Role Based Security

[Stunner01225]

I have just spent two days setting up role based security in for my site and it works, but I have a small problem.
In my system I have four levels of user and I am handling the permissions through the web.config file. When a user logs in and then tries to load a page they don't have the right permission level it bumps them back to the login page. I need to find some way so if a read-only member loads an admin screen the login page they get pushed back to says something like admin only. Anybody have any ideas?

 

[NoCoolHandle]

Yes, you need to set the role that the member is in, but the trick seems to be preserving the role membership data...

I found a very good video on how to set up Role based security on the MS site (in webseminars)

You can find it...

http://www.aspnetwebcasts.com/default.aspx

check out
In Level3 Custom Authentication and Authorization in ASP.NET

 

[Stunner01225]

Thank you for your post, but unfortunately I cannot access that resource from work (don’t ask bleeding techs). I have set up all the role-based security and it all works my problem is this.
I have three pages A B C and we will say two users X Y. X can see ABC and Y can see AB and everyone can see A. When Y tries to view B they have to enter a password once passed they then get to see B. If Y tries to view C then they get taken to the login page once passed the .net security then decides that they cannot see C so it takes them back to the login page.
I know this will confuse my users because they got their login right but they have the wrong permissions and they won’t understand.
I am going to try and set something in the session, but if anyone else has had this problem and knows a nice solution then please tell me.

Cheers

 

[Stunner01225]

How I solved it.
After a successful login I set session variable. The time out of my security and session is the same. In the session variable is a string saying “To view the page you must have a permission level above” and then the users level.
When my login page is loaded I set a labels text to the contents of the session variable. Usually it is empty but if not the message is displayed.