I’m developing an ASP.NET system that has two different ‘tiers’ of roles. The main tier will use Active Directory groups to determine membership, while the second tier will use a database. All users will have a tier-1 AD role, but not all users will have a tier-2 database role.
I know I can use the AspNetWindowsTokenRoleProvider to manage the AD roles, and I know I can use the SqlRoleProvider to manage the database roles… what I’d like to do is use both, simultaneously – is this possible?
I would recommend deriving from
WindowsTokenRoleProvider, then overridingGetAllRoles,GetRolesForUser, etc.Call the base class first, then append the appropriate list of roles from your database.
BTW, as the database key I’d recommend using the account SID (or a hash of it) instead of the
DOMAIN\usernamestring, since the username may change (marriage, etc.) and leave orphaned role entries. Happens more often than you expect 🙁