1.Create a principle object which contains users identity
(login name) and array of roles
2.and pass this object to HttpContext.Current.User
3.The roles supplied to this object will be checked against 
roles specified in the web.config file,if they matched then 
they are allowed access to the page otherwise not.

allowed roles can be specified like this in web.config
<authorization>
<allow roles="Administrator,CanEdit"/>
<deny users="*" />
</authorization>