Roles: Page-Level Security Question

Question

We're currently in the process of re-creating a brand new security model that dwarfs our existing process. Right now, we plan on grabbing a user's roles during the login process and then using a Base Page class to check if the user has the role of the corresponding page the user is navigating to.

We can limit the menu's options by the user's roles as well, but we have had problems with users navigating to pages in our system by typing them in or having old bookmarks. Obviously, we need some sort of page level access.

A simple function in our Base Page class that checks the role in the Arraylist against the page's assigned role would work, but I was wondering if there was any built-in functionality to support this or a cleaner solution possibly.

Answer 1

Have you looked at ASP.Net Membership for this yet? It takes care of all of the scenarios you listed above (trimming menus, page security,) and in a very easy to use manner.

See here for more information about membership - http://msdn.microsoft.com/en-us/library/yh26yfzy.aspx.

Answer 2

Are you using built-in membership?

If so, you can use the location section of your web.config file to restrict access to individual pages or entire directories. From MSDN:

The following example allows an anonymous user to access the Logon.aspx page:

<configuration>
   <location path="Logon.aspx">
      <system.web>
         <authorization>
            <allow users="?"/>
         </authorization>
      </system.web>
   </location>
</configuration>

Answer 3

Iam pretty new to Membership and Role Management in ASP.Net, hope you will be right person in helping me out.

As per my knowledge, assigning permissions to roles can be done at folder level.

I have to build a custom Website administrator tool which uses the ASPNetDB database(available with .net framework), it should have an option to create roles and edit them in such a way that the users should be able to assign permissions to the roles at page level and also at functionality level within that Page for each role.

Pls mail me at [email protected]