Microsoft KB Archive/311495

= How To Implement Role-Based Security with Forms-Based Authentication in Your ASP.NET Application by Using Visual C# .NET =

Article ID: 311495

Article Last Modified on 4/19/2007

-

APPLIES TO


 * Microsoft ASP.NET 1.0
 * Microsoft Visual C# .NET 2002 Standard Edition
 * Microsoft ASP.NET 1.1
 * Microsoft Visual C# .NET 2003 Standard Edition

-



This article was previously published under Q311495



For a Microsoft Visual Basic .NET version of this article, see 306238.

This article refers to the following Microsoft .NET Framework Class Library namespaces:
 * System.Web.Security
 * System.Security.Principal

IN THIS TASK

 * SUMMARY
 * Requirements
 * Assign the Roles to the Authenticating User
 * Check the User Roles and Implement the Program Logic in Your ASPX Pages
 * REFERENCES



SUMMARY
This article describes how to implement role-based security in an ASP.NET application that implements forms-based authentication using Visual C# .NET

Back to the top

Requirements
This article assumes that you have already implemented forms-based authentication on an ASP.NET application.

301240 How To Implement Forms-Based Authentication in Your ASP.NET Application Using C# .NET

Back to the top

Assign the Roles to the Authenticating User
Because forms users usually are not Microsoft Windows users, they do not have any roles associated with them by default. Thus, you must attach the roles of the authenticating user to that user's identity so that you can implement the role-based security inside your code.

Use the sample code in this section to implement role-based security in your application. This sample code assigns pre-specified roles to the authenticating user. Depending how you store your user data, you can implement your own method to retrieve the roles for that authenticated user and attach those roles to the authenticating user's identity, which is illustrated in the sample code to follow.

Copy the following code in the Global.asax file in your existing application to assign the roles to the authenticating user in the Application_AuthenticateRequest event handler: public void Application_AuthenticateRequest( Object src, EventArgs e ) {  if (!(HttpContext.Current.User == null)) {     if (HttpContext.Current.User.Identity.AuthenticationType == &quot;Forms&quot; ) {     System.Web.Security.FormsIdentity id; id = (System.Web.Security.FormsIdentity)HttpContext.Current.User.Identity; String[] myRoles = new String[2]; myRoles[0] = &quot;Manager&quot;; myRoles[1] = &quot;Admin&quot;; HttpContext.Current.User = new System.Security.Principal.GenericPrincipal(id,myRoles); }  } } Back to the top

Check the User Roles and Implement the Program Logic in Your .ASPX Pages
The following steps demonstrate how to implement and control the program logic based on the roles to which the authenticating user belongs.   Create a .aspx new page named Sample.aspx, and paste the following code: <%@ Page Language=&quot;C#&quot; %> <%@ Import Namespace=&quot;System.Web&quot; %>

public void Page_Load { if (User.IsInRole(&quot;Admin&quot;)){ Response.Write (&quot;You are an Administrator&quot;);} else { Response.Write (&quot;You do not have any role assigned&quot;);} }

 Save Sample.aspx in your existing application. Browse to the page to test it.

Back to the top

