授权用户无法访问他们的页面

Question

I have a application that authenticates a particular user(East) and redirects them to their respective page(East.aspx).This page cannot be displayed to un-authorized users, whenever they go to the authorized page(East.aspx) they are re-directed to the login page.

To solve the above problem I have created roles and added users to a particular role in Application file(Global.asax) in Application_Start Event.

void Application_Start(object sender, EventArgs e) 
{
    // Code that runs on application startup
    if (Roles.RoleExists("Browser") == false)
    {
        Roles.CreateRole("Browser");
        Roles.AddUserToRole("East","Browser");
    }
    if (Roles.RoleExists("Buyer") == false)
    {
        Roles.CreateRole("Buyer");
        Roles.AddUserToRole("B2","Buyer");
    }
    if (Roles.RoleExists("Seller") == false)
    {
        Roles.CreateRole("Seller");
        Roles.AddUserToRole("S1","Seller");
    }
    if (Roles.RoleExists("Admin") == false)
    {
        Roles.CreateRole("Admin");
        Roles.AddUserToRole("A1","Admin");
    }

}

In web.Config file I implemented following

</authorization>

<roleManager enabled="true" defaultProvider="SqlRoleManager">
  <providers>
    <clear/>
    <add name="SqlRoleManager" type="System.Web.Security.SqlRoleProvider" connectionStringName="MyDbConn" applicationName="RolebasedApp"/>
    <add applicationName="RolebasedApp" name="AspNetWindowsTokenRoleProvider" type="System.Web.Security.WindowsTokenRoleProvider"/>
  </providers>
</roleManager>
</system.web>

I'm testing the above case for only East User.I want to make sure that my Application name is (the application name where I start creating the Web pages for different users).

When all of this is done, when I run my application And enter the correct credentials for User "East". I get Navigated to Login page instead of East.aspx

How can this be solved?

Answer 1

You need a configuration that looks like this:

  <location path="East.aspx">
    <system.web>
      <authorization>
        <deny users="?" />         <!--Deny all Anonymous (not logged in) users-->
        <allow roles="east"/>        <!--Permit users in these roles-->
        <deny users="*"/>        <!--Deny all users-->
      </authorization>
    </system.web>
  </location>

You can skip the location tag if east.aspx is in a separate folder and the folder has its own web.config file.