Configuration and Deployment

Re: Redirect a user with invalid permissions

mandrews1234 — Fri, 03 Jul 2009 13:39:59 GMT

Did you guys see my if statement question. What is wrong with that? Also I tried the custom errors thing in my web.config but it still redirects to login.aspx. I can't use a logged in template because they are logged in, they just don't have the correct role. Am I correct on that? Thanks for all of your help.

Re: Redirect a user with invalid permissions

briangreig — Thu, 02 Jul 2009 20:48:06 GMT

Why not just add this to your Web.config files:

<system.web>
<customErrors mode="RemoteOnly" defaultRedirect="GenericErrorPage.htm">
<error statusCode="403" redirect="PermissionsError.aspx" />
</customErrors>

</system.web>

This will redirect all 403 errors (access denied) to your custom page.
Good Luck,
Brian

Re: Redirect a user with invalid permissions

sukumarraju — Thu, 02 Jul 2009 20:34:14 GMT

//You can use LoginView control to achieve this. Instead of redirecting to 
//permissionsError.aspx you can display the Authorization message on the same 
//page.

<asp:LoginView ID="LoginView1" runat="server">
     <LoggedInTemplate>
          You are not a member of the Supervisors or Administrators roles. Therefore you cannot edit or delete any user information.
     </LoggedInTemplate>
     <AnonymousTemplate>
          You are not logged into the system. Therefore you cannot edit or delete any user information.
     </AnonymousTemplate>
</asp:LoginView>

Refer this article that explains in detail. Please note here are number of videos on security including Role based security.
Check this video that explains indetail, how to Authorize using Roles.

Let me know further Queries.

Redirect a user with invalid permissions

mandrews1234 — Thu, 02 Jul 2009 20:01:40 GMT

I have went through and put in web.config files in each folder giving specific roles access or not. Now whenever a user tries to go to a page that they don't have access to, they get redirected to the login page. How do I change that to a generic "sorry you don't have permissions to see this page" page? Also, what is wrong with this if statement I want to redirect the user if they are not either a site admin or a super admin

If Not ((Roles.IsUserInRole(Membership.GetUser.UserName, "SiteAdmin")) Or ((Roles.IsUserInRole(Membership.GetUser.UserName, "SuperAdmin")))) Then
Response.Redirect("PermissionsError.aspx")
End If ' if not roles

I get an error saying that the specified cast is not valid.