1

I've built a number sites using classic ASP type security and have continued using the same methods in ASP.NET. However, I now am looking for recommendations for a better or best practice way of doing it. I've read a few resource online but have not seen anything comprehensive enough that's applicable to what I'm trying to do. What I'm trying to do is apply user specific security that determines that user's access to specific pages, sections on that page, and fields in each section. It also needs to restrict access to various records as well and determine whether it's read or write privileges.

For those interested, here's how I've done it so far:

Because I lacked the know-how, here's how I did it using the old ASP classic way...

First, on the database side I have 4 relevant tables: tblUsers, tblRoles, tblPages, tblRecords (haven't gotten to sections and fields yet). Each user can belong to a "role" and the role then determines what pages they can access as well as what records they can access in various tables (there are a number of other tables in the db as well e.g. tblCustomers, tblSales, etc...). Each table includes these fields:

  • tblUsers: UserID, UserName, UserPwd
  • tblRoles: RoleID, RoleName, UserID
  • tblPages: PageID, PageName, RoleID
  • tblRecords: RecordID, RecordTable, RoleID

Now on the application side here's what I've done:

First, my login page is based on 1) looking up the user name and password in the tblUsers table and 2) if found, setting a session variable named "UserLoggedIn" = true. Then on every page load event I check if the UserLoggedIn session is set to true, if so, continue... if not clear all session variables (log out) and send the user back to the login page. The old classic ASP way of doing it.

Second, with the login set up, to control page access, when the user is logged in I created another session variable that holds a pipe delimited string of all the pages that user can access (e.g. Session("PageAccess") = "{1|3|10|8}"). Then in each page's load event I've explicitly added a variable/constant that uniquely identifies that page (e.g. pageone.aspx has Dim PageID As String = 1). Then I check to see if the PageID matches an ID stored in the PageAccess session. If it does, continue... If it doesn't I send them to the home page.

Third/Last, for the records access, I did the same thing. When the user is logged in I created a session variable that hold a pipe delimited string of all the records the user could access along with the table it's related to (e.g. Session("RecordAccess") = "{tblCustomrs||1|5|7}" and checked it and applied it basically the same way as the page session variable.

Cristian Ciupitu
  • 20,270
  • 7
  • 50
  • 76
ptownbro
  • 1,240
  • 3
  • 26
  • 44

1 Answers1

0

My Solution is :(it worked for my projects) tables : tblUser , tblRole , tblUserInRole : userid,roleid,username,password (this design help you can assign more than one role to a user) tblrole, tbrules(your Access Controls for example pages) tblRulesInRole : roleid , ruleid,Editable,Viewable,printable,Deletable

For Implement Access Control in every request and response ,you should Create HttpModule......

Omid Rahimi
  • 457
  • 4
  • 7
  • Welcome to SO. Generally speaking, answers should be more complete than this. Please see http://stackoverflow.com/questions/how-to-answer for details. – cramopy Dec 16 '15 at 21:01