Question

i am using windows authentication with my asp.net application

different users will have different access to parts of the website.

i would like to do something like this in the config file:

    <appSettings>
     <role1>
<user>agordon</user><user>jsmith</user>
     </role1>
<role2><user>dtodd</user><user>kveel</user></role2>
    </appSettings>

is this possible to do?

when authenticating i would then get the username like this:

string username = HttpContext.Current.User.Identity.Name.ToString();

and check if that user exists in the specific role

Answer 1

Use the <authorization> element:

<configuration>
   <system.web>
      <authorization>
         <allow users="*" />
         <deny users="?"/>
      </authorization>
   </system.web>
</configuration>

You can then modify that for particular parts of your site:

<location path="Pages/Administration">
       <system.web>
          <authorization>
             <deny roles="*"/>
             <allow roles="Admin" />
          </authorization>
       </system.web>
</location>