Requiring Authorization for a Single Subfolder

[Johnnie Norsworthy]

ASP.NET 2.0

How do I configure my web site to require forms authorization only for a
subfolder off the root? I know how to set Web.config for forms
authentication for the whole site, but I need the root folder to allow all
read access, and a single subfolder to require authorization.

Thanks for any assistance.

-Johnnie

[Juan T. Llibre]

This should work in your root web.config :

<location path="/">
<system.web>
<authorization>
<allow users="*" />
</authorization>
</system.web>
</location>
<location path="/yoursubfolder">
<system.web>
<authorization>
<allow users="?" />
</authorization>
</system.web>
</location>

Juan T. Llibre, ASP.NET MVP
ASP.NET FAQ : http://asp.net.do/faq/
ASPNETFAQ.COM : http://www.aspnetfaq.com/
Foros de ASP.NET en Español : http://asp.net.do/foros/
======================================
"Johnnie Norsworthy" <jl****@verizon.net> wrote in message
news:u2**************@TK2MSFTNGP09.phx.gbl...

ASP.NET 2.0

How do I configure my web site to require forms authorization only for a subfolder off
the root? I know how to set Web.config for forms authentication for the whole site, but
I need the root folder to allow all read access, and a single subfolder to require
authorization.

Thanks for any assistance.

-Johnnie

[Johnnie Norsworthy]

"Juan T. Llibre" <no***********@nowhere.com> wrote in message
news:uK**************@TK2MSFTNGP12.phx.gbl...

This should work in your root web.config :

<location path="/">
<system.web>
<authorization>
<allow users="*" />
</authorization>
</system.web>
</location>
<location path="/yoursubfolder">
<system.web>
<authorization>
<allow users="?" />
</authorization>
</system.web>
</location>

Thank you very very much Juan! I don't know where I missed that in the
documentation, because I sure looked for it awhile.

[Juan T. Llibre]

Don't get too excited, Johnnie.

I think I have a typo in the example I sent you,
and you still have to setup Forms Authorization for the subdirectory.

;-)

The typo is that the slash is not needed for the subdir, and I think you can even get
away without setting the location path for the main directory, by simply including :

<system.web>
<authorization>
<allow users="*" />
</authorization>
</system.web>
<location path="/yoursubfolder">
<system.web>
<authentication mode="Forms" >
<forms loginUrl="login.aspx" name=".ASPNETAUTH" protection="None" path="/subdir"
timeout="20" >
</forms>
</authentication>

<authorization>
<allow users="?" />
</authorization>
</system.web>
</location>

Test both modes...and let me know how it went.

See a complete example at this KB :

http://support.microsoft.com/default...b;en-us;316871

The difference in that example, of course, is that instead
of requiring authorization, it allows it with :

<allow users ="*" />

But using <allow users ="?" /> requires that the user be authenticated.

You still have to setup Forms authentication for that subdirectory, though.


Juan T. Llibre, ASP.NET MVP
ASP.NET FAQ : http://asp.net.do/faq/
ASPNETFAQ.COM : http://www.aspnetfaq.com/
Foros de ASP.NET en Español : http://asp.net.do/foros/
======================================
"Johnnie Norsworthy" <jl****@verizon.net> wrote in message
news:%2***************@TK2MSFTNGP15.phx.gbl...

"Juan T. Llibre" <no***********@nowhere.com> wrote in message
news:uK**************@TK2MSFTNGP12.phx.gbl...

This should work in your root web.config :

<location path="/">
<system.web>
<authorization>
<allow users="*" />
</authorization>
</system.web>
</location>
<location path="/yoursubfolder">
<system.web>
<authorization>
<allow users="?" />
</authorization>
</system.web>
</location>

Thank you very very much Juan! I don't know where I missed that in the documentation,
because I sure looked for it awhile.

[Johnnie Norsworthy]

Here is the Web.Config I used to make it work with some parts simplified:
<configuration xmlns="http://schemas.microsoft.com/.NetConfiguration/v2.0">
<appSettings/>
<connectionStrings/>
<system.web>
<compilation debug="true">
<assemblies>
...
</assemblies>
</compilation>
<authentication mode="Forms">
<forms loginUrl="login.aspx">
<credentials passwordFormat="Clear">
<user name="Test" password="Test"/>
</credentials>
</forms>
</authentication>
<authorization>
<allow users="*"/>
</authorization>
<customErrors mode="RemoteOnly" defaultRedirect="error.htm">
<error statusCode="403" redirect="security.htm"/>
<error statusCode="404" redirect="missing.htm"/>
</customErrors>
</system.web>

<location path="customer">
<system.web>
<authorization>
<deny users="?"/>
</authorization>
</system.web>
</location>
</configuration>

Thanks for your help,
Johnnie