There are two primary reasons for creating a custom role provider; they are:
- You need to store role information in a data source that is not supported by the role providers included with the .NET Framework, such as a FoxPro database, an Oracle database, or other data source.
- You need to manage role information using a database schema that is different from the database schema used by the providers that ship with the .NET Framework. A common example of this would be authorization data that already exists in a SQL Server database for a company or web site.
To create a Custom Role provider, please use the following procedure.
1. Create a class (named CustomRoleProvider.cs) that inherits the RoleProvider abstract class from the System.Web.Security namespace and implements all the required methods.
public class CustomRoleProvider: RoleProvider
{
public override bool IsUserInRole(string username, string roleName)
{
throw new System.NotImplementedException();
}
public override string[] GetRolesForUser(string username)
{
throw new System.NotImplementedException();
}
public override void CreateRole(string roleName)
{
throw new System.NotImplementedException();
}
public override bool DeleteRole(string roleName, bool throwOnPopulatedRole)
{
throw new System.NotImplementedException();
}
public override bool RoleExists(string roleName)
{
throw new System.NotImplementedException();
}
public override void AddUsersToRoles(string[] usernames, string[] roleNames)
{
throw new System.NotImplementedException();
}
public override void RemoveUsersFromRoles(string[] usernames, string[] roleNames)
{
throw new System.NotImplementedException();
}
public override string[] GetUsersInRole(string roleName)
{
throw new System.NotImplementedException();
}
public override string[] GetAllRoles()
{
throw new System.NotImplementedException();
}
public override string[] FindUsersInRole(string roleName, string usernameToMatch)
{
throw new System.NotImplementedException();
}
public override string ApplicationName { get; set; }
}
2. Now implement your own logic for the following methods:
-
string[] GetAllRoles()
-
string[] GetRolesForUser(string userName)
-
bool IsUserInRole(string username, string roleName)
-
bool RoleExists(string roleName)
| GetAllRoles() |
This method get all roles for the System. |
| GetRolesForUser() |
This method gets the role of the current logged in user |
| IsUserInRole() |
This method checks weather a specified user belongs to the specified role or not |
| RoleExists() |
This method checks weather the given role exists in the system or not. |
3. Change the logic for the following methods.
This method returns all the roles in the system.
public override string[] GetAllRoles()
{
var userRoleList= new UserRoleDataGateway().GetAllUserRole();
var userRole = new string[3];
var i = 0;
foreach (var userRoleData in userRoleList)
{
userRole[i] = userRoleData.RoleName;
i++;
}
return userRole;
}
This method returns the role for the given user. This method will be called by the Authorization module.
public override string[] GetRolesForUser(string userName)
{
var userData = new UserProfileDataGateway().GetUserProfileInformation(userName);
var userRole = userData.Role;
if (!string.IsNullOrEmpty(userRole))
{
return new[] { userRole };
}
return new[] { "visitor" };//dummy
}
This method returns true/false depending on the role of the user.
public override bool IsUserInRole(string username, string roleName)
{
var roles = GetRolesForUser(username);
foreach (var role in roles)
{
if (role.Equals(roleName))
{
return true;
}
}
return false;
}
This method gets all system roles.
public override bool RoleExists(string roleName)
{
var roles = GetAllRoles();
foreach (string role in roles)
{
if (role.Equals(roleName))
{
return true;
}
}
return false;
}
4. Now in your web.config add the following:
<system.web>
<roleManager defaultProvider="CustomRoleProvider" enabled="true">
<providers>
<clear/>
<add name="CustomRoleProvider" type="DemoApplication.CustomRoleProvider"
applicationName="DemoApplication" writeExceptionsToEventLog="false"/>
</providers>
</roleManager>
</system.web>
5. To verify, you can set role based access in web.config for a specified page as shown below.
<location path="UserDetails.aspx">
<system.web>
<authorization>
<allow roles="Super Admin, Admin, Employee"/>
<deny roles="visitor"/>
<deny users="?"/>
</authorization>
</system.web>
</location>
You can do this in each Page level by calling the IsUserInRole() method every time. Instead you can set it directly in the web.config file.