Role based authorization

Question

Hi

I am trying to use Role based authorization in declarative way, when unauthorized user attempt to access a page, it never fire an exception or show the user an error message. What I should do to show unauthorized message? is that possible in declarative way?

using coding is not a nice option sense I have several roles, and folder authorized for several roles while other folders are authorized for one role.

thanks

Answer 1

If it fails authorization it will throw an exception. It must be passing. What are you using for authentication? Have you disabled anonymous access?

Answer 2

Perhaps you could make use of a site map. More on those here, plus a bit about tying security to them here.

Answer 3

Use the following code in your Login page to redirect the user to either an unauthorized page or the default page.

    protected void Page_Load( object sender, EventArgs e )
    {
        if( Page.IsPostBack )
            return;

        if( !Request.IsAuthenticated )
            return;

        if( !string.IsNullOrEmpty( Request.QueryString["ReturnUrl"] ) && !UrlAuthorizationModule.CheckUrlAccessForPrincipal(Request.QueryString["ReturnUrl"], User,"GET"))
        {
            // In Forms Authentication, authenticated but unauthorized requests are converted into a Redirect to the Login page.  
            // Redirect these to an error page instead.
            Response.Redirect( "~/UnauthorizedAccess.aspx", false );
        }
        else
        {
            Response.Redirect( FormsAuthentication.DefaultUrl, false );
        }
    }

See this link for a picture of what's happening and more info:

http://www.asp.net/security/tutorials/user-based-authorization-cs

Answer 4

It's also possible to use web.config to set up permissions for various folders or files. Each folder could have a list of allows or denys like so:

<?xml version="1.0"?>
<configuration>
  <system.web>
    <authorization>
      <allow roles="Administrators" />
      <allow roles="Random Role" />
      <deny users="*" />
      <deny users="?" />
    </authorization>
  </system.web>
</configuration>

Then when someone hits the page that requires authorization that they don't have permission for it will redirect them to your login page. You could then check the query string for the page they came from and perhaps set up case specific responses, or at the very least if it has a returnURL page on it, say "You are not authorized to see this page."