<system.web>
  <authentication mode="Forms">
  <forms loginUrl="~/Login.aspx" timeout="5000" />
</authentication>
 </system.web>

<system.web>

  <authorization>
    <allow users="admin"/>
    <allow users="manager"/>
    <deny users="*"/>
  </authorization>
</system.web>

<div style="margin: 0 60px 0;">
                <label>
                   UserName:</label>
                <asp:TextBox ID="txtUserName" CssClass="text big" TabIndex="1"
                    runat="server"></asp:TextBox>
                <asp:RequiredFieldValidator ID="RFUsername" Display="None" runat="server" ControlToValidate="txtUserName"
                    ErrorMessage="Must enter a username"></asp:RequiredFieldValidator>
                <br />
                <label>
                  Password:</label><br />
                <asp:TextBox ID="txtPassword" CssClass="text big"  TabIndex="2"
                    runat="server" TextMode="Password"></asp:TextBox>
                <br />
                <asp:RequiredFieldValidator ID="RFPassword" runat="server" Display="None" ControlToValidate="txtPassword"
                    ErrorMessage="Password is mandatory"></asp:RequiredFieldValidator>



                    <asp:Button ID="btnLogin" runat="server" CssClass="submit" OnClick="btnLogin_Click"
                        TabIndex="4" />


            </div>

protected void btnLogin_Click(object sender, EventArgs e)
{
    lblLoginFail.Text = "";

    if (txtUserName.Text == "")
    {
        lblLoginFail.Text += "UserName is missing" + Environment.NewLine;
        lblLoginFail.Visible = true;
    }
    if (txtPassword.Text == "")
    {
        lblLoginFail.Text += "Password is missing" + "rn";
        lblLoginFail.Visible = true;
    }
    string role = system.CheckAdminLogin(txtUserName.Text, txtPassword.Text);
    if (role == Role.admin.ToString() || role == Role.manager.ToString())
    {
        Users _user = _users.GetUserByUserName(txtUserName.Text);

            FormsAuthentication.SetAuthCookie(role, false);
            Session.Add("UserName", txtUserName.Text);
            Session.Add("UserID", _user.ID);
            Response.Redirect("System/ShowActivities.aspx");

    }
    else
    {
        if (txtPassword.Text != "" && txtUserName.Text != "")
        {
            lblLoginFail.Text = Application["Wrong_login_data"].ToString();
            lblLoginFail.Visible = true;
        }
    }
}