how to make different authentication in asp.net c# web form?

Question

we have two part for authentication in web site. the first use in admin and the second use for users to enter to site.when admin authentication in site and go to user page ,make error.how to create different authentication for those?web config code:

<authentication mode="Forms">
  <forms loginUrl="~/admin/Login.aspx" timeout="2880" />
</authentication>

Why complicate it? Read the users permissions on sign on, if they have administrative privileges redirect to "/admin/". You're not gaining anything other than more work attempting it this way — Aydin
– Aydin, Commented Feb 7, 2016 at 6:17
we read users permissions on sign on.when i use User.Identity.IsAuthenticated then its return true.but this Authenticated for admin.how to make different Authenticated for users? — shahroz
– shahroz, Commented Feb 7, 2016 at 6:27
@shahroz you have to understand that authentication should only check if that's a valid user or not. To distinguish administrators from normal users, you need to enter the authorization phase and ASP.NET has built in support for that kind of thing. — Lex Li
– Lex Li, Commented Feb 7, 2016 at 6:44
Precisely what @LexLi said, you may also be opening yourself up to attacks if you're not checking user roles on POST requests, we obviously don't know your exact implementation so far but the fact that you could be opening yourself up to real security risks is another reason why you should look into what's being suggested — Aydin
– Aydin, Commented Feb 7, 2016 at 7:01

Aydin · Accepted Answer · 2016-02-07 07:00:03Z

Based on your reply in comments...

we read users permissions on sign on.when i use User.Identity.IsAuthenticated then its return true.but this Authenticated for admin.how to make different Authenticated for users?

Checking whether a user is authenticated is different from checking a user's permissions. Authentication only tells you that the person visiting your site has authenticated themselves (i.e. logged on to their account).

What's missing in your equation is the authorization phase (Remember college/uni? Everyone is issued ID cards, on access to the college/uni grounds you authenticate yourself, staff members also authenticate themselves, students won't have authorization to enter the staff room or perform certain tasks, but staff members do).

We implement this using what's called Roles, every user should have a Role. Every Role should have a set of Permissions associated with it, for now I wouldn't worry about Permissions as it can get real complicated real quick, if you focus on ìmplementing roles alone for now, it would be enough to get you going.

Once every user has a role associated to their account, you can check their Role instead of whether they're simply authenticated, which doesn't tell you much.

There should be an extension method to the IPrinciple interface along the lines of GetUserRoles() already implemented in framework, User.Identity.GetUserRoles() something along the lines of that.

Collectives™ on Stack Overflow

how to make different authentication in asp.net c# web form?

1 Answer 1

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

Comments

Your Answer

Sign up or log in

Post as a guest

Related