role management

Hi I have an application in which admin users have two roles and few of them have only one role. how do I secure the folders in the adminn side based on the roles as they would be having two roles?

 

I tried this
<location path="Administrator">
<system.web>

<authorization >

<allow roles="ADMIN, manager"/>

<deny users="*"/>

</authorization>

</system.web>

</location>-->

 

but this does not work. It never lets the admin to the admin section of the site. Any help would be appreciated
...