Question

I’m developing an ASP.NET authorization module, and so far it works beautifully when using with MVC applications.

However, one of my requirements is that it must work with plain old ASP.NET applications too.

In order to do so, I need to detect what are the required roles that a user must have to access an arbitrary URL.

For instance, imagine that we have in the web.config:

<location path="foo">
  <system.web>
    <authorization>
      <deny user="?"/>
      <allow role="bar, superFoo"/>
    </authorization>
  </system.web>
</location>

Other than reading the web.config myself, how can I detect that the path foo requires the roles bar and superFoo?

I’m checking the roles requirement through an implementation of the IHttpModule interface.

Answer 1

You can check ability of access to path by using UrlAuthorizationModule.CheckUrlAccessForPrincipal.

The CheckUrlAccessForPrincipal method checks to see whether the
current user is granted access to the requested file in the Web.config
file for the application.