forms based authentication feasable?

[matthias s.]

Hi there,

I'm creating a web app which consists of pages, that can seen by all (even
anonymous) users. For example, we have a messageboard. The individual
threads can be read by all users, but a new thread can only be added by a
registered member. Is forms based authentication feasable here? How would I
set it up? Put all the pages implementing "restricted" functionality into a
certain directory and set this up in the web.config?

Would I have access to User.IsAuthenticated even in the root directory of
the webapp (the one, where even anonymous users have access to)? I'd need it
in order to display the members menu.

Thanks in advance!

/matthias

[Brock Allen]

Yes, Forms would work great for this. You would need to configure the <authorization>
in web.config to indicate which pages are not allowed to those anonymous
users. The nice thing about the web.config model is that it's declarative
and you don't need to explicitly check in code for each page, unless you
have some finer grained access check that's necessary (like hide/show sections
of a page based upon who the user is).

As far code the "restricted" code organization, a sub directory can work,
or you can put them all in one directory and use the <location> elemenet
to control settings for individual pages.

-Brock
DevelopMentor
http://staff.develop.com/ballen

Hi there,

I'm creating a web app which consists of pages, that can seen by all
(even anonymous) users. For example, we have a messageboard. The
individual threads can be read by all users, but a new thread can only
be added by a registered member. Is forms based authentication
feasable here? How would I set it up? Put all the pages implementing
"restricted" functionality into a certain directory and set this up in
the web.config?

Would I have access to User.IsAuthenticated even in the root directory
of the webapp (the one, where even anonymous users have access to)?
I'd need it in order to display the members menu.

Thanks in advance!

/matthias

[Patrik Löwendahl [C# MVP]]

What Brock suggests is the first part of a nice solution, but you should
also explore what he calls "finer grained access" or roll based security
in your application.

While Web.Config is perfect to make sure that anonymous users don't
access pages, roll based is a good complement to make communicate to the
user what he/she is allowed to do.

You could as an example hide the post or reply buttons for non
authenticated users.

--
Patrik Löwendahl [C# MVP]
http://www.lowendahl.net/ || http://www.cshrp.net
Please reply only to the newsgroup.

Brock Allen wrote:

Yes, Forms would work great for this. You would need to configure the
<authorization> in web.config to indicate which pages are not allowed to
those anonymous users. The nice thing about the web.config model is that
it's declarative and you don't need to explicitly check in code for each
page, unless you have some finer grained access check that's necessary
(like hide/show sections of a page based upon who the user is).

As far code the "restricted" code organization, a sub directory can
work, or you can put them all in one directory and use the <location>
elemenet to control settings for individual pages.

-Brock
DevelopMentor
http://staff.develop.com/ballen

Hi there,

I'm creating a web app which consists of pages, that can seen by all
(even anonymous) users. For example, we have a messageboard. The
individual threads can be read by all users, but a new thread can only
be added by a registered member. Is forms based authentication
feasable here? How would I set it up? Put all the pages implementing
"restricted" functionality into a certain directory and set this up in
the web.config?

Would I have access to User.IsAuthenticated even in the root directory
of the webapp (the one, where even anonymous users have access to)?
I'd need it in order to display the members menu.

Thanks in advance!

/matthias

[matthias s.]

Hi Brook,

thanks a heap for your help!

/matthias

"Brock Allen" <ba****@NOSPAMdevelop.com> schrieb im Newsbeitrag
news:92**********************@msnews.microsoft.com ...

Yes, Forms would work great for this. You would need to configure the <authorization> in web.config to indicate which pages are not allowed to those anonymous
users. The nice thing about the web.config model is that it's declarative
and you don't need to explicitly check in code for each page, unless you
have some finer grained access check that's necessary (like hide/show sections of a page based upon who the user is).

As far code the "restricted" code organization, a sub directory can work,
or you can put them all in one directory and use the <location> elemenet
to control settings for individual pages.

-Brock
DevelopMentor
http://staff.develop.com/ballen

Hi there,

I'm creating a web app which consists of pages, that can seen by all
(even anonymous) users. For example, we have a messageboard. The
individual threads can be read by all users, but a new thread can only
be added by a registered member. Is forms based authentication
feasable here? How would I set it up? Put all the pages implementing
"restricted" functionality into a certain directory and set this up in
the web.config?

Would I have access to User.IsAuthenticated even in the root directory
of the webapp (the one, where even anonymous users have access to)?
I'd need it in order to display the members menu.

Thanks in advance!

/matthias

[Tom.PesterDELETETHISSS]

This tutorial should get you started :

http://samples.gotdotnet.com/quickst...orization.aspx

Some more good links :

http://www.google.com/search?hl=en&q...torial&spell=1

Let me know if you have any more questions..

Cheers,
Tom Pester

Hi there,

I'm creating a web app which consists of pages, that can seen by all
(even anonymous) users. For example, we have a messageboard. The
individual threads can be read by all users, but a new thread can only
be added by a registered member. Is forms based authentication
feasable here? How would I set it up? Put all the pages implementing
"restricted" functionality into a certain directory and set this up in
the web.config?

Would I have access to User.IsAuthenticated even in the root directory
of the webapp (the one, where even anonymous users have access to)?
I'd need it in order to display the members menu.

Thanks in advance!

/matthias