Simple role authentication in asp.net

Question

I want to do a simple role authentication in .NET - but am lost in the profusion of apis...

I would like to have a web.config per directory with role access like:

<authorization>
    <allow roles="admin"/>
    <deny users="*"/>
</authorization>

And in my login page, where I do FormsAuthentication.RedirectFromLoginPage I want to specify the role of the logged in user (admin, user, etc...) I have no need for the RoleManagementProviders and the overkilled feature (in my case) of RoleManagement.

What API do I need to user to just specify the role of a user?

Thanks

Answer 1

Personally if you are going to use the role management, and user functionality already presented in ASP.NET why try to hack together a solution that down the road will limit your ability to expand.

Working with the default functionality for role assignment is easy, and you don't have to worry about the proper creation of the identity information for the user.

Answer 2

Here is a link on a very simple Forms Authentication implementation with roles. I believe this is the most basic Forms Authentication implementation: http://www.codeproject.com/KB/web-security/formsroleauth.aspx

Here is one on the membership provider: http://www.asp.net/learn/moving-to-asp.net-2.0/module-08.aspx You might have to search for additional tutorials to get a clear idea on how to customize it.

I prefer the membership provider because it allows you to override the defaults and supply your own datastore and methods used for the different authentication actions. I find it to be easier than using the basic implementation.

Answer 3

Note that to use the role provider model you do not have to use a database and a schema, there are simpler options. You might be interested in using the Authorization Manager (a free download from Microsoft) which lets you add a role provider to an ASP.NET application and configure the roles and permissions using their tool (an MMC snap-in accessed through Administrative Tools).

How To: Use Authorization Manager with ASP.NET 2.0

The configuration exposed by the tool gets stored into an xml file which is referenced in the applications web.config:

<connectionStrings>
  <add name="LocalPolicyStore" connectionString="msxml://C:/AzManStore.xml"/>
</connectionStrings>

Which can then be referenced when you configure the application to use the Authorization Manager role provider:

<roleManager enabled="true" defaultProvider="RoleManagerAzManProvider">
  <providers>
    <add name="RoleManagerAzManProvider"
         type="System.Web.Security.AuthorizationStoreRoleProvider, System.Web, Version=2.0.0.0, Culture=neutral, publicKeyToken=b03f5f7f11d50a3a"
         applicationName="MyApp"
         connectionStringName="LocalPolicyStore"/>
  </providers>
</roleManager>