windowsauthentication asp .net 2.0

[newbieAl]

I have the following in place. Is this sufficient code for windows authentication and AD roles? Is the code in the right event (page_load) or should it be somewhere else?

Right now I get the statement on the top of the screen, you do not have access, and the default page loads. I'm not in the 'aRole'.

Also, can this type of code be tested on the local machine or does it have to be uploaded on a dev or production server?

authentication mode="Windows"
authorization
deny users="?" /> <!--Deny anonymous users -->
allow roles="domain\roleA,domain\roleB"
authorization

identity impersonate="true"

(page_load event)
If User.IsInRole("aRole") Then
Response.Redirect("~\default.aspx")
Else
Response.Write("you do not have access")

End If

 

[jmeckley]

you shouldn't need any code in the aspx to authenticate, if your using the web.config.
use the <location> tag to authorize different files/directories of your application.

Jason Meckley
Programmer
Specialty Bakers, Inc.

 

[newbieAl]

so just add as follows?

<location path="~\default.aspx>

<location path="~\APage.aspx>

 

[ca8msm]

Why not try it and see what happens?


-------------------------------------------------------

Mark,
[URL unfurl="true"]http://aspnetlibrary.com[/url]
[URL unfurl="true"]http://mdssolutions.co.uk[/url] - Delivering professional ASP.NET solutions
[URL unfurl="true"]http://weblogs.asp.net/marksmith[/url]

 

[newbieAl]

what I am asking is, if I need more than one location do I do this like shown above?

 

[jmeckley]

within each location tag you need to set the appropiate settings. search MSDN and google for more information on web.config location tags

Jason Meckley
Programmer
Specialty Bakers, Inc.

 

[hughejars]

have you tried,

If User.Identity.IsAuthenticated = False Then Server.Transfer ("notauthorised.aspx")

for users who are not authorised, authorised users will stay on the page.

and

If Roles.IsUserInRole("DeclaredRole") = False Then Server.Transfer ("notauthorised.aspx")

for users who have to be part of a certain role

Regards
Phil

Working towards my MCSE/A and CompTIA. Any help greatly appreciated.

 

[newbieAl]

thanks, Phil, that's good info. However, what is the difference between using server.transfer and response.redirect? Is one better than the other?

 

[jmeckley]

what is the difference between using server.transfer and response.redirect? Is one better than the other?

that's what google/MSDN/<F1> are for.

while Phil's method would work, it requires code on every page. this is duplicated functionality and leads to problems if users/roles change.

Jason Meckley
Programmer
Specialty Bakers, Inc.

 

[ca8msm]

However, what is the difference between using server.transfer and response.redirect? Is one better than the other?

It would be quite easy to find out...[google]Server.Transfer[/google]


-------------------------------------------------------

Mark,
[URL unfurl="true"]http://aspnetlibrary.com[/url]
[URL unfurl="true"]http://mdssolutions.co.uk[/url] - Delivering professional ASP.NET solutions
[URL unfurl="true"]http://weblogs.asp.net/marksmith[/url]

 

[hughejars]

theres a good explaination here, which shows the advantages and disadvantages of using both.

http://www.developer.com/net/asp/article.php/3299641

Regards
Phil


Working towards my MCSE/A and CompTIA. Any help greatly appreciated.