Question

I have an asp.net 4 webforms project. I have a form for managing existing users in the app, but some of the options may be grayed out or hidden for some users depending on their role within the application (admin, user, etc). E.g. an admin can change a user’s role from a drop down list, but a normal user would see the drop down list grayed out (or possibly hidden).

Of course, on the postback I can have a big function that checks all the conditions like “if a user less than admin modified property X, then ignore saving that change.” There may be a list of several of these checks for a single form.

But is there a better way in asp.net to handle this type of thing?

Answer 1

Could use PrincipalPermissions to restrict a method from being executed by anyone other than a particular role

Import System.Security.Permissions

Place above the method

<PrincipalPermissions(SecurityAction.Demand, role:="Admin")> _

...

This isn’t going to hide the controls from users but I suppose you can either wrap that particular controls in a LoginView or control their visibility programmatically.