Asp.net webform & roled based permission for different folders - asp.net

Question

I have following folder structure in my asp.net webform application.
_AdminUser
_ModeratorUser
_EmployeeUser
Images
js
css
ckeditor
App_Code
errorPages
Default.aspx
News.aspx
Article.aspx
So far i had only one type of user who used to edit contents of the website. I used to simply authorise users and redirect authorised user to folder '_AdminUser' so that they
can make changes to the site.
And below code in web.config was enough for me to work without any issue.
<authentication mode="Forms">
<forms loginUrl="~/_Login.aspx" timeout="2880"/>
</authentication>
<location path="_adminUser">
<system.web>
<authorization>
<deny users="?"/>
</authorization>
</system.web>
</location>
<location path="ckeditor">
<system.web>
<authorization>
<deny users="?"/>
</authorization>
</system.web>
</location>
In my new project i have to create three different types of users
Admin User (who is a super user & can have access to all the files in different folder )
Moderator User (This type of user can have access to only files in this folder _ModeratorUser & other general foleder but no access to _AdminUser or _EmployeeUser )
Employee User (This type of user can have access to only files in this folder _EmployeeUser& other general folder but no access to_AdminUseror_EmployeeUser` )
In order to achieve this i have create three types of roles Admin , Moderator and Employee. When i create new user I assign it to specific role and i want each role to have access to different folder as described above.
but i am not sure how i can modify web.config file so that i can achieve this kind of role based permission. I have been looking for such tutorial but no luck so far. other tutorial which i looked at doesn't seem to address my problem. I would appreciate a pointer in right direction.

Answer 1

I assume you use ASP.Net Membership and Role provider. If so, you need a separate web.config in each folder to restrict permission.
web.config inside Admin folder
The following web.conf setting (located inside Admin folder) allows only users in Admin role accessing files inside Admin folder. Other users cannot access those files.
<?xml version="1.0" encoding="UTF-8"?>
<configuration>
<system.web>
<authorization>
<allow roles="Admin" />
<deny users="*" />
</authorization>
</system.web>
</configuration>

Answer 2

You have here a very good tutorial and you even can download a tool for administrate user, roles, permissions. You can download the source code from the bottom of the page, on the attachments section.

Answer 3

Web.Config Setting
<!--Path: folder path -->
<location path="_adminUser">
<system.web>
<authorization>
<!-- Allow user who have Admin role can access the AdminUser folder aspx pages -->
<allow roles="Admin"/>
<!-- Other user can not access AdminUser folder aspx pages -->
<deny users="*"/>
</authorization>
</system.web>
</location>
<!--Path: folder path -->
<location path="_EmployeeUser">
<system.web>
<authorization>
<!-- Allow user who have Client role can access the ClientUser folder aspx pages -->
<allow roles="Employee"/>
<!-- Other user can not access ClientUser folder aspx pages -->
<deny users="*"/>
</authorization>
</system.web>
</location>
I also wrote following code for my Login Control Button
protected void Login1_LoggedIn(object sender, EventArgs e)
{
// please don't use User.IsInRole here , because it will not be populated yet at this stage.
if (Roles.IsUserInRole(Login1.UserName, "Admin"))
{
Login1.DestinationPageUrl = "~/_adminUser/Default.aspx";
}
else if (Roles.IsUserInRole(Login1.UserName, "Heroes"))
{
Login1.DestinationPageUrl = "~/_EmployeeUser/Default.aspx";
}
}
Above approach is working for me but it has a drawback that i have to code in every time a new role is added. I am not sure which separate web.config file for related for is not working as mentioned in one of the solution.