In this article we will tell you how to do role based authorization.

This article is very useful for security purposes.

Suppose we have the three folders in our web site AdminUser, ClientUser and PartnerUser. In that folder there are some aspx pages. I want that the user with admin rights to be able to see the the aspx pages in the AdminUser folder. If the admin user attempts to open the pages that are in the ClientUser folder and the PartnerUser folder then the website automatically redirects the admin user to the login page. Similarly, the client and partner users can only access the pages in which they have rights.

To do role based security please use the following procedure.

1. User Credential store in web.config

For Admin User

  1. <!--Path: folder path -->
  2. <location path="AdminUser">
  3. <system.web>
  4. <authorization>
  5. <!-- Allow user who have Admin role can access the AdminUser folder aspx pages -->
  6. <allow roles="Admin"/>
  7. <!-- Other user can not access AdminUser folder aspx pages -->
  8. <deny users="*"/>
  9. </authorization>
  10. </system.web>
  11. </location>

For Client User

  1. <!--Path: folder path -->
  2. <location path="ClientUser">
  3. <system.web>
  4. <authorization>
  5. <!-- Allow user who have Client role can access the ClientUser folder aspx pages -->
  6. <allow roles="Client"/>
  7. <!-- Other user can not access ClientUser folder aspx pages -->
  8. <deny users="*"/>
  9. </authorization>
  10. </system.web>
  11. </location>

For Partner User

  1. <!--Path: folder path -->
  2. <location path="PartnerUser">
  3. <system.web>
  4. <authorization>
  5. <!-- Allow user who have Partner role can access the PartenerUser folder aspx pages -->
  6. <allow roles="Partner"/>
  7. <!-- Other user can not access Partner folder aspx pages -->
  8. <deny users="*"/>
  9. </authorization>
  10. </system.web>
  11. </location>

2. In Global.asax in the Application_AuthenticateRequest event create the security principal for the user role

  1. // Check that the request has been authenticated
  2. if (Request.IsAuthenticated)
  3. {
  4. // Get the role from the ticket
  5. string[] role = new string[1];
  6. role[0] = ((FormsIdentity)Context.User.Identity).Ticket.UserData;
  8. // Create a new GenericPrincipal with the role information
  9. System.Security.Principal.GenericPrincipal newPrincipal = new System.Security.Principal.GenericPrincipal(Context.User.Identity, role);
  11. // Add the principal to the security context, which replaces the current GenericPrincipal
  12. Context.User = newPrincipal;
  13. }
3. If the user's login and user password are correct then generate the FormsAuthenticationTicket and save it in the cookie.

  1. FormsAuthenticationTicket ticket = new FormsAuthenticationTicket( 1, UserID.ToString(),
  2. DateTime.Now, DateTime.Now.AddMinutes(180), true, UserRole);
  3. // User data string, in our case, to hold the role
  4. string encryptedTicket = FormsAuthentication.Encrypt(ticket);
  5. HttpCookie authenticationCookie
  6. = new HttpCookie(FormsAuthentication.FormsCookieName, encryptedTicket); Response.Cookies.Add(authenticationCookie);
Now if the admin user has successfully logged in can not access the ClienUser and if he tries to change the URL then he will be redirected to the login page.