Beginning ASP.NET 4.5 in CSharp and VB Opsylum

The Role Manager x 635
Management section appear again. Next, log out again, log in with one of the other accounts, and
then try to access the Management folder again. Because that account doesn’t have permissions to
access that folder, you’re redirected to the Login page again.
How It Works
To see how this works, you need to look at a couple of things. First, look at the settings you added to
the Web.config file to limit access to the Management folder:
When the ASP.NET run time processes the request for a page, it checks the various configuration
files to see whether the current user is allowed to access that resource. For requests to files in the
Management folder, it encounters the rule set in the element. It starts scanning the various
allow and deny elements with roles or users attributes to specify the users or roles that are
affected by the rule. The roles and users attributes take one or more role or user names, separated
by a comma. As soon as a rule is found that matches, the scanning process is stopped and that rule is
applied. If no rule is satisfied, access is granted! Therefore, it’s important to end the rule with a deny
rule to block all other users that haven’t been granted access previously.
If you’d add an authorization element to the Web.config in the Management folder, the settings you
apply there are looked at first because the security model works inside out. That is, it starts by scanning
the Web.config file (if present) in the folder that contains the requested page. If it doesn’t find the file
there or it doesn’t contain settings that block or grant access, it goes up in the folder hierarchy searching
for configuration files with authorization elements. In the previous exercise, the run-time found the
settings in the Web.config file in the root that were then applied to the folder.
When an unauthenticated user logs in, the first rule won’t match because the anonymous user is not a
member of the Managers role. The user is then denied access because of the deny rule that blocks all
users, indicated by the asterisk (*).
After you logged in as a Manager and requested the same resource, the rule set was scanned again. The
run time then found the allow element that grants access to the Managers role and immediately let
you in. The final rule that blocks access to all other users was not even checked. In addition to specific
roles or usernames and the asterisk (*) to refer to all users, you can also use the question mark (?) to
refer to unauthenticated — or anonymous — users. So, for example, to let any logged-in user access the
Reviews folder regardless of the role they are in, and block access to all other users, you can add the
following element to your configuration file: