Conditional Login

acdsky · November 22nd, 2003, 11:17 AM

Hi

I have got a login page reading an table within an SQL database. What I need to do is to redirect users depening on certian criteria linked to that user. For example the user table would have the following fields - Username; Password; Company; Designation and depending on any combanation it should redirect it to a certian page.

At the moment I have something like this:

sql = "SELECT * FROM tUsers WHERE " & _
                 "UserName='" & Request.Form("UserName") & "' AND " & _
                 "UserPassword='" & Request.Form("UserPassword") & "' "

Set Rs = Cm.Execute(sql)

If Rs.EOF Then
   Session("Authenticated") = 0
   Response.Redirect ("../Customer login_error.asp")
Else
   Session("Authenticated") = 1
   Response.Redirect ("welcome.asp")
End If

Would this be possible using a single logon? If so please point me in the right direction...

Rgrds
M

Such is Life!

jacob · November 22nd, 2003, 11:58 AM

Couldn't you do something like this...

Code:

If Rs.EOF Then
   Session("Authenticated") = 0
   Response.Redirect ("../Customer login_error.asp")
Else
   Session("Authenticated") = 1
   Select Case Rs("Company")
     Case "First Company Inc."
       Response.Redirect ("first.asp")
     Case "Second Company Inc."
       Response.Redirect ("second.asp")
     Case Else
       Response.Redirect ("notfound.asp")
   End Select
End If

Is that what you mean!?
Another way to do it is to pass the company name, if that is what you want to branch on, in the URL and then handle the switch later...

Code:

If Rs.EOF Then
   Session("Authenticated") = 0
   Response.Redirect ("../Customer login_error.asp")
Else
   Session("Authenticated") = 1
   Response.Redirect ("show.asp?where=" & Rs("Company"))
End If

In both cases you have to make sure that the user is logged on when requesting the page to which he/she is redirected. You also have to handle the case where people try to e.g. hack the URL (last example), if you will not allow others to see other companies. The same actually also goes for the first example. Some unauthorized people could try different URLs etc. What I am trying to say is be careful!

Hope it helps

Jacob.

acdsky · November 25th, 2003, 11:59 AM

Yes, that is exactly what I am looking for my concern is like you said people guessing the URL.
I am using a check file but that only 0/1 irrespective of the company u belong to.
The only way I can see around the security issue is using asp.net and then use NTFS security to restrict access to folders.

Which is confusing me is having to check the company and then having to check if its a user or manager, would it be possible to nest another Case beneath the company check?

I will play around with it and see what I come up with

Thanks!
Marnus

Such is Life!