Ask the Expert

Limiting user access in ASP.NET

In ASP.NET how can I limit access to certain directories to only users who have logged in with different roles? For example, how can I limit access to Admin/, Customer/ and Client/ directories to users who have logged in with those roles?

    Requires Free Membership to View

ASP.NET provides robust URL-based authorization capabilities allowing you to control access to directories by users, roles and even by HTTP verbs (GET, POST, and so on).

First, you need to set up your application to use either Forms or Windows authentication and configure the system to have three different roles: Admin, Customer and Client. In Windows authentication these will map to user groups and in Forms authentication those groups must be set up manually. See "Forms Authentication differences in ASP.NET 2.0" for more information on the disparities in Forms authentication between ASP.NET 1.1 and ASP.NET 2.0.

Once you have your Web application set up to authenticate users, you need to tell ASP.NET to require specific authorization in order to access resources. Web.config files supply configuration information for the directory in which they are located and all resources below them. By setting up a proper <authorization> tag in the web.config file you can control what users are allowed access to the directories.

ASP.NET security resources:
How to create a secure login page using ASP.NET

Discover the power of .NET's code access security

Authentication & authorization: Secure ID and user privileges

Forms Authentication -- Professional ASP.NET 2.0 Security, Membership and Role Management

To allow access only to users with the Admin role for the Admin/ directory, the <authorization> tag should be set up as follows:

<authorization>

    <allow roles="Admin" />

    <deny roles="*" />

</authorization>

This will allow users with a role of Admin to access files in the Admin/ directory and will disallow all others.

Here is a great MSDN reference article with more specifics and syntax information for URL authentication.

This was first published in September 2006

There are Comments. Add yours.

 
TIP: Want to include a code block in your comment? Use <pre> or <code> tags around the desired text. Ex: <code>insert code</code>

REGISTER or login:

Forgot Password?
By submitting you agree to receive email from TechTarget and its partners. If you reside outside of the United States, you consent to having your personal data transferred to and processed in the United States. Privacy
Sort by: OldestNewest

Forgot Password?

No problem! Submit your e-mail address below. We'll send you an email containing your password.

Your password has been sent to: