C# - WEB - Can't figure out authorization via web.config

[garymcintyre]

Here's my situation:

I'm using forms authentication with a SQL DB (more or less that aspnetdb created by the config tool, but mine is NOT in the App_Data directory, just on a SQL server).

I've gotten as far as getting a user logged in (authenticated) so that they are looking at the dashboard.aspx. On this page, there are two buttons, one for the members page, one for the administrators page. The admin page is in an 'admin' folder, which is set up in my web.config as follows:

<authorization>
<allow roles="Administrators"/>
<deny users="*"/>
</authorization>

My understanding is that if the current user is in the Administrators role, they should be able to view this page, otherwise they would be denied, taken back to the login page, whatever. Problem is this: no matter what I try, I cannot get to that administrators page; it just keep taking me back to the login.aspx.

I can step thru the code and see the Cookie on the Response.Redirect and it appears to be what I need, but it won't let me in. Any thoughts on what I'm missing?

According to every site I read, this is really easy. I beg to differ; I'm a newbie, for sure, but this is far from what I would call "easy". I'm sure it's something stupid I'm doing or something I've missed, but I've spent several hours on this and have gotten no where. Any help or ideas would be greatly appreciated.

Thanks.

[KBTibbs]

Here's my situation:

I'm using forms authentication with a SQL DB (more or less that aspnetdb created by the config tool, but mine is NOT in the App_Data directory, just on a SQL server).

I've gotten as far as getting a user logged in (authenticated) so that they are looking at the dashboard.aspx. On this page, there are two buttons, one for the members page, one for the administrators page. The admin page is in an 'admin' folder, which is set up in my web.config as follows:

<authorization>
<allow roles="Administrators"/>
<deny users="*"/>
</authorization>

My understanding is that if the current user is in the Administrators role, they should be able to view this page, otherwise they would be denied, taken back to the login page, whatever. Problem is this: no matter what I try, I cannot get to that administrators page; it just keep taking me back to the login.aspx.

I can step thru the code and see the Cookie on the Response.Redirect and it appears to be what I need, but it won't let me in. Any thoughts on what I'm missing?

According to every site I read, this is really easy. I beg to differ; I'm a newbie, for sure, but this is far from what I would call "easy". I'm sure it's something stupid I'm doing or something I've missed, but I've spent several hours on this and have gotten no where. Any help or ideas would be greatly appreciated.

Thanks.

You need a RoleProvider to just use the web.config file. It sounds since you've got your own database set up that you'll need to implement your own RoleProvider (the link above has more information about that).

The alternative is to handle this yourself. It sounds like you already have the information at hand (is it stored in the cookie?) so perhaps on page load you just check if this person belongs and redirect if they don't...


Edit: I reread what you wrote, and now I have a better link for you. Since your database is the same as what aspnet_regsql would make for you, this page will show you how to redirect from the local SQL express to a remote SQL server.

[garymcintyre]

Thanks for the reply.

I think I figured out what I was doing wrong. In my web.config, I have both role provider and membership provider. I'm not positive of this, but I had the application name different in each section; once I changed them both to the same name (the one in aspnet_Applications table), it seemed to work. I think. I will continue to test this out to make sure.