Question

I have an application that has a backoffice. This backoffice was isolated with the use of roles like this:

<location path='backoffice'>     <system.web>         <authorization>             <allow roles='admin'/>             <deny users='*'/>         </authorization>     </system.web> </location> 

But now we have another type of role that needs access. The companyadmin role.

Can I just say?:

 <location path='backoffice'>         <system.web>             <authorization>                 <allow roles='admin,companyadmin'/>                 <deny users='*'/>             </authorization>         </system.web>     </location> 

Answer 1

Yes, exactly so (assuming you properly authenticated your users, and set their roles accordingly).

Check the MSDN article: https://learn.microsoft.com/en-us/previous-versions/dotnet/netframework-1.1/8d82143t(v=vs.71)