A Little background….
Page object provides User [System.Security.Principal.IPrincipal] in order to access to the information about the current authenticated user. User is having following two important members. These members provide way to implement Role-based authorization programmatically.
Identity [Property] [System.Security.Principal.IPrincipal.Identity] – This property provides important members like AuthenticationType, IsAuthenticated, Name.
IsInRole[Method] [System.Security.Principal.IPrincipal] – This method takes single parameter that is string value of Role for which to check the membership.
<authentication mode="Forms">
<forms loginUrl="~/Login/Login.aspx?Session=Expired" protection="None" timeout="20" name=".ASPXAUTH" path="/"/>
</authentication>
On Login click event do the following:
protected void btnLogin_Click(object sender, EventArgs e)
{
/*Here put your code to fetch the userinformation which includes user name, role, password,etc. from Database*/
...
/*Now, create the Forms Authentication ticket with the application’s custom user role & user name,.*/
FormsAuthenticationTicket Authticket = new FormsAuthenticationTicket(1,
userName, DateTime.Now, DateTime.Now.AddMinutes(HttpContext.Current.Session.Timeout),
false, userrole.ToString(), FormsAuthentication.FormsCookiePath);
/*You may want to encrypt the ticket information before putting into the coockie.*/
string hash = FormsAuthentication.Encrypt(Authticket);
HttpCookie Authcookie = new HttpCookie (FormsAuthentication.FormsCookieName, hash);
/*Here you can set some coockie sessings like persistence, httponly..*/
if (Authticket.IsPersistent)
Authcookie.Expires = Authticket.Expiration;
/*Now, add the cookie to the Reponse object of Current HttpContext.*/
HttpContext.Current.Response.Cookies.Add(Authcookie);
/*Put the userrole into session*/
HttpContext.Current.Session[USER_ROLE] = UserRole.Operator;
/*Now you can redirect the user to the requested page*/
HttpContext.Current.Response.Redirect(“~/Operator/Home.aspx”, false);
}
Now, you can check the custom application user role on any page before authorizing the resource as follows:
Public static void CheckAuthorizedUserRole()
{
if (!HttpContext.Current.User.IsInRole(“Operator”))
{
FormsAuthentication.SignOut();
/*Or else, you can redirect the user to the desired page.[Probably, Access Denied!]*/
/*Or else, you can redirect the user to the desired page.[Probably, Access Denied!]*/
}
}
Here system will check for the specific user role, if not found forms authentication will forces the user to signout.
This way you can have the custom implementation of role based authorization.