Re: Can't get access with some role logins - on IIS 6 only

Major problem - the user is not authenticated when that event handler is
called. It should be - but it isn't.

However, the following works great:

protected void Page_Load(object sender, EventArgs e)
{

if (! IsPostBack)
{
// will come here if logged in but went to a page not allowed on. In that
case go to default
if (User.Identity.IsAuthenticated &&
PortalRole.IsInRole(PortalRole.ROLES.USER))
Response.Redirect(ResolveUrl("~/default.aspx"));
}
}


--
thanks - dave
david_at_windward_dot_net
http://www.windwardreports.com

Cubicle Wars - http://www.windwardreports.com/film.htm




"Steven Cheng[MSFT]" wrote:

Thanks for Dominick's input.

Hi Dave,

Use custom httpmodule and change the response status may make it a bit
complex. My concern here is why would your user be redirect to the login
page after he login the second time(with a non-admin) account. He is try
to request an admin-only page, correct? If this is the case, I think it is
reasonable to redirect him to the login page since a non-admin user should
not request a admin-only page.

Actually, after the login control correctly validate the user, it will call
FormsAuthentication.GetRedirectUrl to get the url which it will reirect the
user toward later. So for your scenario, when a non-admin user originally
request a admin-only page, and is redirect to the login page, he will go
through the following steps:

1. first time go to login page, the Context.User.Identity.IsAuthenticated
== false (because hasn't login)

2. After login, the login control automatically redirect user to the
original requested page

3.since this page is admin-only, the user is redirected to login page
again. However, this time, Context.User.Identity.IsAuthenticated ==
true(because he has already login , but hasn't sufficient permission)

Then, we can find that what we can do is check the
Context.User.Identity.IsAuthenticated to determine whether the current
login redirect is due to unauthenticated or lack of permission. If the
user is already authenticated, you can manually redirect him to the default
page instead. You can do this in the login control's "OnLoggedIn" event
.e.g

===================
protected void Login1_LoggedIn(object sender, EventArgs e)
{
if (User.Identity.IsAuthenticated)
{
Response.Redirect(ResolveUrl("~/default.aspx"));
}
}
=====================

Hope this helps.

Sincerely,

Steven Cheng

Microsoft MSDN Online Support Lead



==================================================

Get notification to my posts through email? Please refer to
http://msdn.microsoft.com/subscriptions/managednewsgroups/default.aspx#notif
ications.



Note: The MSDN Managed Newsgroup support offering is for non-urgent issues
where an initial response from the community or a Microsoft Support
Engineer within 1 business day is acceptable. Please note that each follow
up response may take approximately 2 business days as the support
professional working with you may need further investigation to reach the
most efficient resolution. The offering is not appropriate for situations
that require urgent, real-time or phone-based interactions or complex
project analysis and dump analysis issues. Issues of this nature are best
handled working with a dedicated Microsoft Support Engineer by contacting
Microsoft Customer Support Services (CSS) at
http://msdn.microsoft.com/subscriptions/support/default.aspx.

==================================================



This posting is provided "AS IS" with no warranties, and confers no rights.



.

Relevant Pages

  • RE: Login control and restricted member pages
    ... I think it is likely caused by windows ... Microsoft MSDN Online Support Lead ... where an initial response from the community or a Microsoft Support ... Login control and restricted member pages ...
    (microsoft.public.dotnet.framework.aspnet.security)
  • Re: Forms Authentication - Sudden Redirect Failure on Login
    ... login page and executable to the production environment failed, ... web app in VS 2005 using forms authentication. ... Microsoft Online Community Support ... where an initial response from the community or a Microsoft Support ...
    (microsoft.public.dotnet.framework.aspnet.security)
  • RE: WMP 11 Download Songs from URGE
    ... it's a music online download site that need to login to use its service. ... Microsoft Online Community Support ... where an initial response from the community or a Microsoft Support ...
    (microsoft.public.vb.general.discussion)
  • Re: WMP 11 Download Songs from URGE
    ... | it's a music online download site that need to login to use its service. ... normally accessing such web site programmatically ... | Microsoft Online Community Support ... | where an initial response from the community or a Microsoft Support ...
    (microsoft.public.vb.general.discussion)
  • RE: RoleProvider Capturing Authentication Events
    ... login page) see different pages depend on whether they're unauthenticated ... Because if a user is redirect to login ... Microsoft MSDN Online Support Lead ... where an initial response from the community or a Microsoft Support ...
    (microsoft.public.dotnet.framework.aspnet)