Setting HttpContext.Current.User

lukin

I have an ASP.NET site and I am logging in users without using the ASP.NET login control. I can assign them to roles once they login.
See example code below:

 string[] roles = {"Admin"};
      
        System.Security.Principal.GenericIdentity curIdentity = null;
        System.Security.Principal.GenericPrincipal curPrincipal = null;
            curIdentity = new System.Security.Principal.GenericIdentity(userName);
            curPrincipal = new System.Security.Principal.GenericPrincipal(curIdentity, roles);
            HttpContext.Current.User = curPrincipal;

 if (HttpContext.Current.User.IsInRole("Admin"))
           {
            System.Windows.Forms.MessageBox.Show("This user is in admin role");
           }

The user is in the role I want them to be but the settings I have placed in my Web.config file are not being picked up.

Web.config section below:

 <location path="Page1.aspx">
    <system.web>
      <authorization>
      <deny roles="Admin">        
      </deny>       
      </authorization>
    </system.web>    
  </location>

The "Page1.aspx" file should not be accessible to a user in the Admin role but it is. This is because the "HttpContext.Current.User" is not being recognised outside of the page it is in. How can I change this? I've seen some code on the web that might fix it but it looks a right nightmare.

Ronan_

Do you also have a variation of this in you web.config

<system.web>
    <roleManager enabled="true" />
</system.web>

Edit: This might also be worth a read:
http://davidhayden.com/blog/dave/archive/2007/10/17/CreateCustomRoleProviderASPNETRolePermissionsSecurity.aspx

lukin

Ronan_ wrote: »

Do you also have a variation of this in you web.config

<system.web>
    <roleManager enabled="true" />
</system.web>

Edit: This might also be worth a read:
http://davidhayden.com/blog/dave/archive/2007/10/17/CreateCustomRoleProviderASPNETRolePermissionsSecurity.aspx

No I don't have that enabled, I'll do it and see. The problem is that role the user is in (which is set in the first section of code I posted) is lost once the user goes to another page so the role of the logged in user at that time is null. I think I have found a way to fix it by using the Global.asax file.
I think variables in code that are set there are accessible throughout the site?
I'll check out the link too thanks.

Ginger

The Httpcontext User is set in the Global.asax and its then accessible from then on you can check it etc.