2003 Server Ignoring Forms Authentication (ASP.NET 2.0)

[Mark Milley]

Hi All -

I'm an MCAD and I've got a real head-scratcher here.

I've created a ASP.NET Web Application for a client that
essentially is a wrapper for SQL Reporting Services (they wanted a
custom security model). The application uses ASP.NET 2.0 and forms
authentication to lock down the site. I've used Forms Authentication in
the past and have never had the problem I'm about to describe.

The site works perfectly on my development machine, but after
uploading it to the server, the server completely ignores the forms
authentication, allowing anyone to access any page in the site. The
site works otherwise exactly as it should--no code errors, nothing.

Here is the pertinent information about the server:

Windows 2003 Server
ASP.NET 1.1 is used by default
ASP.NET 2.0 is installed and functional for this application
It has SQL Reporting Services 2005 and Great Plains Portal
installed (which uses Sharepoint--I have already excluded the
application path using stsadm)

From the logon script, the page does the correct database check
and sets the cookie, however, somehow the user is never actually logged
on. I have a logonview control in the master page file and the loggedon
template never appears, but I am given access to the full site.

Accessing a locked-down page without logging on is granted, as if
the web config files weren't set correctly, but I have a web config
file inside each folder preventing anonymous users.

Any Ideas?

-Mark

[Joey]

What do you mean...asp.net 1.1 is used by default? I think that you
must set IIS to run asp.net 2.0 (and then reboot afterwards) before
your app can run properly. Folks, feel free to correct me if I am
wrong...

Mark Milley wrote:

Hi All -

I'm an MCAD and I've got a real head-scratcher here.

I've created a ASP.NET Web Application for a client that
essentially is a wrapper for SQL Reporting Services (they wanted a
custom security model). The application uses ASP.NET 2.0 and forms
authentication to lock down the site. I've used Forms Authentication in
the past and have never had the problem I'm about to describe.

The site works perfectly on my development machine, but after
uploading it to the server, the server completely ignores the forms
authentication, allowing anyone to access any page in the site. The
site works otherwise exactly as it should--no code errors, nothing.

Here is the pertinent information about the server:

Windows 2003 Server
ASP.NET 1.1 is used by default
ASP.NET 2.0 is installed and functional for this application
It has SQL Reporting Services 2005 and Great Plains Portal
installed (which uses Sharepoint--I have already excluded the
application path using stsadm)

From the logon script, the page does the correct database check
and sets the cookie, however, somehow the user is never actually logged
on. I have a logonview control in the master page file and the loggedon
template never appears, but I am given access to the full site.

Accessing a locked-down page without logging on is granted, as if
the web config files weren't set correctly, but I have a web config
file inside each folder preventing anonymous users.

Any Ideas?

-Mark

[Mark Milley]

No, you CAN have mutiple instance of the framework being used by IIS.

After installing the .NET Framework 2.0, you simply use
C:\WINDOWS\Microsoft.NET\Framework\v2.0.xxxx\aspne t_regiis -i on a
particular virutal directory to install ASP.NET 2.0 to that folder, or,
you can install ASP.NET to the entire server (by not specifying a
path).

You can also do the opposite; if you have installed ASP.NET 2.0 to the
root (with recursion), you can specify asp.net 1.1 to a virtual
directory by using the aspnet_regiis in the v1.1.xxxx folder.

Thanks...

[Mark Milley]

Further Wierdness...

....It's not even sending the forms auth cookie to my browser. WTF???

[Joey]

Good to know. Thanks!

[Mark Milley]

Okay, this looks like some kind of bug. My best guess is that great
plains portal/sharepoint may be the culprit.

After I moved the application into it's own web site (instead of a web
application under the root) everything worked beautifully.