Build User rights control system in Asp.net.(Windows Form Authentication)

1.You must change your web system to windows form authentication in web.config

1. <authentication mode="Forms">
2.       <forms loginUrl="Pub/Login.aspx" name=".ASPXAUTH"></forms>
3.     </authentication>

2. Create a new web.config file under the folder you want to protect.

1. <?xml version="1.0"?>
2. <configuration>
3.     <appSettings/>
4.     <connectionStrings/>
5.     <system.web>
6.       <authorization>
7.         <!--多个角色用,分隔-->
8.         <allow roles="SuperAdmin,Admin"/>
9.         <deny users="*" />
10.       </authorization>
11.     </system.web>
12. </configuration>
14. <!--也可控制某个页的权限
16.   <location path="AnnounceList.aspx">
17.      <system.web>
18.         <authorization>
19.            <allow roles="admin"/>
20.            <deny users="*" />
21.         </authorization>
22.      </system.web>
23.   </location>
25.   <location path="ConfigInfo.aspx">
26.      <system.web>
27.         <authorization>
28.            <allow roles="users"/>
29.            <deny users="*" />
30.         </authorization>
31.      </system.web>
32.   </location>
34.   -->

Please be care of the under path for the location nodes. It should be under <configuration> node.

 

In the Login.aspx page,

the code should be like this,

1. protected void Button1_Click(object sender, EventArgs e)
2.         {
3.             string username = UserLogin(TextBox1.Text);
4.             if (username != null && username != "")
5.             {
6.                 string userRole = GetUserRole(username);
8.                 SetLoginCookie(username, userRole);
9.                 Response.Redirect("~//highlevel//high.aspx");
10.             }
11.             else
12.             {
13.                 ltError.Text = "用户名输入错误！请重新输入！";
14.             }
15.         }
17.         public static void SetLoginCookie(string username, string roles)
18.         {
19.             //建立身份验证票对象
20.             FormsAuthenticationTicket ticket = new FormsAuthenticationTicket(1, username, DateTime.Now, DateTime.Now.AddMinutes(30), false, roles, "/");
21.             //加密序列化验证票为字符串
22.             string hashTicket = FormsAuthentication.Encrypt(ticket);
23.             HttpCookie userCookie = new HttpCookie(FormsAuthentication.FormsCookieName, hashTicket);
24.             HttpContext.Current.Response.Cookies.Add(userCookie);
25.         }

Create Global.asax at the root folder.

1. protected void Application_AuthenticateRequest(object sender, EventArgs e)
2.         {
3.             HttpApplication app = (HttpApplication)sender;
4.             HttpContext ctx = app.Context; //获取本次Http请求的HttpContext对象  
5.             if (ctx.User != null)
6.             {
7.                 if (ctx.Request.IsAuthenticated == true) //验证过的一般用户才能进行角色验证  
8.                 {
9.                     System.Web.Security.FormsIdentity fi = (System.Web.Security.FormsIdentity)ctx.User.Identity;
10.                     System.Web.Security.FormsAuthenticationTicket ticket = fi.Ticket; //取得身份验证票  
11.                     string userData = ticket.UserData;//从UserData中恢复role信息
12.                     string[] roles = userData.Split(','); //将角色数据转成字符串数组,得到相关的角色信息  
13.                     ctx.User = new System.Security.Principal.GenericPrincipal(fi, roles); //这样当前用户就拥有角色信息了
14.                 }
15.             }
16.         }

then the user can't visit the page without the right role. You must assure every person should have correct role.