I would like to show an "access denied" page when an authenticated
user tries to access a page for which they are not authorised
(role-based).

....I know there has been much discussion of this already, but can
anyone confirm:

1) that my understanding is correct that this can't be done in a
trivial way - and that the user will generally be redirected to a
log-in page instead

2) if there is a way to get at the role information for the requested
page so that I can implement the logic myself (ideally in a module) -
ideally this would not involved having to read and parse the
web.config file myself.

ta muchly,
Oliver.