ASP.NET access controls

Question

I am trying to build an ASP.NET 3.5 website that allows users to log in and browse a couple of pages. I would like to restrict certain users to be able to view certain pages but I'm having trouble coming up with a custom and flexible system. I have seen MS's version of this but it's not what I am looking for. Can anyone direct me to some good online articles or even a video tutorial so I can do further research. Thanks!

P.S. I have tried creating a class that inherits from System.Web.UI.Page which does some checking but it's getting messy. All my other pages inherit from that common page. Is this a common practice? How have you guys solved this problem in the past?

Answer 1

Well, without knowing the exact details of your app, one thing you could use is the Role Manager built into the Membership API.

Basically, you would create roles for each page and assign users to the roles (pages) you would want them to view.

In the code behind for each page, on the On_Load event, I would simply call the method

if(Roles.IsUserInRole(rolePageName))
{
  //Continue page loading logic
}
{
  //Redirect or transfer the user elsewhere
}

For this kind of logic you may want to reconsider using an inherited page, otherwise you're going to have to come up with a way to retrieve the URL of the page and pass that into some long list of if-else or switch statements to call the proper Roles.IsUserInRole method.

Answer 2

The best way to implement this would be, Forms Authentication coupled with Custom Role Provider.

Hope you know, for Forms Authentication to work, you need not have to use the Complete Database Setup that MS uses to Authenticate.

You can simply have your own Database and Validate a user yourself, and just set the cookie.

String UserName = "CoolGuy";
Boolean isValidUser = YourClass.YourMethod(UserName);
if (isValidUser)
{ FormsAuthentication.setAuthCookie(UserName, false); }

This will authenticate the user "CoolGuy" for the session, provided YourMethod returns true.

You can use this, coupled with custom role provider. This gives you the facility to check User.IsInRole("Role"); in your code.

To Start with CustomRoleProvider.. here is a good reference... http://davidhayden.com/blog/dave/archive/2007/10/17/CreateCustomRoleProviderASPNETRolePermissionsSecurity.aspx

• Raja