Role Based Security

See more:

C#3.0

C#

Hello experts,

I am writing a web application where i want to implement role based security with form authentication. But I do not want to use the ASPNETDB.MDF database so i created my user table which has these colomns: UserName, Password, Role.

I wrote a class below:

public bool Login()
{
    SqlConnection con = new SqlConnection(this.ConnectDB());
    SqlCommand cmd = new SqlCommand();
    SqlDataReader rdr = default(SqlDataReader);
    {
        cmd.CommandType = CommandType.StoredProcedure;
        cmd.CommandText = "sp_Login";
        cmd.Parameters.AddWithValue("@Password", Password);
        cmd.Parameters.AddWithValue("@Username", Username);
        cmd.Connection = con;
    }
    bool userfound = false;
    try 
    {
        con.Open();
        rdr = cmd.ExecuteReader();
        if (rdr.Read()) 
        {
            userfound = true;
            this.Role = rdr("Role");
        }
    }
    catch (Exception ex) 
    {
        msg = "Invalid Username or Password" + ex.Message.ToString();
    }
    finally 
    {
        con.Close();
    }
    return userfound;
}

In my LoginButon_Click event i used

Session("Role") = objlogin.Role;

but the role is save in the session, hence i cant restrict people who are not in particular role not to access some pages.

Please is there any better way i can do this without ASPNETDB.MDF database.