Security :: Relationship Between Roles And Functionality?
Oct 18, 2010
We have an ASP.NET web application that has been around for over 4 years now. The web app uses ASP.NET role management with a custom role provider. The custom role provider connects to a database which includes tables for Users, User Groups, and Roles, with a table linking roles to user groups.
Over the years the application has grown in functionality and roles have been added. We now have around 30 roles and there is a complaint that it's not clear (due to lack of documentation, bad naming or whatever) what functionality a particular role gives a user.
Is there guidance on how to make the relationship between roles and functionality more transparent? list out the application functionality in another table and create a relationship between Role and Functionality. The application security would then be programmed against the items in the Functionality table, and the relationships between role and functionality could be maintained through a UI.
To me this approach doesn't quite fit with the concepts behind ASP.NET role based security. All the framework code methods refer to roles, e.g. "RoleProvider.IsUserInRole(string username, string roleName)" and:
<authorization>
<allow roles="members" />
</authorization>
View 2 Replies
Similar Messages:
Jun 9, 2010
I have an ASP.NET project where I want to keep the membership (SQL Provider) in a separate database and the Roles/Profiles will be per application.QuestionWhat is the KEY that relates between the Membership database and the Roles/Profile database? Is it the UserID or UserName?I opened up the tables in separate expolrer and notice the UserID is different in the Membership database from that in the application Roles database.
View 2 Replies
Mar 7, 2011
I have a multi level application that I am developing and need to block multiple rows from being joined. I know how to hide one role but I cannot figure out how to hide multiple.
Here is my current code
[Code]....
View 2 Replies
May 17, 2010
Newb question: what is the standard practice for assigning roles to newly signed-on members. Is it usually manual or is there a way of automatically assigning roles. Being completely new to this, I am confronted by the issue of my site having three different roles that new members could fall into, but am unsure about how to assign each a role. I can't imagine having to go through the process manually if I have thousands of members.
View 6 Replies
Jun 26, 2010
I have my membership provider configured and working on my web host.
IŽd like to create a table, for example, table ARTICLES, and iŽd like that the user logged in, his ID or his NAME, was inserted into my ARTICLES database.Which one is the best table i could get for doing that ?
I was checking the table aspnet_users, but its Primary Key has a uniqueidentifer type.This wonŽt be a problem in the future ?Or is there a better way to relate my table with the membership provider ? Maybe another table OR another field.
View 1 Replies
Jul 25, 2010
i have a web application that is using a https webservice and for accessing this webservice i have installed the PFK file into the mmc console in the personal storage folder and also installed in IIS. After installing the PFK file the properties of the installed PFK file shows a warning that "Windows does not have enough information to verify this certificate" but the installation is done with success. After this i go to add the wsdl to my project as service reference, but it shows the error "Could not establish trust relationship for the SSL/TLS secure channel with authority". What is the solution for this?
View 17 Replies
Apr 24, 2010
[ASP.NET 3.5, FormsAuthentication, SQL Server]
In the Roles table there is Role, and RoleType.
I have 3different roles, 2 of which have sub-roles.
Example
Role----------------------Type
Adminstrator
Subscriber---Basic
Subscriber---Business
I need to implement Code Access Security, and URL based security using the roles & types...
For instance, the (Subscriber/Basic) would need to view a different set of pages, and have different access to things then a (Subscriber/Business).
I think I can handle the Code Access security with a custom attribute, but I am unsure to how enforce a User be apart of 2 roles in the URL Authorization.
I am currently using the web.config to deny/allow access to the directories/pages.
e.g.
/Areas/Admin/web.config
[Code]....
Is it possible to force the user to be apart of 2 roles with this technique?
View 1 Replies
Jun 7, 2010
I am using membership api in my project.I have customized all the controls.Now i want that user can login on only one machine from same username and password at the same time.If user is trying to login on any machine at that time if he is logged in from another machine.They should get message.They should not be able to log in using same username and password on same time on different machine.
View 2 Replies
Jan 7, 2010
I have used .net login control to authenticate user,i have three types of role ,role1,role2 and role3 and i have users and user have different roles.
now my requirement is like as per loggedin user i want to redirect user on particular page as per role.
for example if loggedin user role is role1 than he will redirect default1.aspx
for example if loggedin user role is role2 than he will redirect default2.aspx
for example if loggedin user role is role3 than he will redirect default3.aspx
and one question if same user may be have more than one role than what should happen???
I got a solution for same than if we are used "loggingin" event than it would be possible but i had placed login control in login view anonymous template because as per my requirement i want that after successfull login user can't see login control on page.thats why i didn't get the login control event on code.
View 6 Replies
Mar 22, 2010
In our system now, we have a class of user and beneath each class, there's a type of user.
Is there a way to setup and use the ASP.Net role provider with this kind of setup?
View 2 Replies
Feb 20, 2010
i am new to asp.net, i am creating a small website for my college, in that.
Only the admin's can create other users...
Now while using the nw registration wizard, i hav to mention the role also in that page.
View 5 Replies
Jun 10, 2010
can any one tell how to create the roles in asp.net? when ever Admin creates the roles, there it self he should assing the pages,which pages should be open when ever perticular person enters in to the site. When ever Admin wants to assing the Roles,all pages appear in grid view with check box,if he checks that pages,he able to access other wise he couldnot access that page.
View 1 Replies
Aug 3, 2010
i want to create a webservice that reading from the user identity interacts with a db, where there are app names and group that can use that app, and gives to the user a list of operation that he can use.
My question is, is there any table in apsnetdb that does this association or i should create a costum table.
View 1 Replies
Mar 1, 2010
Pls explain the Membership Roles in MVC ASP.NET 3.5
View 1 Replies
Feb 27, 2011
I know how use Roles in Controller:
[Code]....
In this situation, any one who is not "admin" can'nt vist the "About.cshtml". But what if I want anonymous can see part of the "About.cshtml"?
[Code]....
I know code above is wrong, But how can implement my goal in Views
View 2 Replies
Dec 11, 2010
I want to get my user list provided by ASP.net membership provider with the GetAllUsers method.
This method has the paging support but I did not see any sorting support. Which means that this will sort the rows with default columns. But I want to customize it and sort the rows by my define column.
In addition, as I have already mentioned that I will implement paging and sorting both features so I want to implement the sorting feature at database end so that only filtered rows are fetched by application.
View 1 Replies
May 18, 2010
I have created 3 different folders (admin, user, viewer) in my site and each has a different template (masterPage). I created user and roles which are admins, users, and viewers. I assigned each role to a user in .Net administration Tool.
What I need to do is to allow each user to access his page only and deny access to others , except for the admin who can access all pages.
View 4 Replies
Oct 5, 2010
I'm trying to redirect users upon login based on their roles which were defined in the Administer website feature of asp.net.Heres what I'm trying protected void Login1_LoggedIn(object sender, EventArgs e)
View 2 Replies
Oct 7, 2010
Im trying to redirect different roles to different pages. Its working but the code I'm entering allows people through even with incorrect passwords. protected void Login1_Authenticate(object sender, AuthenticateEventArgs e)
View 1 Replies
Jan 11, 2010
Im now in assigning a roles to a user. But, 1 of my user wants me to assign 2 roles for him.. The situasion is like this :
I have a few roles which are :
- zone head
-zone officer
-clerk
The problem is now 1 person can be assign for 1 role only..
How can i assign 2 roles for 1 user..
View 4 Replies
Jul 2, 2010
I'm workin with Visual studio 2010 and I'm trying to create an ASP.net Web Site, language used - C#
I have 2 different pages, for 2 different users with 2 different roles.Each page has a textbox.I have already created them.What I want to do, is to make a bind between this 2 textboxes, so that the second to get the first boxes' text.I managed to do it, but only if the textboxes are on the same page, very easy (Textbox2.Text=TextBox1.Text) . But how to do it for 2 different pages, for 2 different users with 2 different roles?
Another trouble would be....How can I connect the both users same time....after i start debugging the project, I do a sign in but when I sign in with the second user,the first is automaticly siggned out and the text it's lost.Then, how can they synchronize and the second user see what the first one wrote,using that 2 textboxes? Wich is the solution?
View 4 Replies
Mar 10, 2010
I am currently having a spot of bother in something im trying to create. I want it so when a user who is in a certain role logs in they are directed to a certain page, and any other normal users are directed to another page.
I think i have this sorted via code but...
-The first time it will work, the 'admin' user will get directed to the appropriate page
-I then log out and log in as a normal user and get directed to the appropriate page
-then when i log out of that users account and back into the admin one i get directed to the normal users page instead.
-additional to this, I tried it on a different machine logging in as the admin user only to be redirected to the normal users page (is my session being stored somewhere?)
Ive traced through the problem and the user name and password being subbmitted are what they should be, yet it skips the true part of my IF statement for being in that role.
Here is my code I am using on the login form:
[Code]....
-When stepping through if seen it work and not work with the same values, I cant understand the logic of its inconsistency
the code i am using for the logout is (this is on my masterpage):
[Code]....
View 4 Replies
Jan 10, 2011
I have three roles:
AdminEditorGeneral
How can i give acces so to:
1- All users in roles Admin and Editor
2- Specific users from role General
i tried this but with no luck:
[Code]....
View 2 Replies
Aug 24, 2010
I have setup ASP security in my application. I used the following tutorial, just wondering if someone can tell me how i can setup this up to allow the creation of a user?
http://weblogs.asp.net/scottgu/pages/Recipe_3A00_-Implementing-Role_2D00_Based-Security-with-ASP.NET-2.0-using-Windows-Authentication-and-SQL-Server.aspx
where to find or what to search on to find some example of how to add the option for adding users?
I have the above setup and its working, but only because of the accounts i created with my global.asax file.
I need to give the admins access to add a new user. Currently i can search on existing users and update them, but need to add the ability to add a new user.
View 4 Replies
Nov 3, 2010
well i have a simple application using an authentication (user and password) before accessing and there are several roles bound to each user.
in my web.config i have configured the acces for each page according to each role, this is an example below:
[Code]....
and i have 2 users:
1: admin (default role: administrator)
2: guest (default role: role1)
my problem is as follows:
if i give acces to the user "guest" to open the "admin.aspx" page with changin him his role from "role1" to "administrator", this one do not function except if i recharge the web.config file to the server it's just after this manipulation that this user "guest" arrives to open the page "admin.aspx".
i don't know why this problem occurs, normally changing the user role will applies instantaneously.
View 6 Replies
