You can use the HttpModule and attach a handler to the AuthenticateRequest event. Inside the handler, use Regex to match the incoming request URL, and if it matches, check the roles of the user who is currently logged in. You can also configure it to read the configuration from Web.config, if you are after.
source share