Question

Does anyone know of a way to get ASP.NET Forms Authentication to not redirect back to the login page if a user is not allowed to visit a certain page or folder based on their role (and perhaps show a message instead)?

Answer 1

The redirect happens because the user is not authorized to see the page – not because she is not authenticated with the system. As such, the framework does not distinct between the situation where a user is “not logged in” and the situation where she is just “missing the required role”. If she does not have acccess, she is redirected to the login page – end of story.

What I usually do, is to create my login form with a MultiView with a view for each of the two cases, as well as one for the case where the user asked for the login form himself. Then I do something like this to toggle between the different views:

if (Request.QueryString["ReturnUrl"] == null)
   myMultiView.ActiveViewIndex = 0;               // user asked for login form
else if (Request.IsAuthenticated)
   myMultiView.ActiveViewIndex = 1;               // insufficient rights
else
   myMultiView.ActiveViewIndex = 2;               // login required

Rather than using a MultiView you could also insert a Response.Redirect in branch above, if this seems to make more sence in your application – e.g. if the three login forms are significantly diverse.