ASP.NET Security Roles AND Permissions

Question

I\'m comfortable with the ASP.NET security model whereby one can allow/deny access to users in the web.config based on what roles they are in e.g.

Answer 1

You could return PERMISSIONS instead of the ROLES in your RoleProvider.

public override string[] GetRolesForUser(string username) {
   return GetGrantedPermissions(userName);
}

Then create your admin pages to add {granted/denied} permissions to roles and of course users to roles.