Question

I am using ASP.net form authentication for my web application. I have folder “admin” for administration work, and also I can lock one user if he/she misbehaves.

currently if an normal user tries to access the admin page, it will be redirected to the logon page, although he/she is already logged on.

The question is: how can I configure the web app, so that when the user fails to access a page, I can show different pages such as “you need admin privilege to access this page”/”your account is locked out”/(normal logon page)?

ValidateUser() can only return bool. 🙁

Thanks a lot

Answer 1

You’ll need to implement roles and add people to them. Once you assign people to the proper roles, you would check to see if the person is in the proper role to access a page. If not, redirect them or show the proper error message. You would be able to do this with code behind like it seems like you are already trying:

if(!Roles.IsUserInRole("Administrator")) Response.Redirect("~/");

Or you can use the web.config

<configuration>
   <location path="memberPages">
       <system.web>
            <authorization>
               <allow roles="Administrator" />
               <deny users="*" />
            </authorization>
          </system.web>
        </location>
<configuration>

See the links below for more info:

• https://web.archive.org/web/20210417083524/https://www.4guysfromrolla.com/articles/121405-1.aspx
• http://msdn.microsoft.com/en-us/library/ff647401.aspx