Hi all. Ok I am new to forms authentication and I am trying to pull this all together. Right now I have a login page where if the user authenticates against a SQL Database then I move on and I am setting up a Forms Auth ticket etc. I then have pages where I want to check certain credentials and if it does not pass or if the user just hits the page without authenticating to the SQL Database I want to force them to go back to the sign off page. How do I do this. I am posting here what I have. I cant seem to get my global.asax page working so I added all this into the login page. I will also paste my web.config. At this point I dont know what to do etc. Once the user authenticates from the SQL Database I pass to this method here:
private void ProcessFormsAuthentication
(string USER_ID)
{
FormsAuthentication.Initia
lize();
string roleList = GetRoles(USER_ID);
// Create the authentication ticket
FormsAuthenticationTicket authTicket = new
FormsAuthenticationTicket(
1, // version
USER_ID, // user name
DateTime.Now, // creation
DateTime.Now.AddMinutes(60
),// Expiration
false, // Persistent
roleList); // User data
// When the ticket was created, the UserData property was assigned a
// pipe delimited string of role names.
string[] roles = authTicket.UserData.Split(
new char[]{'|'});
// Create an Identity object
FormsIdentity id = new FormsIdentity(authTicket);
// This principal will flow throughout the request.
GenericPrincipal principal = new GenericPrincipal(id, roles);
// Attach the new principal object to the current HttpContext object
Context.User = principal;
// Now encrypt the ticket.
string encryptedTicket = FormsAuthentication.Encryp
t(authTick
et);
// Create a cookie and add the encrypted ticket to the
// cookie as data.
HttpCookie authCookie =
new HttpCookie(FormsAuthentica
tion.Forms
CookieName
,
encryptedTicket);
// Add the cookie to the outgoing cookies collection.
Response.Cookies.Add(authC
ookie);
Respones.Redirect("firstpa
ge.aspx");
}
private string GetRoles(string USER_ID)
{
return "Senior Manager|Manager|Employee";
//just for testing
}
the roles is another issue I am looking at as well but I just want to also start with checking on a page the user is authenticated and playing around with a force sign off. Here is my Web config. I dont have any clue how the authorization works:
<authentication mode="Forms">
<forms name="CustomerSite"
loginUrl="\Site\Logon.aspx
"
protection="All"
timeout="60"
path="/"
requireSSL="true"
slidingExpiration="true">
</forms>
</authentication>
<authorization>
<allow users="*" />
</authorization>