ASP.NET Authorization Settings

Question

hi All

I want to setup a authorization permission in ASP.NET application.

Hence , in one particular folder I want to deny the access of one particular user which user role is granted as allow for that particular.

 <authorization>
            <allow roles="General" />
            <allow roles="Sale" />
            <allow roles="Administrator" />
            <deny users="admin_test" />
 </authorization>

However , when I tried to access the pages from that particular folder by using the admin_test account , system allow me to access the page instead of denying the access.

Can anyone point out what wrong with above configuration?

Any help would be much appreciated.

Regards,

Ran

Answer 1

You need to have the deny listed first. The authorization engine will stop on the first matching rule:

At run time, the authorization module iterates through the allow and deny elements, starting at the most local configuration file, until the authorization module finds the first access rule that fits a particular user account. Then, the authorization module grants or denies access to a URL resource depending on whether the first access rule found is an allow or a deny rule.

Answer 2

According to http://msdn.microsoft.com/en-us/library/wce3kxhd.aspx

Rules are applied as follows:

Rules contained in application-level configuration files take precedence over inherited rules. The system determines which rule takes precedence by constructing a merged list of all rules for a URL, with the most recent rules (those nearest in the hierarchy) at the head of the list.

Given a set of merged rules for an application, ASP.NET starts at the head of the list and checks rules until the first match is found. The default configuration for ASP.NET contains an element, which authorizes all users. (By default, this rule is applied last.) If no other authorization rules match, the request is allowed. If a match is found and the match is a deny element, the request is returned with the 401 HTTP status code. If an allow element matches, the module allows the request to be processed further.

So if the admin_test user is in any of General, Sale, Administrator roles, it will match first and allow the access. Try putting the deny rule before allow rules.