I have developed an ASP.NET MVC 2 application on Framework 4. I have an 'Administration' link on the home page. My query is, what is the best approach of displaying the 'Administration' link only to the users in the role administrator and hiding it from others keeping in mind the Seperation of Concern bit.
View 2 Replies
I have a Grid View. I added AutoGenerateEditButton=True.
I want to display that button to users that belong to a certain role. If not the button is not rendered.
What do you recommend? Which event do I have to handle to accomplish that purpose?
Do I have to work with template-driven control such as ListView?
Solution:
[Code]....
I want to execute some logic if the Logged in User can view a page "~/MyPage.aspx". IF the logged in user should be elligible to view the page is determined by the role based security I configured in the web.config file. There are many methods to find out if the user is in role XXX or not. But I did not find any method to find out if the user can view a page or not ahead of transferring the user to that page. Maybe I will hide a link to a specific page to the logged in user if the user is not elligible to view that page if I know the technique i am asking here to know.
View 1 RepliesIn any strongly-typed View, I can test for a value within the Model and display content within the View, or not, as I choose. I'm having fits trying to get this same thing to work within the Master View. Since the Master View doesn't have its own Controller, but rather uses the Controller of whatever View is being rendered at the time, it's not like I can assign an object for the Master View to inherit from as I can with a normal View. Or at least I don't know how. I've also tried setting ViewData within a base Controller class, but that hasn't worked out, and is the subject of another thread.
When any View loads, I want to be able to run a check for the current user's security group (not ASP.NET roles, but a special object for the current project). Based on their security group I'll either show certain menu items or not, and direct them to a default View for their group. I suppose that in the default Controller that rolls when the project starts, I can do a check and redirect to an action based on the security group, but that still doesn't tell me how to render out menu items based on
I'm building an ASP.NET MVC 2 site where I'm using the OutputCache parameter heavily. However, I have a concern: using such caching may interfere with authentication.On all of my pages, I display whether the user is logged in or not. Furthermore, in some of my Views, I do filtering based on user role to determine whether or not to display some page content (for example, the Edit link on one of my pages is only shown to users in the roles of Moderator or Administrator)
View 2 RepliesI have a simple intranet site. It has a role based authorization in the web.config file.
Any user's in a specific role called as "Apr-Sales-Writers" will be authorized to use those pages. If not, they will not be authorized. So far so good. Works fine. But we added additional functionality where a new active directory group (means new role) has to be added and user's belonging to this new AD group should be given access to only specific .aspx pages on the intranet site. I am using a web.sitemap and it looks like this.
If the user's belong to say AD group "Apr-Sales-Writers", they should access only default.aspx and salesData.aspx pages. User's belonging to new AD group (which I did not include in the web.config file below), should have access to other .aspx pages.
[CODE]<?xml version="1.0" encoding="utf-8" ?>
<siteMap xmlns="http://schemas.microsoft.com/AspNet/SiteMap-File-1.0" >
<siteMapNode url="default.aspx" title="Home" description="Home">
<siteMapNode title="sales Data" description="sales Data">
<siteMapNode url="salesData.aspx" title="sales Data" description="sales Data" />
[Code] ....
Our team has recently implemented a role permission based authorization so that we can have granular control. This is similar to what Rockford Lhotka suggests herehttp://www.lhotka.net/weblog/PermissionbasedAuthorizationVsRolebasedAuthorization.aspx I have also read about the Claims based authorization which to me looks very similar to what we have. Can some one put in simple terms what the advantages of claims based authorization are.
View 1 RepliesHow could users in a "customer" role be retrieved from a MembershipUserCollection?
View 3 RepliesHow to implement role based security in each page.
View 2 RepliesI want to know how can I display role-specific markup using loginview?
I have these three roles, Admin, Editor, Moderator
Each and every user will belog to only one of the following role groups
1. Admin, Editor, Moderator (Some user/s will have all these three roles)
2. Admin, Editor (Some user/s will have all these two roles)
3. Admin, Moderator (Some user/s will have all these two roles)
4. Editor, Moderator (Some user/s will have all these two roles)
5. Admin (Some user/s will have all only this role)
6. Editor (Some user/s will have all only this role)
7. Moderator (Some user/s will have all only this role)
Now I want to display some links that will be specific for each role group to which one or more users will belong. So the links I want to display for these role groups are following
1. Admin, Editor, Moderator => Only Links of all the pages of Admin, Editor and Moderator
2. Admin, Editor => Only Links of all the pages of Admin and Editor
3. Admin, Moderator => Only Links of all the pages of Admin and Moderator
4. Editor, Moderator => Only Links of all the pages of Editor and Moderator
5. Admin => Only Links of all the pages of Admin
6. Editor => Only Links of all the pages of Editor
7. Moderator => Only Links of all the pages of Moderator
I have tried doing this using RoleGroups in Loginview but couldn't succed.
Can anybody let me know the correct way of going this?
1) I'm currently working for HR application with security roles
2) for that I created dynamic menu and set data source to sitemapprovider control with "AspNetSqlSiteMapProvider"
Now my client requirement is to change menu's based on drop down selection so that menus will be minimum and quite user friendly.for that I did following steps:-
Created Drop Down contains list of all Roles provided him in Master Page In Menu1_MenuItemDataBound event I grabbed the roles for that node and compared with role selected in drop down and deleted that node now what i need is on drop down_selected index change I want to recreate menu.
I have seen articles on Role Based Authorization in MS-Sql server-Asp.net but i did not find any article in MySql-ASP.net/vb.net, i am acheived this concept using session user name i am enabling certain parts of website to group A and certain parts of site to Group B but when i have more groups i cannot use this method.
Myrequirement is:
In Web applications, typically there exist certain parts of the site that only certain folks, or groups of persons can access. For example, imagine Web site used to administer the content on a company's public Internet Web site, where the public Web site lists products sold by the company. From the administrative site, all company employees might be able to make minor changes to the products' descriptions, quantity, and other such non-essential information. However, perhaps only a subset of trusted employees might be able to change the products' prices. And even a smaller subset of employees would be able to add new products or delete existing products from the database I would be delighted if any one provide the solution
i want to redirect the user after the log in based on his role. e.g. admin, userI already read the other threads.. I already used this:
[Code]....
And this:
[Code]....
I also tried the above codes on the Page_Load event.
How can I implement role based security that would show the admin tab if the user was logged in as a admin by using (ul-li) like the below code as a simple example. I do not want to use the menu control is this possible ?
<ul>
<li><a href="#">Services</a></li>
<li><a href="#">About us</a></li>
<li><a href="#">Admin</a></li>
</ul>
I am building an ASP.NET 3.5 Web Application and I am NOT using the membership provider for security. In the application I have a role named Admin and all the files for this role are inside the Security folder in the project. Currently for all the pages inside the security folder I am checking to see if the logged in user's role is an Admin or not. This to me seems very redundant, can do something like "If the user is requesting a page inside the security folder then check his role".
View 1 RepliesI have a page, program.aspx. Users with different roles have a different URL.
e.g., [URL] [URL]
I also used URL rewrite to rewrite the URLs, so users will see the following URLs from the browser
[Code]....
I defined the following access rules for the above pages.
[Code]....
The problem is when the admin users access the pages, they still have access to supervisorprogram.aspx. Vice versa for the supervisor users.
How to access datas based on user roles in asp.net ? For example : i have two admins (admin1, admin2). In the frontend ,admin1 has full access to datas(view,add,edit,delete all datas) while admin2 has limited access to datas(view,add,edit,delete certain datas alone and not all datas)
View 2 RepliesI want to know how can i redirect a user to a different page when he tries to access a page restricted to another role?
The scenario is as follows:
I have a folder "Gestao" that only allows users in role "Administrator"
[Code]....
If an anonymous user tries to access that folder he is redirected to the login page, but if a logged in user whose role is "friend" tries to access this folder he is also redirected to the login page. I want to redirect him to a page showing a message that he has no permission to access that page/area.
How can I do that? Should i have code on the Page_load event of the login page checking the user role and then redirect him to the correct page? Or is there some otherway to do this?
is possible or do you have to use a forms based auth when using a role manager?
View 1 Repliesi need to create a hyperlink dynamically. In our project till now we are calling the hyperlink in every page but now we need that controls must be displayed on the roles b'coz we are all the pages in one role and only few controls in some other roles
View 2 RepliesHow do I create a menu in a ASP.NET MVC2 Master Page, dynamically based on the current user's "role"?
View 3 RepliesI have a website created in ASP.Net 3.5(C#) and I have configued asp.net defalut membership provider for it.There are 5 different type of roles in this site. Now I want to display a small role based (i.e. depending upon the logged in user's role) menu whenever a user log-in to the site.For this I have added the code in the OnPageLoad() event of the master page, here is the code -
[Code]....
Now I wanted to know Is this code is logcally correct? And what is the security level of this code?
I am having a very simple intranet site. I took the sample for my project from [URL] ....
I have integrated windows authentication with Role based authorization. There are only 3 .aspx pages and I have a tree view control on the master page. depending on the choices that the user's make on the tree view control the .aspx pages gets displayed.
There are only 2 active directory groups. Sales and Marketing. My network id is not in Sales AD group.So obviously it prompts me to put userid and password and it throws not authorized error when i try to access PortfolioData.aspx page. So far so good.
But I am a member of AD group MARKETING. I should be able open the page Schedules.aspx (please see the config file below). But I still get the Error message 401.2.: Unauthorized: Logon failed due to server configuration.
Code:
<!--
<authorization>
<allow roles="domainADGROUP_SALES"/>
<deny users="*"/>
</authorization>
[Code] .....
I have an asp.net application. This is a role based authorization. Basically, if the user's are in a specific AD group, it should allow them to look at the webpage. Otherwise it should error out saying "not authorized".
In the web.config file, I have the following lines of code. I made sure I am in the Apr-Sales-Writers AD group.
Code:
<authorization>
<allow roles="Apr-Sales-Writers"/>
<deny users="*"/>
</authorization>
Issue: when I go to default.aspx page, it prompts for a userid and password and even though I put correct password and userid, it says "not authorized error".
Code:
Access is denied.
Description: An error occurred while accessing the resources required to serve this request. The server may not be configured for access to the requested URL.
Error message 401.2.: Unauthorized: Logon failed due to server configuration. Verify that you have permission to view this directory or page based on the credentials you supplied and the authentication methods enabled on the Web server. Contact the Web server's administrator for additional assistance.
In the IIS project (on IIS server), I configured it to be a "Integrated windows authentication".
I have several pages or views in my application which are essentially the same for both authenticated users and anonymous users. I'd like to limit the insert/update/delete actions in formviews and gridviews to authenticated users only, and allow read access for both authed and anon users.
I'm using the asp.net configuration system for handling authentication and roles. This system limits access based on path so I've been creating duplicate pages for authed and anon paths.The solution that comes to mind immediately is to check roles in the appropriate event handlers, limiting what possible actions are displayed (insert/update/delete buttons) and also limiting what actions are performed (for users that may know how to perform an action in the absence of a button.) However, this solution doesn't eliminate duplication - I'd be duplicating security code on a series of pages rather than duplicating pages and limiting access based on path; the latter would be significantly less complicated.I could always build some controls that offered role-based configuration, but I don't think I have time for that kind of commitment right now.Is there a relatively easy way to do this (do such controls exist?) or should I just stick to path-based access and duplicate pages?
Does it even make sense to use two methods of authorization? There are still some pages which are strictly for either role so I'll be making use of path-based authorization anyway.Finally, would using something other than path-based authorization be contrary to typical asp.net design practices, at least in the context of using the asp.net configuration system?
