Hi there,

We have 500 users on our network. I'm writing a web system (asp.net) where
you can create a user and give them access to various sections of the site.

To create a user you select and existing Active Directory user and just
attach their permissions (to see different web pages/options on web pages)
then save it to a database.

The purpose is to have the system hanging off the intranet and it will
seamlessly let registered users use the system without logging one (i.e. the
fact they they are logged into windows is enough).

In the default page I can pick up up the user logged into the machine and
test against my DB like so:

If temp.isUserRegistered(HttpContext.Current.User.Identity.Name().Split("\",
2)(1)) Then

FormsAuthentication.RedirectFromLoginPage(HttpContext.Current.User.Identity.Name().Split("\", 2)(1), False)
Response.Redirect("menu.aspx")
end if

What do I need to have set in iis and web.config to prevent users from just
typing in the url for the menu to get into the system. I've had this working
before with forms but not sure with this check with AD users.

Further to this, how would I prevent certain content on a page being
displayed to a user that doesn't have access to see that particularlink for
example (and example might be a button to take you to the admin section, I
don't want the button to be visible a normal user and I don't want a normal
user to able to just browse to the admin.aspx page).

One stipulation is that I can't have a seperate fodler for each type of
access and thus have separate web.config files.

Just to make it clear, the permissions are set in my web system and stored
on my DB. I'm only using AD to check that the user currently logged in to
windows is a user within this system (i.e. their username has been stored in
DB with some permissions).

Many thanks for any help on this one.

Jono

Hi Jono,

I thinks this is mainly an ASP.net form authentication related issue. Our
ASP.net newsgroup should be the best place to give you qualified
suggestions on it.

microsoft.public.dotnet.framework.aspnet.security

From my point of view, the most general and straightforward way may be
using session state to maintain the users' login status. Then nobody can
get into the site by simply inputting the url.

Thanks.

Best regards,

WenJun Zhang
Microsoft Online Partner Support

This posting is provided "AS IS" with no warranties, and confers no rights.