Forms authentication Of Asp.net

I am working on Asp.net Application where I have 4 roles in my application. 1. Admin 2. User 3. Reseller 4. Affiliate. And I am Using Form Authentication for this everything was working fine for single role(User). But now i have 4 roles and I am not getting how to manage this. I have 4 folders for different Users. If i login with reseller account and if i change the url for user then its allowing me to access user part also. But i don't want this. I need in my app that user can access only his access area. Means If your r开发者_C百科eseller logged in then he can only access reseller pages or same folder nothing else.

Please help me to find this solution.

---

You can use the web.config to set the permission or you can also get more granular and decorate the class or method you want to lock down like this:

[PrincipalPermissionAttribute(SecurityAction.Demand, Role = @"Administrators")]

All of this is part of the role manager that you can set up. Start by reading this article that explains what to do.

---

There's two things to look at here. First of all, restricting access to each folder by role ought to be straightforward enough if you use <location> elements in your web.config e.g.

<location path="Resellers">
    <system.web>
        <authorization>
            <allow roles="Reseller"/>
            <deny roles="*"/>
       </authorization>
    </system.web>
</location>

<location path="Users">
    <system.web>
        <authorization>
            <allow roles="User"/>
            <deny roles="*"/>
       </authorization>
    </system.web>
</location>
...

Also in your individual pages, you can call the IsUserInRole function to check whether your user is in the correct role to access the page.

You might want to get hold of a copy of Beginning ASP.NET Security, it's got great information on how to do this.

---

You need to set the appropriate authentication settings in a web.config file for each folder you are restricting access to, i.e.

<authorization>
  <deny users="?" />
  <allow roles="Administrators" />
  <deny users="*" />
</authorization>

Will allow access only to validated users with the role of "Administrators".

---

In each of the folders you have to place a web.config file that restricts access to the role in question. For example, in the resellers folder you have a web.config containing:

<authorization>
  <deny users="*"/>
  <allow roles="Resellers"/>
</authorization>

And so on for the other folders.

---

use like below code:

<location path="Users">
        <system.web>
            <authorization>
                <allow roles="Users"/>
                <deny users="*"/>
            </authorization>
        </system.web>
    </location>