Take the 2-minute tour ×

How can I configure ELMAH to display only for certain people without default ASP.NET authorization roles manager?

I (as well as many others, I think) use my own authorization logic and build my projects from zero without using provided templates. I want to log errors but it seems that it is impossible to configure ELMAH (somehow override functionality) to make it work with some other authorization or even to make it work only for particular IP addresses.

Since I will have access to web.config I tried to change these values in order to NOT display elmah by default.

<add key="elmah.mvc.requiresAuthentication" value="false" />

And when I want to view errors switch them from true to false and see errors, then switch back. But it seems that when I change these values all logs are erased.

What can I do?

share|improve this question
Allowing users access by username doesn't work? If, on login, you set an authentication cookie with something like FormsAuthentication.RedirectFromLoginPage it should work. In your custom authorization, do you set people in roles? –  MikeSmithDev Jan 23 '13 at 14:07
@MikeSmithDev I'm not even using Roles or Cookies. I just have a admin page where user logs in and session is created. It's all done by me, no MS code. –  Steve Jan 23 '13 at 14:14
add comment

2 Answers

up vote 5 down vote accepted

I think the easiest approach would be to make some minor alterations to your custom authorization so the ELMAH authorization will work.

Option 1: Set the FormsAuthentication cookie on login. This way, in the web.config the allow users="username" should work. On successful login you can set the cookie with FormsAuthentication.SetAuthCookie(theUsername, true).

The ELMAH authorization would look something like:

         <allow users="theUserName" />
         <deny users="*" />
  ...other config settings

Option 2: If you are using putting users into roles, you can override the default role provider to use the function you made to get roles. This way is a little more involved but then lets you harness role-basing authentication in the web.config, which is really nice for securing things like static file (.pdf etc) delivery. I can add code for this if interested.

share|improve this answer
Works. It really does not care for username tho. But whatever, at least now only when you log in to admin panel session is created and only then you can view /elmah. Thanks. –  Steve Jan 23 '13 at 14:33
add comment

It doesn't matter how the system gets the username or roles in this case. Whether it be from the built-in providers, a provider you implement yourself, or if during your custom authentication you populate this information yourself. All it takes is to manually set the principal during something like the Application_PostAuthenticationRequest event. This should give you the jist of it.

protected void Application_PostAuthenticateRequest(object sender, EventArgs e)
    //Obtain username and roles from application datastore and use them in the next line
    Thread.CurrentPrincipal = new GenericPrincipal(
        new GenericIdentity("userNameHere"),
        new string[] { "Admin", "CanDeleteStuff", "CanEditStuff", "OtherRole" }

This will let you use something like this in your web.config

      <allow roles="Elmah"/>
      <deny users="*"/>

Not to mention being able to use User.IsInRole("CanEditStuff") in your code.

share|improve this answer
add comment

Your Answer


