Using Roles in ASP.NET

Question

In the asp.net web application, I limited user actions based on their roles, for example:

I created three tables in the database

Tables

Table: Users

UserID Username Password
1 Bob password1
2 Scott password2
3 Jisun password3
4 Sam password4
5 John password5

Table: Groups

GroupID Name
1 Administrators
2 Clerk
3 Manager
4 Cashier

Table: Roles

UserID GroupID
1 1
2 2
2 3
3 4
4 3
4 4

In the Global.asax file, I wrote the following

Sub Application_AuthenticateRequest(sender As Object, e As EventArgs)
    If Request.IsAuthenticated Then
        'Determine this user roles
        Dim reader As SqlDataReader = _
              SqlHelper.ExecuteReader(connection string, _
              CommandType.StoredProcedure, "rolesForUser", _
              New SqlParameter("@Username", User.Identity.Name))

        ' Create an array of role names
        Dim roleList As New ArrayList
        Do While reader.Read()
            roleList.Add(reader("Name"))
        Loop

        'Convert the roleList ArrayList to a String array
        Dim roleListArray As String() = roleList.ToArray(GetType(String))

        'Add the roles to the User Principal
        HttpContext.Current.User = _
             New GenericPrincipal(User.Identity, roleListArray)
    End If
End Sub

And in the asp.net code file the following code

If User.IsInRole("Administrator") then
  ' Display sensitive material
ElseIf User.IsInRole("Clerk") then
  ' Display moderately sensitive material
Else
  ' Display only bland material
End If

currently working fine. Now a new requirement has drawn attention to allow the clerk to access some (but not all) of the functions performed by the administrator.

Do I need to change the source code to provide the above new requirement?

Is it necessary to do the same thing again and again when this requirement arises in the future?

or any other best way that I can do, please suggest me.

Answer 1

Robin Day, , , - , , , "". (, , ..), , .. , .

, ASP.NET( SqlRoleProvider) ?

Answer 2

, , - asp.net.

, "" , .

, , .

Answer 3

ASP.NET 2.0 , . : ASP.NET.

, . , .

, : , aspnetdb.mdf.

Answer 4

, ASP.NET. , " ", . , ( SiteMapProvider) .

Answer 5

( ) . , , .

, , " ". , . , "--", .

Answer 6

, , , . , , - .

  If Authorizer.UserHasAccessToFunctionality(user, "Sensitive") Then
    ' Display sensitive material     
  Else If ...

:

public Shared Function UserHasAccessToFunctionality(user as IPrincipal, _
   functionality as string) as Boolean
     functionalities = Authorizationrepository.GetFunctionalityForRoles(user.Roles)
     Return functionalities.Contains(functionality)
  End Function

AuthorizationRepository , .

,

:

ID Name
1  Sensitive
2  Protected
3  Public

: RoleFunctionality

Role Functionality
1    1
1    2
2    2
3    3