I have an application that has a backoffice. This backoffice was isolated with the use of roles like this:
<location path='backoffice'> <system.web> <authorization> <allow roles='admin'/> <deny users='*'/> </authorization> </system.web> </location>
But now we have another type of role that needs access. The companyadmin role.
Can I just say?:
<location path='backoffice'> <system.web> <authorization> <allow roles='admin,companyadmin'/> <deny users='*'/> </authorization> </system.web> </location>
Yes, exactly so (assuming you properly authenticated your users, and set their roles accordingly).
Check the MSDN article: https://learn.microsoft.com/en-us/previous-versions/dotnet/netframework-1.1/8d82143t(v=vs.71)