1

I inherited an ASP.NET C# application that is not totally working. I have been told to use Form Authentication to prevent unauthorized users from accessing certain subdirectories.

I am having a problem understanding Forms Authentication. This is a public internet site and all users will have access to the main part of the site. However there is a subdirectory that is restricted to certain users. I know that a user is valid because they will enter a user name and password and I will look them up in a database. I have added these lines to the web.config file of the subdirectory.

<configuration>
    <appSettings/>
    <connectionStrings/>
    <system.web>
        <authorization>
      <allow roles="Administrators, Examiners"/>
            <deny users="*"/>
        </authorization>
    </system.web>

The question is how do I set in my code that the user belongs to a certain role.

Here is the pseudo code.

If user name and password match then

Set this users role to Examiners.

I don’t know the code I need to set the user to a role.

4 Answers 4

1

Take a look at your membership database.

To make a start here you go with the login method:

protected void LoginButton_Click(object sender, EventArgs e)
{
 // Validate the user against the Membership framework user store
 if (Membership.ValidateUser(UserName.Text, Password.Text))
 {
 // Log the user into the site
 FormsAuthentication.RedirectFromLoginPage(UserName.Text, RememberMe.Checked);
 }
 // If we reach here, the user's credentials were invalid
 InvalidCredentialsMessage.Visible = true;
}

you can check the user credentials within the authenticate method:

protected void myLogin_Authenticate(object sender, AuthenticateEventArgs e)
{
 // Get the email address entered
 TextBox EmailTextBox = myLogin.FindControl("Email") as TextBox;
 string email = EmailTextBox.Text.Trim();

 // Verify that the username/password pair is valid
 if (Membership.ValidateUser(myLogin.UserName, myLogin.Password))
 {
 // Username/password are valid, check email
 MembershipUser usrInfo = Membership.GetUser(myLogin.UserName);
 if (usrInfo != null && string.Compare(usrInfo.Email, email, true) == 0)
 {
 // Email matches, the credentials are valid
 e.Authenticated = true;
 }
 else
 {
 // Email address is invalid...
 e.Authenticated = false;
 }
 }
 else
 {
 // Username/password are not valid...
 e.Authenticated = false;
 }
}

For redirection depending on a specific role use this code:

protected void Login1_LoggedIn(object sender, EventArgs e)
{
    if (Roles.IsUserInRole(Login1.UserName, "Admin"))
    {
         Response.Redirect("~/Admin/Default.aspx");
    }
    else if (Roles.IsUserInRole(Login1.UserName, "Examiner"))
    {
         Response.Redirect("~/Examiner/Default.aspx");
    }
    else
    {
         Response.Redirect("~/Login.aspx");
    }
}
3
  • This is helpful. I found out that my Predecessor already created the tables I need. The web config is set up too but no code. I was able to change the web.config to point to my local database. Then the call you gave me Membership.ValidateUser worked when I feed it a sample user and password. The problem I have is that the passwords I have for my users are encrypted so I have no way of knowing what there were. So I need code to create a user and give him a password or modify the password of an existing user so I can get a sucessful call. Apr 27, 2011 at 20:31
  • I figure out what I need. While the other answers were also helful, I'm marking your as the best one. Apr 28, 2011 at 13:17
  • @Bob,I'm glad this helped. Validation of the passwords are done server side and you don't need to worry about that. You can click the Up-Vote button for all helpful answers w/o accepting their answers to give everyone some credit. Apr 28, 2011 at 15:33
0

Everything you need to know about forms authentication is covered in this asp.net security tutorial series. It is very basic and step by step so hope you may not have any problem in following it.

0

You will need to implement a membership and role provider that works with your database. The membership provider will authenticate the user and track which user is logged in. The role provider will determine what permissions the user has.

It sounds like you are approaching the problem from the wrong direction as far as the .NET membership and role providers goes. Instead of you authenticating your users and then telling Microsoft's membership and role library who is logged in and what permissions they have, the .NET framework will authenticate your users by using a membership provider, and the framework will also tell your application what permissions a user has by using the role provider. You will essentially build plugins for the membership and role providers.

See here for more information on implementing a membership provider, and here for similar information on implementing a role provider.

0

go through the link given below

[http://www.asp.net/web-forms/tutorials/security]

1
  • Your link is broken
    – Tony L.
    Oct 19, 2016 at 19:56

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.