[RESOLVED] passing role to the context user.

[popskie]

Hi,

We have a requirement that will authenticate against AD and to the database. We do this because not all user in AD will have an access to the application. The user in AD has no specific role. My question is it posible to add role to the context user dynamically? Thanks!

[mendhak]

Yes, you'll simply have username stored against rolename in a table somewhere.

[popskie]

Hi Mendhak,

I can now successfully override the context username and the role using the genericPrincipal class but when I set the web.config. Pls see the config below. Even the user is clerk still can access the page. Im user the role of the user is Clerk because I checked using the IsinRole method.
<

authorization>
<allow roles="Manager" />
<Deny roles="Clerk" />
</authorization>

[popskie]

I have another problem the changes happened only on that context meaning it will reset if another request will be happen?

[mendhak]

Oh, those roles.

It wasn't clear in your original post. The database would contain custom defined roles, it won't work like that, unless you create a role provider.

[popskie]

Acutally I used a windows authentication if authentication was succesffully it will check to the user database if exist. Then if exist it will return a role then this role I want to override to the context user. I do this because our AD has no groups/roles.

[dark87]

hmm.... i don't know whether this will help you out... my web.config looks like this

      <authorization>
        <allow roles ="admin"/>
        <deny users ="*"/>
      </authorization>
    </system.web>
  </location>
    <location path="Admin/AddUsers.aspx">
    <system.web>

and my login page for the role is

FormsAuthentication.SetAuthCookie(Login.Name, True)
            If Roles.IsUserInRole(Login.Name, "admin") = False Then
                Roles.AddUserToRole(Login.Name, "admin")
                Response.Redirect("Admin.html")

As for me, i am using form authenication
Hope this can help you out..

[mendhak]

Implement a custom membership provider that looks at the currently logged in user (windows auth) and checks the database for their role. This will mean that you need to store their name in the database in a table against a role or roles. Any new users who don't exist in that table will need to be added against a default role.

http://msdn2.microsoft.com/en-us/library/f1kyba5e.aspx

[popskie]

Thanks for the rep guys but my problem now Im facing is that during that request, sample in the page load or init event I can succesfully override that user but when my page request to another server the value will reset to the actual login user. I realize that the overriding is per context meaing per request but I dont want to this that every request to server I have to override that user. I want a static value for this after I succesfully override that user.

[mendhak]

Override the user with what?

[popskie]

The role is from database and username from active directory

[mendhak]

Yes, but you said

in the page load or init event I can succesfully override that user but when my page request to another server the value will reset to the actual login user

Override the user with what?

[popskie]

Sorry for misunderstanding

If a user log in the site using basic authentication using user "userbasic" then if succesful. The user context now is "userbasic". In the page load in my page I have to query to the database the userbasic assuming both is exist in AD and database. In the database I have a field called role which I want to override the value in the user role in the context. I can succesfull override but the problem is per context meaning if I want to retain the role from database I have to override in each request.

I have to do this because the username from AD has no group or role. we have no authorize to alter the data from AD. That why we have to authencate from AD then override the role from database. Assuming that all user must exist in AD and database.

[mendhak]

Which is why you need to create your own custom membership provider, post #8, so that it can work with your other membership controls.

[popskie]

Thanks mendhak for the. I changed the authentication from windows to forms then create a login page. This solved my problem. Thanks for the idea.