Question

Hey,
I am building a content management system and so far I am trying to get a member’s area to work. I figured out the CreateUserWizard and the Login controls. I also used Roles.AddUserToRole(RegisterUser.UserName, "Member"); upon account creation to assign the user the role of a “Member”. I have been googling but I havent been able to find a solid way on how to restrict either a directory or a page to make it so that only “Member” users can access it, otherwise redirect to login page. Can anyone give me an idea for this? Also I had a related question, when I go on to the site and I am NOT logged in, what is my default role? is it guest or just null?

Thanks!

Answer 1

Non-logged-in users have no roles.

You can restrict specific areas of your site in Web.config.

First, disallow access to the entire site:

<authorization>
    <deny users="?" />
    <deny users="*" roles="" />
</authorization>

You can then selectively grant access to specific areas using the <location> element:

<location path="Login.aspx">
    <system.web>
        <authorization>
            <allow users="?" />
        </authorization>
    </system.web>
</location>
<location path="SomeFolder/">
    <system.web>
        <authorization>
            <allow roles="Member" />
        </authorization>
    </system.web>
</location>

• users="?" means anonymous (non-logged-in) users
• users="*" means all logged-in users.