Authentication & Subdirectories

[dmears1]

I have a login in page which authenticates against an Active Directory. It works well until I authenticate to a subdirectory (named "policies").
Here is my relevant code from my web.config:

...
<system.web>
     <authentication mode="Forms">
          <forms name=".ADAuthCookie" timeout="10" />
     </authentication>
</system.web>
<location path="policies">
     <system.web>
          <authorization>
               <deny users="?" />
          </authorization>
     </system.web>
</location>

Here is my login code:

Protected Sub btnLogin_Click(ByVal sender As Object, ByVal e As System.EventArgs)
          
        Dim domainProvider As MembershipProvider = Membership.Providers("AspNetActiveDirectoryMembershipProvider")
        
        If domainProvider.ValidateUser(txtUName.Text, txtPassword.Text) Then
            
            FormsAuthentication.SetAuthCookie(txtUName.Text, False)
            Response.Redirect("policies/testing.aspx")
            
        Else
            
            Response.Write("Invalid UserID and Password")
        
        End If
        
    End Sub

Any ideas as to why I can't authenticate to subdirectories would be greatly appreciated.

http://www.Morter.com

http://www.BestLifeTraining.com

http://www.AbsoluteStudio.com

 

[BrianB]

Who should be allowed into policies? You don't have anyone granted permission.

Brian Begy
BugSentry - Automatic error reporting for .NET and COM

http://www.bugsentry.com

 

[TipGiver]

The order makes difference. First always the allow users or roles(if you have role based login) and then the deny.

Also, you can have many web.config files.
Have one in the root, where you only set the forms authentication and nothing else.

<system.web>
     <authentication mode="Forms">
          <forms name=".ADAuthCookie" timeout="10" />
     </authentication>
</system.web>

To grant access to other pages (not on root), they must:
- be in a different subfolder
- and place in it a web.config file.

<authorization>
     <allow users="..., ..." roles="..., ..." />
     <deny users="*" />
</authorization>

 

[dmears1]

Hey Guys,
Thanks for the replies. I have

<authorization>
<deny users="?" />
</authorization>

in my config file, just forgot to add it to my post.

I did find the problem. The "policies" folder was setup as an app folder on IIS and was preventing us from passing session variables to it or to authenticate to it. I've got it working now. Thanks for the help.

http://www.Morter.com

http://www.BestLifeTraining.com

http://www.AbsoluteStudio.com