Question

Hi I have problem on setting up the admin Module for Web app

1. I had two roles on my System Admin and Tech

2. If the go to admin module the system will see if he is admin or not

3. If the user is not admin will be redirect him to page

   Sorry, you don t have access to this page !

I used Web.config to restrict access for sub directory Admin

<?xml version="1.0"?>
<configuration>
    <system.web>
      <authorization>
        <allow roles="admin" />
        <deny users="*"/>
      </authorization>
    </system.web>
</configuration>

also I have C# code to check if the logged in user is admin or other

protected void Page_Load(object sender, EventArgs e)
    {
        if (HttpContext.Current.User.Identity.IsAuthenticated)
        {
            if (Page.User.IsInRole("admin"))
            {
                if (!Page.IsPostBack)
                {
                    DisplayRolesInGrid();
                }
            }
            if(!Page.User.IsInRole("admin"))
            {
                Response.Redirect("/accessPage.aspx");
            }

        }
    }

Answer 1

Do not confuse these two types of role management with each other. They are exclusive of each other.One in web.config and the other is in code via C#. Simply remove the web.config access part and use codein Page_Load function as you have done already.

protected void Page_Load(object sender, EventArgs e)
{

        if (Page.User.IsInRole("admin"))
        {
            // all is good, do not do anything
            // if you want to initialized something, do it here
        }
        else
        {
            // opps you do not have access here, take him somewhere else
            Response.Redirect("/accessPage.aspx");
        }


}