File Authorization

for RuBoard

Now that you know how users are authenticated, you need to control what resources they have access to. File authorization is the method of authorization that existed in ASP.old and migrates forward in ASP.NET.

NOTE

File authorization is the only method of authorization that IIS supports. If Allow Anonymous is off in IIS, authorization is handled by IIS. If Allow Anonymous is on, ASP.NET applies File Authorization.

File Authorization utilizes Access Control Lists (ACLs) to specify the roles that a user must be in to access a file. After the user has been authenticated, the File Authorization module will take each group in the ACL for a file and call IsInRole() on the passing of the name of the group as a parameter to IsInRole() . If IsInRole() returns true, the user is permitted to access the resource. If the File Authorization module iterates across each group in the ACL and never receives a true response from IsInRole() , the user is asked to authenticate again.

File Authorization will work with any type of authentication as long as the principal is populated with the applicable roles as part of the authentication process.

for RuBoard