System.Web.Security Namespace

---

.NET Framework version 2.0

Gets role information for an ASP.NET application from Windows group membership.

WindowsTokenRoleProvider Class Members

Show Inherited Members

Constructors Visibility Constructor Parameters public WindowsTokenRoleProvider ( )   Properties Visibility Name Value Type Accessibility public ApplicationName String [ Get , Set ]   Methods Visibility Name Parameters Return Type public AddUsersToRoles ( String usernames , String roleNames ) Void public CreateRole ( String roleName ) Void public DeleteRole ( String roleName , Boolean throwOnPopulatedRole ) Boolean public FindUsersInRole ( String roleName , String usernameToMatch ) String public GetAllRoles ( ) String public GetRolesForUser ( String username ) String public GetUsersInRole ( String roleName ) String public Initialize ( String name , NameValueCollection config ) Void public IsUserInRole ( String username , String roleName ) Boolean public IsUserInRole ( String username , WindowsBuiltInRole role ) Boolean public RemoveUsersFromRoles ( String usernames , String roleNames ) Void public RoleExists ( String roleName ) Boolean

The WindowsTokenRoleProvider class is a read-only role-membership provider that retrieves role information for a Windows user based on Windows security groups. It is most useful with ASP.NET applications that use Windows authentication mode where the IIS authentication settings disable anonymous authentication. You can configure ASP.NET applications to allow or deny access based on a user's membership in a particular Windows group.

You cannot use the WindowsTokenRoleProvider class to create or delete roles or modify the membership of a role that is based on Windows group membership. This functionality is managed by the Windows operating system. The WindowsTokenRoleProvider class supports only the IsUserInRole and GetUsersInRole methods of the RoleProvider abstract class.

The following example shows the Web.config file for an ASP.NET application. It specifies that the application uses both Windows authentication and the WindowsTokenRoleProvider class to retrieve role information for Windows users. The authorization element specifies that only users in the BUILTIN\Administrators group are allowed access to the application.

<configuration>
   <system.web>
      <authentication mode = "Windows" />

      <authorization>
         <allow roles = "BUILTIN\Administrators" />
            <deny users = "*" />
         </authorization>

      <roleManager defaultProvider = "WindowsProvider" 
         enabled = "true"
         cacheRolesInCookie = "false">
         <providers>
            <add
               name = "WindowsProvider"
               type = "System.Web.Security.WindowsTokenRoleProvider" />
         </providers>
      </roleManager>

   </system.web>
</configuration>

ASP.NET Authorization   WindowsAuthenticationModule Class

Suggested Reading