Using IsInRole() with Forms Authentication

A Little background….

Page object provides** User** [System.Security.Principal.IPrincipal] in order to access to the information about the current authenticated user.** User** is having following two important members. These members provide way to implement Role-based authorization programmatically.

Identity [Property] [System.Security.Principal.IPrincipal.Identity] – This property provides important members like AuthenticationType, IsAuthenticated, Name.

IsInRole[Method] [System.Security.Principal.IPrincipal] – This method takes single parameter that is string value of Role for which to check the membership.

First configure the web.config to use Forms Authentication as below:

On Login click event do the following:

protected void btnLogin_Click(object sender, EventArgs e)

{

/Here put your code to fetch the userinformation which includes user name, role, password,etc. from Database/

...

/Now, create the Forms Authentication ticket with the application’s custom user role & user name,./

FormsAuthenticationTicket Authticket = new FormsAuthenticationTicket(1,

userName, DateTime.Now, DateTime.Now.AddMinutes(HttpContext.Current.Session.Timeout),

false, userrole.ToString(), FormsAuthentication.FormsCookiePath);

/You may want to encrypt the ticket information before putting into the coockie./

string hash = FormsAuthentication.Encrypt(Authticket);

HttpCookie Authcookie = new HttpCookie (FormsAuthentication.FormsCookieName, hash);

/Here you can set some coockie sessings like persistence, httponly../

if (Authticket.IsPersistent)

Authcookie.Expires = Authticket.Expiration;

/Now, add the cookie to the Reponse object of Current HttpContext./

HttpContext.Current.Response.Cookies.Add(Authcookie);

/Put the userrole into session/

HttpContext.Current.Session[USER_ROLE] = UserRole.Operator;

/Now you can redirect the user to the requested page/

HttpContext.Current.Response.Redirect(“~/Operator/Home.aspx”, false);

}

Now, you can check the custom application user role on any page before authorizing the resource as follows:

Public static void CheckAuthorizedUserRole()

{

            if (!HttpContext.Current.User.IsInRole(“Operator”))

  {

FormsAuthentication.SignOut();

/Or else, you can redirect the user to the desired page.[Probably, Access Denied!]/

  }

}

Here system will check for the specific user role, if not found forms authentication will forces the user to signout.

This way you can have the custom implementation of role based authorization.

---

Originally posted on Things on Tech.