title: How can I limit asp.net control actions based on user role?
body: <p>I have several pages or views in my application which are essentially the same for both authenticated users and anonymous users.  I'd like to limit the insert/update/delete actions in formviews and gridviews to authenticated users only, and allow read access for both authed and anon users.</p>
  
  <p>I'm using the asp.net configuration system for handling authentication and roles.  This system limits access based on path so I've been creating duplicate pages for authed and anon paths.</p>
  
  <p>The solution that comes to mind immediately is to check roles in the appropriate event handlers, limiting what possible actions are displayed (insert/update/delete buttons) and also limiting what actions are performed (for users that may know how to perform an action in the absence of a button.)  However, this solution doesn't eliminate duplication - I'd be duplicating security code on a series of pages rather than duplicating pages and limiting access based on path; the latter would be significantly less complicated.</p>
  
  <p>I could always build some controls that offered role-based configuration, but I don't think I have time for that kind of commitment right now.</p>
  
  <p>Is there a relatively easy way to do this (do such controls exist?) or should I just stick to path-based access and duplicate pages?</p>
  
  <p>Does it even make sense to use two methods of authorization?  There are still some pages which are strictly for either role so I'll be making use of path-based authorization anyway.</p>
  
  <p>Finally, would using something other than path-based authorization be contrary to typical asp.net design practices, at least in the context of using the asp.net configuration system?</p>