-1

I am new to ASP.NET and I am working on ASP.NET Web Site Application in which i have some Internal (OR Domain specific) Roles. Like, BoardOfDirectors, Managers, Secretary belonging to Employee class and ShareHolder another Role, another one as Company Administrator/Creator/Owner etc. All these Roles are internal (OR domain/business model) specific Roles which delimit the business functions a specific Role/Actor can perform.

One of my colleagues told me to do R&D on ASP.NET Forms-Based Authenticatoin, Authorization and MEmbership class etc. With this i initally got an idea that probably ASP.NET provides a ready-made Role Management Module that can be customized to any domain specific needs (just as we see in ready-made CMS Systems)

But, After some googling, i reallized that Form-Based Authentication limits the Roles on use of Web Resources specificlaly Pages. This leads me to idea that Internal (OR Domain Specific) Role Management is not related to ASP.NET Form-Based Authentication. Instead Form-Based Authentication (as it restricts access to pages in website) can be used to manage External Roles of the website like Web Site Adminsitrator (Having a different website folder/file structure which should be accessed merely by a Role specified in database like Site Admin or so. Similarly, Form-Based Authentication can be used to discriminate between a Site Member and Free User/Visitor.

For my internal/Domain specific Roles, I really do not see any reason to create multiple pages in different Role-Based folders with duplicate OR overlapping functionality like A Company Creator will be able to do business functions that manager can do, so i would not like to create two separate folders/files; one for Company Creator and other for Manager with Manager page duplicating some of functionality from Company Creator. I feel that it would be appropriate to handle Domain Roles using Business Logic (in my Domain Model Layer).

I need your suggestion if i am wrong in my understanding/assumption, OR if i am missing something?

Regards

Fakhar Anwar
  • 295
  • 1
  • 3
  • 20

1 Answers1

0

Do not mix up Authentication and Authorization.

Authentication in your case is going to be done by using Forms-based Authentication, and Authorization is going to be based on User Roles.

Authentication would ensure that the system recognizes the User. Authorization would ensure that whether or not that user is allowed to perform certain actions or functionality.

malikalamgirian
  • 185
  • 11