Problem with web.config inheritance and <authorization> section

[Max2006]

Hi,

I have the following tags in my root web.config file:

<authorization>
<allow roles="RoleA,RoleB"/>
<deny users="*"/>
</authorization>

I also have a public folder in my application called "~/Public"

I like to put all publicly available aspx pages in the "~/Public" folder.
Here is what I have in the web.config file within "~/Public" folder:

<?xml version="1.0"?>
<configuration>
<appSettings/>
<connectionStrings/>
<system.web>
<authorization>
<allow users="*"/>
</authorization>
</system.web>
</configuration>
The problem is that none of pages in "~/Public" folder are available for
public users. I guess still thetag <deny users="*"/in root web.config is
in effect.

How can I make the pages within "~/Public" folder available for anonymous
users?

Any help would be appreciated,
Max

[Steven Cheng[MSFT]]

Hi Max,

Have you got the problem resolved? Based on my understanding, using a
web.config file in sub directory does be identical to using a <location>
section in root web.config. Also, I've performed some simple local test
and the public pages(in a sub folder mark with <allow users="*" / should
be visible to all users no matter how you configure authorization setting
in root web.config file. I think there maybe something else result to your
application's problem behavior.

You can also try a simple forms authentication application to see whether
you can duplicate the same issue.

Sincerely,

Steven Cheng

Microsoft MSDN Online Support Lead
This posting is provided "AS IS" with no warranties, and confers no rights.

[=?Utf-8?B?UXVpbmN5IEpvbmVz?=]

It certainly seems like the root authorization takes precedence - I too have
a web config with
<authorization>
<deny users="?" />
<allow users="*" />
</authorization>

and then

<!-- Allow public access to all files in the public folder-->
<location path="Public">
<system.web>
<authorization>
<allow users="*" />
</authorization>
</system.web>
</location>

None-the-less, I get a login form for pages in Public.

Removing the deny from the global authorization allows public access to the
pages in the Public folder, but also to pages in the root directory.

[Steven Cheng[MSFT]]

Hi Quincy,

Thanks for your input.

Seems my test result is quite different. I've tried both approaches(using a
web.config file in sub folder and using the <locationelement to specify
sub folder setting), and in b oth cases, sub folder's authorization rules
will take precedence. And this is also the expected behavior. If you feel
necessary, I can send a test project to you.

Sincerely,

Steven Cheng

Microsoft MSDN Online Support Lead
This posting is provided "AS IS" with no warranties, and confers no rights.

[Steven Cheng[MSFT]]

Hi Max,

Any progress on this issue? If you still have any questions on this, please
feel free to post here.

Sincerely,

Steven Cheng

Microsoft MSDN Online Support Lead

This posting is provided "AS IS" with no warranties, and confers no rights.