Page view counter

form based authentication problem plz help

Last post 01-12-2005 10:35 AM by Damon.Armstrong. 1 replies.

Sort Posts:

  • form based authentication problem plz help

    01-12-2005, 6:22 AM
    • Loading...
    • kami909
    • Joined on 10-12-2004, 10:58 AM
    • Karachi,Pakistan
    • Posts 52
    • Points 260
    hello folks ...

    The problem is... in my project there is several folders and in each folder there have their respective aspx forms ...

    what i want is to authenticate users

    let say i have 3 folders in my project

    Admin
    Customer
    Vendors

    all have there respective login page in the folder ..how would i authenticate them?? and if they r not authorize redirect them to there respective login page...

    if any one know about this problem plz help me ...


    Thanx alot hoping 4 the reply soon ..


    Kamran Sorathia
  • Re: form based authentication problem plz help

    01-12-2005, 10:23 AM
    • Loading...
    • Damon.Armstrong
    • Joined on 01-06-2005, 12:18 PM
    • Dallas, TX
    • Posts 46
    • Points 230
    First, you will probably want to only use a single login form instead of one for each different user. Forms authentication can only send un-authenticated users to a single form, so it would be very confusing if a vendor tried to access a protected resource and was redirected to the Admin login form.

    Next, you will probably need to setup Forms authentication to use roles, and define Access Rules for each directory that will keep users from un-authorized roles from accessing items in specific folders. Assuming that you have the following three roles for your application:

    Admin
    Customer
    Vendors

    you can then Access Rules as follows. In the Admin folder, create a new web.config file. Add something similar to the following to it:

    <authorization>
    <deny users="?"/>
    <allow roles="Admin"/>
    <deny users="*"/>
    </authorization>

    This ensure that unauthenticated users cannot access the Admin folder (<deny users="?"/>), that anyone in the Admin role can access the folder, and that everyone else cannot access the folder. (You may have to check into the syntax of this, I'm not sure if it's perfect). You will have to setup a web.config file for each folder you want to protect. Make sure that you allow un-authenticated users to access the directory in which your login form is located or else un-authenticated users will have no access to the login form, which they need to become authenticated.

    So now the question is, how do you define roles, etc. You can define them in the web.config, or you can define them in a database and write some code to load them into the authentication ticket (you could do a lot of other things two, but those are probably the most popular). Here's some links on how to go about doing that:

    http://www.xoc.net/works/tips/forms-authentication.asp
    http://aspnet.4guysfromrolla.com/articles/082703-1.2.aspx

    If you google for "asp.net forms authentication with roles" you should come up with a wealth of sites that can help you out.
    Damon Armstrong
Page 1 of 1 (2 items)