title: Authorization Asp.net web.config
body: <p>I have an application that has a backoffice.
  This backoffice was isolated with the use of roles like this:</p>
  
  <pre><code>&lt;location path="backoffice"&gt;
      &lt;system.web&gt;
          &lt;authorization&gt;
              &lt;allow roles="admin"/&gt;
              &lt;deny users="*"/&gt;
          &lt;/authorization&gt;
      &lt;/system.web&gt;
  &lt;/location&gt;
  </code></pre>
  
  <p>But now we have another type of role that needs access. The companyadmin role.</p>
  
  <p>Can I just say?:</p>
  
  <pre><code> &lt;location path="backoffice"&gt;
          &lt;system.web&gt;
              &lt;authorization&gt;
                  &lt;allow roles="admin,companyadmin"/&gt;
                  &lt;deny users="*"/&gt;
              &lt;/authorization&gt;
          &lt;/system.web&gt;
      &lt;/location&gt;
  </code></pre>