Question

I am working on an intranet website using ASP.NET and was wondering what exactly I can gain by enabling roles when Windows authentication is enabled for my website. I can check if users belong to groups with the User object so why would I need to enable roles given that windows authentication is enabled?

Answer 1

It is often the case that someone in the “Adminstrators” group on active directory is not an administrator on a specific system. The “Administrators” group on your Windows network will point to the network administrators, but what you really want is a different administrators group specific to your application. If you had a system that handled some numbers for the Finance department, you wouldn’t want the network administrators to also be the administrators for the Finance system.

That’s where the role manager comes in. The role manager allows you to continue to use Windows Authentication, but create your own roles, separate from your network, and assign a different set of users to that role. On your intranet for example, you might want managers to be able to edit pages, so you assign them to the “Page Editor” role.