I am working on a project where we need to provide an interface for an Administrator to configure authorization for a website. For example, the Administrator would like to restrict the Settings folder to everyone in role "abc", but next week wants to include role "def". Normally if I were to secure a website I would add security trimmings in the web.sitemap file for the Roles that can view a particular link. I would also configure the web.config file with the following tag to restrict access to a particular URL
<location path="Admin/Settings.aspx">
<system.web>
<authorization>
<allow roles="Domain\Administrators" />
<deny users="*" />
</authorization>
</system.web>
</location>
Since the administrator would like to control who has access to what, I will no longer be able to create these Location tags in the Web.config file since ever ...
Go to the complete details ...