asp.net 2.0 problem...

Hi

I have an asp.net 2.0 project and am experiencing a problem.

In the project, I am trying to make use of Membership.

I have one Role, called "Basic User" and two users - "admin" and "test".

"admin" is a member of the Role but "test" is not.

I have only a few pages in the project at the moment: -

• SecurePage.aspx - The page I want only authenticated users that are members of the Role to use.

• Login.aspx - Login page

• Unauthorized.aspx - Informs user that they cannot view the secure page because of a lack of permissions

SecurePage.aspx just contains a ChangePassword control.

Unauthorized.aspx has some text and a LoginStatus control.

So in the SecurePage.aspx, I have this code to handle this: -

Protected Sub form1_Load(ByVal sender As Object, ByVal e As System.EventArgs)

If User.Identity.IsAuthenticated = False Then
Server.Transfer("login.aspx")
End If

If Roles.IsUserInRole("Basic User") = False Then
Server.Transfer("unauthorized.aspx")
End If

End Sub

If I go to the SecurePage and am not authenticated, it transfers me to login.aspx.

If I then login with the user "admin", which is in the Role "Basic User", it works ok.

If I first login with "test", which is NOT in the Role, then I am transfered to the "unauthorized.aspx" page.

However, if I click "Logout" on the LoginStatus control on the "unauthorized" page it refreshes and changes to display "Login".

So, if I then click "Login", I am taken back to the login page. The URL in the address bar at this point is: -

http://localhost:1489/Lesson09/login.aspx?ReturnUrl=%2funauthorized.aspx

If I then login with using "admin" - which is a member of the Role - this is where I get a problem.

Instead of being taken to the SecurePage.aspx as expected, I get taken back to the "unauthorized.aspx" page.

This is obviously wrong.

Now, I know that this should work but does anybody know why it is not working?

Is there some settings or something I need to change on my PC? Am I missing a step or not doing something?

I've checked the obvious things - like that the user was actually in the Role etc.

However, I just cannot get this to work.

I am new to ASP.Net and so I don't really know where to start to look for what the problem is?

I have gone through re-doing the project twice now and I still get the same problem.

For info, I am using: -

- Visual Studio .Net 2005 (Professional) (up to date)
- Latest .Net installed
- Windows XP Pro
- Internet Explorer 6 (version 6.0.2900.2180.xpsp_sp2_gdr.050301-1519) SP2

I would very much appreciate any help or advice on this problem.

Thanks in advance.

Kind regards
Darren Brook
Removed email address. The point of the forum is to keep the discussion here...

Well, you shouldn't have to write any code if you have the Membership and Roles set up properly. You should just be able to put entries in the web.config file and let that manage your security for you. Check the <authorization> section of web.config.

That being said, I see two things that could potentially be causing problems...
1. You're using Server.Transfer. That changes the page with out telling the browser. It still thinks you're on "SecurePage.aspx" regardless of what code got executed. Response.Redirect is a much better option in this case.

2. Based on the URL in the query string you're going to be taken to Unauthorized.aspx regardless of what page you want to go to. If you go to your login page with "ReturnUrl=%2funauthorized.aspx" you're going to get unauthorized. Are you checking security on unauthorized? That's normally the only time I see a URL like that one. Or are you clicking the login button from the unauthorized page? The order of events are important when doing something like this.

In any case this isn't anything you'll normally see in production. Most of your users should only have a single account. They won't be switching back and forth from an Admin, to Regular user account. Of course, that doesn't mean you shouldn't get it fixed anyway.

Hi. Thanks for the reply.

The project & code is actually from a training video and in the video you can actually see it working fine.

In the training video, the trainer actually does exactly the steps I mention in my original forum post, the only different being that it works for him!

If it works in the training video, it should work on my PC too.

But it does not work on my PC when I recreate the project OR when I try the actual corresponding source code the form the training site.

Any ideas?

Regards
Darren

no. if you're using their project directly, it should work the same on either machine. i can't think of anything that would cause different results based on what you're describing.

Being quite new to asp.net, I don't really know where to start looking.

But, it definitely is not working correctly on my machine.

Frustrating, and I don't know what to do!

Thanks for taking the time anyway - appreciated.

Darren