Role Based Authorization in ASP.Net

In this article we will tell you how to do role based authorization.

This article is very useful for security purposes.

Suppose we have the three folders in our web site AdminUser, ClientUser and PartnerUser. In that folder there are some aspx pages. I want that the user with admin rights to be able to see the the aspx pages in the AdminUser folder. If the admin user attempts to open the pages that are in the ClientUser folder and the PartnerUser folder then the website automatically redirects the admin user to the login page. Similarly, the client and partner users can only access the pages in which they have rights.

To do role based security please use the following procedure.

1. User Credential store in web.config

For Admin User

<location path="AdminUser">
<system.web>
<authorization>
<allow roles="Admin"/>
<deny users="*"/>
</authorization>
</system.web>
</location>

For Client User

<location path="ClientUser">
<system.web>
<authorization>
<allow roles="Client"/>
<deny users="*"/>
</authorization>
</system.web>
</location>

For Partner User

<location path="PartnerUser">
<system.web>
<authorization>
<allow roles="Partner"/>
<deny users="*"/>
</authorization>
</system.web>
</location>

2. In Global.asax in the Application_AuthenticateRequest event create the security principal for the user role

// Check that the request has been authenticated
if (Request.IsAuthenticated)
{
// Get the role from the ticket
string[] role = new string[1];
role[0] = ((FormsIdentity)Context.User.Identity).Ticket.UserData;
// Create a new GenericPrincipal with the role information
System.Security.Principal.GenericPrincipal newPrincipal = new System.Security.Principal.GenericPrincipal(Context.User.Identity, role);
// Add the principal to the security context, which replaces the current GenericPrincipal
Context.User = newPrincipal;
}

3. If the user's login and user password are correct then generate the FormsAuthenticationTicket and save it in the cookie.

FormsAuthenticationTicket ticket = new FormsAuthenticationTicket( 1, UserID.ToString(),
DateTime.Now, DateTime.Now.AddMinutes(180), true, UserRole);
// User data string, in our case, to hold the role
string encryptedTicket = FormsAuthentication.Encrypt(ticket);
HttpCookie authenticationCookie
= new HttpCookie(FormsAuthentication.FormsCookieName, encryptedTicket); Response.Cookies.Add(authenticationCookie);

Now if the admin user has successfully logged in can not access the ClienUser and if he tries to change the URL then he will be redirected to the login page.

3 Comments

Join the conversation! Your thoughts help the community grow.

Attiq Jaffar7y ago
Thx for saving my day
Milburn Gomes8y ago
Great tutorial! Exactly what I needed. Thanks a lot!
Purush Seo11y ago
Hello exactly am using your code initially it worked once executed after that it is not working with your code when i was changing location path as like ex: "~/PartnerUser" it is working but access all pages. could you please give me solution for this.