Groups | Blog | Home
all groups > asp.net security > may 2007 >

asp.net security : How to determine authorized roles for a page?



MyndPhlyp
5/28/2007 5:21:04 PM
I've been combing through Google trying to find the answer but not luck.

I'm using Forms authentication. Determining what Roles the current user is
in was the easy part. But how does one determine what Roles are permitted to
use a particular ASPX page? (.NET 2.0, VS05)

Alexey Smirnov
5/29/2007 7:07:36 AM
On May 29, 12:48 pm, Dominick Baier
[quoted text, click to view]

He need to determine what Roles are permitted to use the page.
Dominick Baier
5/29/2007 10:48:19 AM
you can do do that using the <authorization> element in web.config - or imperatively
usign Page.User.IsInRole to grant/deny access to a page.

-----
Dominick Baier (http://www.leastprivilege.com)

Developing More Secure Microsoft ASP.NET 2.0 Applications (http://www.microsoft.com/mspress/books/9989.asp)

[quoted text, click to view]

MyndPhlyp
5/29/2007 6:08:03 PM

"Dominick Baier" <dbaier@pleasepleasenospam_leastprivilege.com> wrote in
message news:51eb304810c1f8c96ffe631bbd60@news.microsoft.com...
[quoted text, click to view]

Dom:

Thanks. Got that part already. As Alexey said, I need to determine what
Roles are permitted to access a page.

Alexey Smirnov
5/31/2007 2:29:51 PM
On May 31, 5:05 pm, Dominick Baier
[quoted text, click to view]

Here's the complete code
http://groups.google.com/group/microsoft.public.dotnet.framework.aspnet/browse_thread/thread/8a854fd1c899cc67/
Dominick Baier
5/31/2007 3:05:26 PM
Where is this information stored? In the web.config??

If yes you can use the config API to parse it.


this:
AuthorizationSection section = (AuthorizationSection)Context.GetSection("system.web/authorization");

should get you started.


-----
Dominick Baier (http://www.leastprivilege.com)

Developing More Secure Microsoft ASP.NET 2.0 Applications (http://www.microsoft.com/mspress/books/9989.asp)

[quoted text, click to view]

AddThis Social Bookmark Button