Redirect User

[Jcarr38]

Okay i've got this code in the web.config below.

<location path="testpage.aspx">
	<system.web>
		<authorization>
			<allow users="user2, user1"/>
			<deny users="*"/>
		</authorization>
	</system.web>
</location>

My issue is for this testpage.aspx if the user isnt either user 1 or user 2, then i'd like to redirect them to another page BUT i already have this code below for a redirect to the login page but i don't want them to refer back to the login page for this specific testpage.aspx

<authentication mode="Forms">
	<forms loginUrl="login.aspx"/>
</authentication>

Rather than setting up a role, could i just create an If statement on the testpage.aspx and if so would it be something like this.. I would appreciate any help.

If request.LogonUserIdentity.....
     Response.Redirect("/")
End If

 

[jmeckley]

this won't work because authorization is validated before the page is rendered.

have you confirmed this is the result, or you think this will be the result? I ask because users are redirected to the login when they are not logged in. I wasn't aware this would happen if they are logged in but do not have access.

have you tried setting up the CustomErrors to catch an authentication error and redirect to an "Invalid Access" page?

Jason Meckley
Programmer
Specialty Bakers, Inc.

 

[Jcarr38]

No i havent tried that but i know i could do something like this but it's not probably a good way of doing it. Eliminate the web.config code for the page and just put this in the actual page. What do you think?

If Not Request.LogonUserIdentity.Name = "user1" Or Not Request.LogonUserIdentity.Name = "user2" Then
            Response.Redirect("/")
End If

 

[Jcarr38]

I meant this...

If Not User.Identity.Name= "user1" Or Not User.Identity.Name= "user2" Then
            Response.Redirect("/")
End If

 

[jmeckley]

I wouldn't opt for this because now you have security settings scattered throughout the application. I would either opt for the web.config authorization. or roll your own authorization model which is referenced in a base Page class.

why would the user have a link displayed to this page if s/he is not authorized to see it? if you want to use the redirect because they manually type the url, or bookmark the page then an "Unauthorized Access" message/log is appropiate.

Jason Meckley
Programmer
Specialty Bakers, Inc.

 

[Jcarr38]

Ok thanks