Forms Authentication: page access based on user's category

Question

I have two pages: Members.aspx and Admins.aspx. I want to make unlogged users to see none of them, any logged user to see the first one and only certain users to see both.

User's category ("member" or "admin") is detected at login time from the code and is put in a session variable.

I can easily grant access to any logged user to some page using Forms Authentication (basically as described here), but how should I design my web.config in order to take in account not the username but his category?

Note that users could anytime change their category so i can't hard-code their names, and I need this to be db-independent so I shall stick to Forms Authentication login mode.

Answer 1

You really should look into

Asp.net roles management

And

Filtering Site-Map Nodes Based on Security Roles

It would be smarter than trying to build your own security mechanism based upon Session values.

Answer 2

My suggestion is to use Role-based authentication. A user can have one or more roles. .NET has classes to help you manage users along with their roles.

This is one good tutorial: http://www.4guysfromrolla.com/articles/082703-1.aspx

Good luck.

Answer 3

You can place your pages in folders grouped by roles, and create a Web.config for each folder:

For your Admin zone you can use:

<configuration>
   <system.web>
      <authorization>
         <allow roles="admin"/>
         <deny users="*"/>
      </authorization>
   </system.web>
</configuration>

And for your Member zone you can use:

<configuration>
   <system.web>
      <authorization>
         <allow roles="admin"/>
         <allow roles="member"/>
         <deny users="*"/>
      </authorization>
   </system.web>
</configuration>