Is WEB.CONFIG the right solution to control thousands of users?

[TunaAdmiral]

Good afternoon!

Handling web-page access using the web.config file is very unwieldy when you have a few thousand users.

There must be another way of doing this (by allowing access by groups, or something.)

I can control access to each page in the code-behind for each page, but this would also be very unwieldy, and would require me to recompile my code every time I add or change a user.

What are other folks doing to control user access to specific pages and directories within a website?

Thanks!

Mikeymac

 

[BoulderBum]

1. Use Windows integrated security and lock down access on a per-folder basis.
2. Use Forms authentication to assign roles, but still lock down folders as above.
3. In ASP.NET 2.0, automate the authentication using a built-in MembershipProvider (but still configure roles for folders).
4. For security setups that fall outside of the normal methods (as in per-user access to a page), use an IHttpModule to handle authentication (using whatever arbitrary security criteria you like):

http://www.codeproject.com/aspnet/AspNetCustomAuth.asp

5. For ASP.NET 2.0, do something similar with custom role and membership providers.
6. Have all pages inherit from the same base page that handles security (better to use an IHttpModule/Providers, though).

 

[adamroof]

Drive it with a database!...

<configuration>
   <appSettings file="externalFile.config">
   </appSettings>
    <system.web>
        <customErrors mode="On" defaultRedirect="error.htm">
			<error statusCode="500" redirect="CustomerError500.aspx"/>
			<error statusCode="401" redirect="CustomerAccessDenied.aspx"/>
			<error statusCode="404" redirect="inactive.aspx"/>
			<error statusCode="403" redirect="noaccessallowed.aspx"/>
		</customErrors>
        <authentication mode="Forms">
            <forms name="appNameAuth" path="/" loginUrl="login.aspx" protection="All" timeout="30">
            </forms>
        </authentication>
        <authorization>
            <deny users="?" />
        </authorization>
		<sessionState mode="InProc" cookieless="false" timeout="30" />
    </system.web>
</configuration>

Many articles on this process, i built a couple of database driven login pages.

If hosted, only option is Forms Auth, if internal DO NOTHING BUT INTEGRATED WINDOWS!

some good links...

http://www.15seconds.com/issue/020220.htm

(to build auth pages)

http://msdn.microsoft.com/library/default.asp?url=/library/en-us/secmod/html/secmod17.asp

(forms auth and sql)

Glad to help you out more when u decide which direction to go

 

[TunaAdmiral]

Your responses set me on the right track!

Thanks for taking the time to respond!

Excelsior!

Mikeymac