Requiring Authorization for a Single Subfolder

[Johnnie Norsworthy]

ASP.NET 2.0

How do I configure my web site to require forms authorization only for a
subfolder off the root? I know how to set Web.config for forms
authentication for the whole site, but I need the root folder to allow all
read access, and a single subfolder to require authorization.

Thanks for any assistance.

-Johnnie

[Juan T. Llibre]

This should work in your root web.config :

<location path="/">
<system.web>
<authorizatio n>
<allow users="*" />
</authorization>
</system.web>
</location>
<location path="/yoursubfolder">
<system.web>
<authorizatio n>
<allow users="?" />
</authorization>
</system.web>
</location>

Juan T. Llibre, ASP.NET MVP
ASP.NET FAQ : http://asp.net.do/faq/
ASPNETFAQ.COM : http://www.aspnetfaq.com/
Foros de ASP.NET en Español : http://asp.net.do/foros/
=============== =============== ========
"Johnnie Norsworthy" <jl****@verizon .net> wrote in message
news:u2******** ******@TK2MSFTN GP09.phx.gbl...

ASP.NET 2.0

How do I configure my web site to require forms authorization only for a subfolder off
the root? I know how to set Web.config for forms authentication for the whole site, but
I need the root folder to allow all read access, and a single subfolder to require
authorization.

Thanks for any assistance.

-Johnnie

[Johnnie Norsworthy]

"Juan T. Llibre" <no***********@ nowhere.com> wrote in message
news:uK******** ******@TK2MSFTN GP12.phx.gbl...

This should work in your root web.config :

<location path="/">
<system.web>
<authorizatio n>
<allow users="*" />
</authorization>
</system.web>
</location>
<location path="/yoursubfolder">
<system.web>
<authorizatio n>
<allow users="?" />
</authorization>
</system.web>
</location>

Thank you very very much Juan! I don't know where I missed that in the
documentation, because I sure looked for it awhile.

[Juan T. Llibre]

Don't get too excited, Johnnie.

I think I have a typo in the example I sent you,
and you still have to setup Forms Authorization for the subdirectory.

;-)

The typo is that the slash is not needed for the subdir, and I think you can even get
away without setting the location path for the main directory, by simply including :

<system.web>
<authorizatio n>
<allow users="*" />
</authorization>
</system.web>
<location path="/yoursubfolder">
<system.web>
<authenticati on mode="Forms" >
<forms loginUrl="login .aspx" name=".ASPNETAU TH" protection="Non e" path="/subdir"
timeout="20" >
</forms>
</authentication>

<authorizatio n>
<allow users="?" />
</authorization>
</system.web>
</location>

Test both modes...and let me know how it went.

See a complete example at this KB :

http://support.microsoft.com/default...b;en-us;316871

The difference in that example, of course, is that instead
of requiring authorization, it allows it with :

<allow users ="*" />

But using <allow users ="?" /> requires that the user be authenticated.

You still have to setup Forms authentication for that subdirectory, though.


Juan T. Llibre, ASP.NET MVP
ASP.NET FAQ : http://asp.net.do/faq/
ASPNETFAQ.COM : http://www.aspnetfaq.com/
Foros de ASP.NET en Español : http://asp.net.do/foros/
=============== =============== ========
"Johnnie Norsworthy" <jl****@verizon .net> wrote in message
news:%2******** *******@TK2MSFT NGP15.phx.gbl.. .

"Juan T. Llibre" <no***********@ nowhere.com> wrote in message
news:uK******** ******@TK2MSFTN GP12.phx.gbl...

This should work in your root web.config :

<location path="/">
<system.web>
<authorizatio n>
<allow users="*" />
</authorization>
</system.web>
</location>
<location path="/yoursubfolder">
<system.web>
<authorizatio n>
<allow users="?" />
</authorization>
</system.web>
</location>

Thank you very very much Juan! I don't know where I missed that in the documentation,
because I sure looked for it awhile.

[Johnnie Norsworthy]

Here is the Web.Config I used to make it work with some parts simplified:
<configuratio n xmlns="http://schemas.microso ft.com/.NetConfigurati on/v2.0">
<appSettings/>
<connectionStri ngs/>
<system.web>
<compilation debug="true">
<assemblies>
...
</assemblies>
</compilation>
<authenticati on mode="Forms">
<forms loginUrl="login .aspx">
<credentials passwordFormat= "Clear">
<user name="Test" password="Test"/>
</credentials>
</forms>
</authentication>
<authorizatio n>
<allow users="*"/>
</authorization>
<customErrors mode="RemoteOnl y" defaultRedirect ="error.htm" >
<error statusCode="403 " redirect="secur ity.htm"/>
<error statusCode="404 " redirect="missi ng.htm"/>
</customErrors>
</system.web>

<location path="customer" >
<system.web>
<authorizatio n>
<deny users="?"/>
</authorization>
</system.web>
</location>
</configuration>

Thanks for your help,
Johnnie