Link to home
Start Free TrialLog in
Avatar of cbtidball
cbtidball

asked on

Implement Roles in

I have an ASP.NET application (in C#.)  I have a custom login authentication procedure.  Once a user is authenticated I want to take advantage of the asp.net roles.  Can I integrate the asp.net roles feature into my existing authentication procedure?  And if so, how would I do this?  Just to let you know where I stand, my DB is already set up for asp.net security and I have already created all of the roles I want to use.  So, when I authenticate my user I need to assign a role(s) to them... which I where I need help.  Thanks in advance, Christopher
Avatar of guru_sami
guru_sami
Flag of United States of America image

Do you want to assign role to each user everytime they login or first time they login?
Or when you create the account?

Two thing you have to do:
1: Setup your application to use role provider. This can be done by enabling roleManager and approriate settings for roleprovider in your web.config
2: Use the Role Provider APIs to add user to role/Remove user from a role etc.

The link below is almost what you are looking for. The only difference is it is using Windows Authentication and you will be using your own authentication. Roles concept remains identical.
Check:
http://weblogs.asp.net/scottgu/pages/Recipe_3A00_-Implementing-Role_2D00_Based-Security-with-ASP.NET-2.0-using-Windows-Authentication-and-SQL-Server.aspx

Also check the tutorials here under Roles section on how to create/assign/manage roles through code i.e. using Roles API.
http://www.asp.net/learn/security/
http://msdn.microsoft.com/en-us/library/ms998314.aspx
Avatar of cbtidball
cbtidball

ASKER

ok, I will take a look at those sites this afternoon; they might be the answer:  

To answer your question:  I have around 300 users, who will use their employee ID to log in.  The login page authenticates the user via a web service that my IT group administers.  Once they are authenticated, they need to only access specific folders (thus my need for roles.)  So, once John Doe logs in with his employee id (12345) I have a table that says id 12345 belongs to the "Sales" and "Marketing" roles.  Not sure if this changes your suggestion, but just wanted to make sure I was clear on my issue.  Thanks.
So, once John Doe logs in with his employee id (12345) I have a table that says id 12345 belongs to the "Sales" and "Marketing" roles.
How did you create user/roles mapping in the table? Is this the table that comes with aspnet membership/roles database or your custom table?
If it is aspnet roles tables ... you should create roles and add users to those roles using roles api to work it properly
If you have your custom table for roles ...then the default sqlroleprovider will not work for you.
The user/roles mapping is a custom table right now, but I could start using the [aspnet_UsersInRoles] table if it makes the task easier.  But I would need help with the mechanics.  For instance, once a user is authenticated do I need to set a specific session variable with the employee ID?
Using aspnet Roles tables will make your job easy.
If you are using Forms Authentication then it will get the info of current logged-in username from the httpcontex.current.identity.Name and do the work for you.
If not then I think then the code might become complex.

So how is your current authentication mechanism working?
Right now, there is no role security.  Once the user is authenticated, they have acces to the whole site.  I use Forms Authentication.  The user types their id and password, I send the values to a webservice that returns true or false.  

So, based on what you suggested.  Once the webservice returns true (meaning the user is authenticated) should I set the httpcontex.current.identity.Name = employee id?  Then it would look for the employee id in the role table and assign the correct role, right?
ASKER CERTIFIED SOLUTION
Avatar of guru_sami
guru_sami
Flag of United States of America image

Link to home
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
Start Free Trial
Thanks for your help, your guidance was very clear and worked perfectly.  My forms authentication was set-up how you described , so implementing the roles portion was easy.  Thanks again.