CODEWITHSUNDEEP
c#asp.netforms-authentication
Bob Avallone
Bob Avallone

Reputation: 979

ASP.NET C# - Setting up Role Based Security with Forms Authentication

I inherited an ASP.NET C# application that is not totally working. I have been told to use Form Authentication to prevent unauthorized users from accessing certain subdirectories.

I am having a problem understanding Forms Authentication. This is a public internet site and all users will have access to the main part of the site. However there is a subdirectory that is restricted to certain users. I know that a user is valid because they will enter a user name and password and I will look them up in a database. I have added these lines to the web.config file of the subdirectory. 

<configuration>
    <appSettings/>
    <connectionStrings/>
    <system.web>
        <authorization>
      <allow roles="Administrators, Examiners"/>
            <deny users="*"/>
        </authorization>
    </system.web>

The question is how do I set in my code that the user belongs to a certain role.

Here is the pseudo code.

If user name and password match then

Set this users role to Examiners.

I don’t know the code I need to set the user to a role.

Upvotes: 1

Views: 10894

Answers (4)

Kanwar Singh
Kanwar Singh

Reputation: 908

go through the link given below

[http://www.asp.net/web-forms/tutorials/security]

Upvotes: 0

Brian McCarthy
Brian McCarthy

Reputation: 4784

Take a look at your membership database.

To make a start here you go with the login method:

protected void LoginButton_Click(object sender, EventArgs e)
{
 // Validate the user against the Membership framework user store
 if (Membership.ValidateUser(UserName.Text, Password.Text))
 {
 // Log the user into the site
 FormsAuthentication.RedirectFromLoginPage(UserName.Text, RememberMe.Checked);
 }
 // If we reach here, the user's credentials were invalid
 InvalidCredentialsMessage.Visible = true;
}

you can check the user credentials within the authenticate method:

protected void myLogin_Authenticate(object sender, AuthenticateEventArgs e)
{
 // Get the email address entered
 TextBox EmailTextBox = myLogin.FindControl("Email") as TextBox;
 string email = EmailTextBox.Text.Trim();

 // Verify that the username/password pair is valid
 if (Membership.ValidateUser(myLogin.UserName, myLogin.Password))
 {
 // Username/password are valid, check email
 MembershipUser usrInfo = Membership.GetUser(myLogin.UserName);
 if (usrInfo != null && string.Compare(usrInfo.Email, email, true) == 0)
 {
 // Email matches, the credentials are valid
 e.Authenticated = true;
 }
 else
 {
 // Email address is invalid...
 e.Authenticated = false;
 }
 }
 else
 {
 // Username/password are not valid...
 e.Authenticated = false;
 }
}

For redirection depending on a specific role use this code:

protected void Login1_LoggedIn(object sender, EventArgs e)
{
    if (Roles.IsUserInRole(Login1.UserName, "Admin"))
    {
         Response.Redirect("~/Admin/Default.aspx");
    }
    else if (Roles.IsUserInRole(Login1.UserName, "Examiner"))
    {
         Response.Redirect("~/Examiner/Default.aspx");
    }
    else
    {
         Response.Redirect("~/Login.aspx");
    }
}

Upvotes: 1

Katie Kilian
Katie Kilian

Reputation: 6985

You will need to implement a membership and role provider that works with your database. The membership provider will authenticate the user and track which user is logged in. The role provider will determine what permissions the user has.

It sounds like you are approaching the problem from the wrong direction as far as the .NET membership and role providers goes. Instead of you authenticating your users and then telling Microsoft's membership and role library who is logged in and what permissions they have, the .NET framework will authenticate your users by using a membership provider, and the framework will also tell your application what permissions a user has by using the role provider. You will essentially build plugins for the membership and role providers.

See here for more information on implementing a membership provider, and here for similar information on implementing a role provider.

Upvotes: 0

suhair
suhair

Reputation: 10929

Everything you need to know about forms authentication is covered in this asp.net security tutorial series. It is very basic and step by step so hope you may not have any problem in following it.

Upvotes: 0

Related Questions