Custom Roles in ASP.NET
I am working on an ASP.NET website that uses forms authentication with a custom authentication mechanism (which sets e.Authenticated
to programmatically protected void Login_Authenticate(object sender, AuthenticateEventArgs e)
).
I have an ASP.NET sitemap. Some items should only be displayed to registered users. Others should only appear to one, unique user (that is, an administrator named by username, which will never change).
What I want to avoid:
- Install custom role provider: too much code to write for such a basic thing,
- Convert existing code, for example by removing the sitemap and replacing it with a code-behind solution.
What I want to do:
- A clean code handling solution that will allow me to assign roles in an authentication event.
Is it possible? How? If not, is there an easy workaround?
a source to share
As Matthew says, building a principal and setting it up at the right time is the easiest way to take advantage of all the built-in positional heroes like SiteMap.
But there is a much simpler standards-based implementation method than is shown on MSDN.
This is how I am implementing a simple role provider
Global.asax
using System;
using System.Collections.Specialized;
using System.Security.Principal;
using System.Threading;
using System.Web;
using System.Web.Security;
namespace SimpleRoles
{
public class Global : HttpApplication
{
private static readonly NameValueCollection Roles =
new NameValueCollection(StringComparer.InvariantCultureIgnoreCase)
{
{"administrator", "admins"},
// note, a user can be in more than one role
{"administrator", "codePoets"},
};
protected void Application_AuthenticateRequest(object sender, EventArgs e)
{
HttpCookie cookie = Request.Cookies[FormsAuthentication.FormsCookieName];
if (cookie != null)
{
FormsAuthenticationTicket ticket = FormsAuthentication.Decrypt(cookie.Value);
Context.User = Thread.CurrentPrincipal =
new GenericPrincipal(Context.User.Identity, Roles.GetValues(ticket.Name));
}
}
}
}
To manually check the user in the context of the codebehind page:
if (User.IsInRole("admins"))
{
// allow something
}
Elsewhere, just disconnect the user from the current context
if (HttpContext.Current.User.IsInRole("admins"))
{
// allow something
}
a source to share
I use this technique that Microsoft recommends:
http://msdn.microsoft.com/en-us/library/aa302399.aspx
In the global asax, I intercept the auth cookie and then set the thread principle and user of the HttpContext and roles for it. Once you can use HttpContext.Current.User.IsInRole ("foo") which is the same type of code you would use in the WinForm equivalent.
The more you can rely on inline templates, the more likely it is to be secure, and the sooner the maintenance developer will learn how to use the template.
a source to share