Secure and Unsecure Web Directories using Forms Authentication

[Billy Jacobs]

I have a website which has both secure and non-secure
pages. I want to uses forms authentication. How do I
accomplish this?

Originally I had my web.config file in the root with Forms
Authentication set up and it worked just fine. Then I
realized that I needed to have some pages unsecure.

I then created 2 directories. One named Secure and the
other named Public. I placed my web.config file in my
Secure Folder with Forms Authentication On and also placed
a web.config in the root with Authentication set to none
and allow users="*". Doing this I get the following error.

It is an error to use a section registered as
allowDefinition='MachineToApplication' beyond application
level. This error can be caused by a virtual directory not
being configured as an application in IIS.

If I make the Secure Directory an application in IIS I
don't get that error but I get a different error. It says
cannot load type CSEPP.Login.

If I remove the web.config from the secure directory and
also remove the application from the Secure Directory in
IIS it does run and displays any page within the Secure
Directory correctly but of course there is no
authentication without the web.config file in that
directory.

Please help. I know this is possible but don't remember
how to set it up properly.

Thanks,

Billy Jacobs

[Peter Huang [MSFT]]

Hi Billy,

You may take a look at the link below.
Forms Authentication Using An XML Users File
http://msdn.microsoft.com/library/de...us/cpguide/htm
l/cpconcookieauthenticationusinganxmlusersfile.asp

If you can not adduser in the example above, you may need to modify one of
the web.config as below.
[NOTE: <identity impersonate="true"/> will allow you to impersonate the
account you use to access the aspx page,
so that, you have write permission to the user.xml file, or you may need to
guarantee that the ASP_NET account has enough permission to
access the user.xml file]
<configuration>
<system.web>
<identity impersonate="true"/>
<authorization>
<allow users="*"/>
</authorization>
</system.web >
</configuration>

Did the example works for you?

Regards,
Peter Huang
Microsoft Online Partner Support
Get Secure! www.microsoft.com/security
This posting is provided "as is" with no warranties and confers no rights.
--------------------

Content-Class: urn:content-classes:message
From: "Billy Jacobs" <bi********@csa.com>
Sender: "Billy Jacobs" <bi********@csa.com>
Subject: Secure and Unsecure Web Directories using Forms Authentication
Date: Thu, 11 Sep 2003 15:28:38 -0700
Lines: 36
Message-ID: <06****************************@phx.gbl>
MIME-Version: 1.0
Content-Type: text/plain;
charset="iso-8859-1"
Content-Transfer-Encoding: 7bit
X-Newsreader: Microsoft CDO for Windows 2000
X-MimeOLE: Produced By Microsoft MimeOLE V5.50.4910.0300
Thread-Index: AcN4tAwIiQDIbifhTH6DG1udCyABfQ==
Newsgroups: microsoft.public.dotnet.general
Path: cpmsftngxa06.phx.gbl
Xref: cpmsftngxa06.phx.gbl microsoft.public.dotnet.general:108209
NNTP-Posting-Host: TK2MSFTNGXA11 10.40.1.163
X-Tomcat-NG: microsoft.public.dotnet.general

I have a website which has both secure and non-secure
pages. I want to uses forms authentication. How do I
accomplish this?

Originally I had my web.config file in the root with Forms
Authentication set up and it worked just fine. Then I
realized that I needed to have some pages unsecure.

I then created 2 directories. One named Secure and the
other named Public. I placed my web.config file in my
Secure Folder with Forms Authentication On and also placed
a web.config in the root with Authentication set to none
and allow users="*". Doing this I get the following error.

It is an error to use a section registered as
allowDefinition='MachineToApplication' beyond application
level. This error can be caused by a virtual directory not
being configured as an application in IIS.

If I make the Secure Directory an application in IIS I
don't get that error but I get a different error. It says
cannot load type CSEPP.Login.

If I remove the web.config from the secure directory and
also remove the application from the Secure Directory in
IIS it does run and displays any page within the Secure
Directory correctly but of course there is no
authentication without the web.config file in that
directory.

Please help. I know this is possible but don't remember
how to set it up properly.

Thanks,

Billy Jacobs

[Billy Jacobs]

This does not answer my question.

Please read it more carefully.

I need 2 web.config files. It is my understanding that it
is ok to have a web.config in multiple directories and
that the settings in the subdirectory web.config file
overrides the web.config file in the parent directory for
the subdirectory.

At the root of my web app and all folders EXCEPT
the "Secure" Folder I don't need forms authentication. I
need forms authentication in the Secure Directory Only.

Thanks,

Billy Jacobs

-----Original Message-----
Hi Billy,

You may take a look at the link below.
Forms Authentication Using An XML Users File
http://msdn.microsoft.com/library/default.asp? url=/library/en-us/cpguide/html/cpconcookieauthenticationusinganxmlusersfile.asp

If you can not adduser in the example above, you may need to modify one ofthe web.config as below.
[NOTE: <identity impersonate="true"/> will allow you to impersonate theaccount you use to access the aspx page,
so that, you have write permission to the user.xml file, or you may need toguarantee that the ASP_NET account has enough permission toaccess the user.xml file]
<configuration>
<system.web>
<identity impersonate="true"/>
<authorization>
<allow users="*"/>
</authorization>
</system.web >
</configuration>

Did the example works for you?

Regards,
Peter Huang
Microsoft Online Partner Support
Get Secure! www.microsoft.com/security
This posting is provided "as is" with no warranties and confers no rights.--------------------

Content-Class: urn:content-classes:message
From: "Billy Jacobs" <bi********@csa.com>
Sender: "Billy Jacobs" <bi********@csa.com>
Subject: Secure and Unsecure Web Directories using Forms AuthenticationDate: Thu, 11 Sep 2003 15:28:38 -0700
Lines: 36
Message-ID: <06****************************@phx.gbl>
MIME-Version: 1.0
Content-Type: text/plain;
charset="iso-8859-1"
Content-Transfer-Encoding: 7bit
X-Newsreader: Microsoft CDO for Windows 2000
X-MimeOLE: Produced By Microsoft MimeOLE V5.50.4910.0300
Thread-Index: AcN4tAwIiQDIbifhTH6DG1udCyABfQ==
Newsgroups: microsoft.public.dotnet.general
Path: cpmsftngxa06.phx.gbl
Xref: cpmsftngxa06.phx.gbl microsoft.public.dotnet.general:108209NNTP-Posting-Host: TK2MSFTNGXA11 10.40.1.163
X-Tomcat-NG: microsoft.public.dotnet.general

I have a website which has both secure and non-secure
pages. I want to uses forms authentication. How do I
accomplish this?

Originally I had my web.config file in the root with FormsAuthentication set up and it worked just fine. Then I
realized that I needed to have some pages unsecure.

I then created 2 directories. One named Secure and the
other named Public. I placed my web.config file in my
Secure Folder with Forms Authentication On and also placeda web.config in the root with Authentication set to none
and allow users="*". Doing this I get the following error.
It is an error to use a section registered as
allowDefinition='MachineToApplication' beyond applicationlevel. This error can be caused by a virtual directory notbeing configured as an application in IIS.

If I make the Secure Directory an application in IIS I
don't get that error but I get a different error. It sayscannot load type CSEPP.Login.

If I remove the web.config from the secure directory and
also remove the application from the Secure Directory in
IIS it does run and displays any page within the Secure
Directory correctly but of course there is no
authentication without the web.config file in that
directory.

Please help. I know this is possible but don't remember
how to set it up properly.

Thanks,

Billy Jacobs

.

[Peter Huang [MSFT]]

Hi Billy,

I modify the example I refer in my last post.
This is my directory structure in the IIS configuration.[I move the files
in the root to the Logon directory for demostrating your question]
http://localhost/Test-------AddUser Web.config [This one will make the
directory visited free, note it as webconfig1, unsecure]
|--------Logon Web.config [This one will make
the directory visited with form authentication, note it as webconfig2,
secure]
[Test, AddUser and Logon directories are all configured as an application
in IIS.]
[NOTE, the AddUser and Logon are the alias names that you set when you
confugured a virtual directory
And the webconfig in the AddUser virtual directory will be read , as it is
unsecure config(webconfig1), then all the aspx page in the virtual
directory will be free visited
similarly, the webconfig in the Logon virtual directory will be read , as
it is secure config(webconfig2), then all the aspx page in the virtual
directory will be visited with authentication.]

[webconfig1]
<configuration>
<system.web>
<identity impersonate="true"/>
<authorization>
<allow users="*"/>
</authorization>
</system.web >
</configuration>

[webconfig2]
<configuration>
<system.web>
<authentication mode="Forms">
<forms loginUrl = "../adduser/adduser.aspx" name =
"FORMSAUTHCOOKIE"/>
</authentication>
<authorization>
<deny users="?"/>
</authorization>
</system.web>
</configuration>

You may try to modify the example I post last as what I have said to see if
it meet your question.
Did I misunderstand your meaning?

Regards,
Peter Huang
Microsoft Online Partner Support
Get Secure! www.microsoft.com/security
This posting is provided "as is" with no warranties and confers no rights.

--------------------

Content-Class: urn:content-classes:message
From: "Billy Jacobs" <bi********@csa.com>
Sender: "Billy Jacobs" <bi********@csa.com>
References: <06****************************@phx.gbl> <wS**************@cpmsftngxa06.phx.gbl>Subject: RE: Secure and Unsecure Web Directories using Forms Authentication
Date: Fri, 12 Sep 2003 09:30:58 -0700
Lines: 125
Message-ID: <1a****************************@phx.gbl>
MIME-Version: 1.0
Content-Type: text/plain;
charset="iso-8859-1"
Content-Transfer-Encoding: 7bit
X-Newsreader: Microsoft CDO for Windows 2000
Thread-Index: AcN5Sz8Df03oA781TQyUZyKJFEEbMg==
X-MimeOLE: Produced By Microsoft MimeOLE V5.50.4910.0300
Newsgroups: microsoft.public.dotnet.general
Path: cpmsftngxa06.phx.gbl
Xref: cpmsftngxa06.phx.gbl microsoft.public.dotnet.general:108306
NNTP-Posting-Host: TK2MSFTNGXA13 10.40.1.165
X-Tomcat-NG: microsoft.public.dotnet.general

This does not answer my question.

Please read it more carefully.

I need 2 web.config files. It is my understanding that it
is ok to have a web.config in multiple directories and
that the settings in the subdirectory web.config file
overrides the web.config file in the parent directory for
the subdirectory.

At the root of my web app and all folders EXCEPT
the "Secure" Folder I don't need forms authentication. I
need forms authentication in the Secure Directory Only.

Thanks,

Billy Jacobs

-----Original Message-----
Hi Billy,

You may take a look at the link below.
Forms Authentication Using An XML Users File
http://msdn.microsoft.com/library/default.asp?

url=/library/en-us/cpguide/htm

l/cpconcookieauthenticationusinganxmlusersfile.asp

If you can not adduser in the example above, you may need

to modify one of

the web.config as below.
[NOTE: <identity impersonate="true"/> will allow you to

impersonate the

account you use to access the aspx page,
so that, you have write permission to the user.xml file,

or you may need to

guarantee that the ASP_NET account has enough permission

to

access the user.xml file]
<configuration>
<system.web>
<identity impersonate="true"/>
<authorization>
<allow users="*"/>
</authorization>
</system.web >
</configuration>

Did the example works for you?

Regards,
Peter Huang
Microsoft Online Partner Support
Get Secure! www.microsoft.com/security
This posting is provided "as is" with no warranties and

confers no rights.

--------------------

Content-Class: urn:content-classes:message
From: "Billy Jacobs" <bi********@csa.com>
Sender: "Billy Jacobs" <bi********@csa.com>
Subject: Secure and Unsecure Web Directories using FormsAuthenticationDate: Thu, 11 Sep 2003 15:28:38 -0700
Lines: 36
Message-ID: <06****************************@phx.gbl>
MIME-Version: 1.0
Content-Type: text/plain;
charset="iso-8859-1"
Content-Transfer-Encoding: 7bit
X-Newsreader: Microsoft CDO for Windows 2000
X-MimeOLE: Produced By Microsoft MimeOLE V5.50.4910.0300
Thread-Index: AcN4tAwIiQDIbifhTH6DG1udCyABfQ==
Newsgroups: microsoft.public.dotnet.general
Path: cpmsftngxa06.phx.gbl
Xref: cpmsftngxa06.phx.gblmicrosoft.public.dotnet.general:108209NNTP-Posting-Host: TK2MSFTNGXA11 10.40.1.163
X-Tomcat-NG: microsoft.public.dotnet.general

I have a website which has both secure and non-secure
pages. I want to uses forms authentication. How do I
accomplish this?

Originally I had my web.config file in the root withFormsAuthentication set up and it worked just fine. Then I
realized that I needed to have some pages unsecure.

I then created 2 directories. One named Secure and the
other named Public. I placed my web.config file in my
Secure Folder with Forms Authentication On and alsoplaceda web.config in the root with Authentication set to none
and allow users="*". Doing this I get the followingerror.
It is an error to use a section registered as
allowDefinition='MachineToApplication' beyondapplicationlevel. This error can be caused by a virtual directorynotbeing configured as an application in IIS.

If I make the Secure Directory an application in IIS I
don't get that error but I get a different error. Itsayscannot load type CSEPP.Login.

If I remove the web.config from the secure directory and
also remove the application from the Secure Directory in
IIS it does run and displays any page within the Secure
Directory correctly but of course there is no
authentication without the web.config file in that
directory.

Please help. I know this is possible but don't remember
how to set it up properly.

Thanks,

Billy Jacobs

.

[Billy Jacobs]

After moving my files to my "Secure" and "Unsecure"
directory, if I make the directories Applications in IIS
then I get an error saying:

"Could not load type 'CSEPPPortal.Login'.

My Login.aspx was originally in the root then I moved it
to the secure folder.

Do you have any idea what may be causing this?

Billy Jacobs

-----Original Message-----
Hi Billy,

I modify the example I refer in my last post.
This is my directory structure in the IIS configuration. [I move the filesin the root to the Logon directory for demostrating your question]http://localhost/Test-------AddUser Web.config [This one will make thedirectory visited free, note it as webconfig1, unsecure]
|--------Logon Web.config [This one will makethe directory visited with form authentication, note it as webconfig2,secure]
[Test, AddUser and Logon directories are all configured as an applicationin IIS.]
[NOTE, the AddUser and Logon are the alias names that you set when youconfugured a virtual directory
And the webconfig in the AddUser virtual directory will be read , as it isunsecure config(webconfig1), then all the aspx page in the virtualdirectory will be free visited
similarly, the webconfig in the Logon virtual directory will be read , asit is secure config(webconfig2), then all the aspx page in the virtualdirectory will be visited with authentication.]

[webconfig1]
<configuration>
<system.web>
<identity impersonate="true"/>
<authorization>
<allow users="*"/>
</authorization>
</system.web >
</configuration>

[webconfig2]
<configuration>
<system.web>
<authentication mode="Forms">
<forms loginUrl = "../adduser/adduser.aspx" name ="FORMSAUTHCOOKIE"/>
</authentication>
<authorization>
<deny users="?"/>
</authorization>
</system.web>
</configuration>

You may try to modify the example I post last as what I have said to see ifit meet your question.
Did I misunderstand your meaning?

Regards,
Peter Huang
Microsoft Online Partner Support
Get Secure! www.microsoft.com/security
This posting is provided "as is" with no warranties and confers no rights.
--------------------

Content-Class: urn:content-classes:message
From: "Billy Jacobs" <bi********@csa.com>
Sender: "Billy Jacobs" <bi********@csa.com>
References: <06****************************@phx.gbl>

<wS**************@cpmsftngxa06.phx.gbl>

Subject: RE: Secure and Unsecure Web Directories using Forms AuthenticationDate: Fri, 12 Sep 2003 09:30:58 -0700
Lines: 125
Message-ID: <1a****************************@phx.gbl>
MIME-Version: 1.0
Content-Type: text/plain;
charset="iso-8859-1"
Content-Transfer-Encoding: 7bit
X-Newsreader: Microsoft CDO for Windows 2000
Thread-Index: AcN5Sz8Df03oA781TQyUZyKJFEEbMg==
X-MimeOLE: Produced By Microsoft MimeOLE V5.50.4910.0300
Newsgroups: microsoft.public.dotnet.general
Path: cpmsftngxa06.phx.gbl
Xref: cpmsftngxa06.phx.gbl microsoft.public.dotnet.general:108306NNTP-Posting-Host: TK2MSFTNGXA13 10.40.1.165
X-Tomcat-NG: microsoft.public.dotnet.general

This does not answer my question.

Please read it more carefully.

I need 2 web.config files. It is my understanding that itis ok to have a web.config in multiple directories and
that the settings in the subdirectory web.config file
overrides the web.config file in the parent directory forthe subdirectory.

At the root of my web app and all folders EXCEPT
the "Secure" Folder I don't need forms authentication. I
need forms authentication in the Secure Directory Only.

Thanks,

Billy Jacobs

-----Original Message-----
Hi Billy,

You may take a look at the link below.
Forms Authentication Using An XML Users File
http://msdn.microsoft.com/library/default.asp?

url=/library/en-us/cpguide/htm

l/cpconcookieauthenticationusinganxmlusersfile.asp

If you can not adduser in the example above, you may need

to modify one of

the web.config as below.
[NOTE: <identity impersonate="true"/> will allow you to

impersonate the

account you use to access the aspx page,
so that, you have write permission to the user.xml

file,or you may need to

guarantee that the ASP_NET account has enough

permissionto

access the user.xml file]
<configuration>
<system.web>
<identity impersonate="true"/>
<authorization>
<allow users="*"/>
</authorization>
</system.web >
</configuration>

Did the example works for you?

Regards,
Peter Huang
Microsoft Online Partner Support
Get Secure! www.microsoft.com/security
This posting is provided "as is" with no warranties and

confers no rights.

--------------------
Content-Class: urn:content-classes:message
From: "Billy Jacobs" <bi********@csa.com>
Sender: "Billy Jacobs" <bi********@csa.com>
Subject: Secure and Unsecure Web Directories using

FormsAuthentication

Date: Thu, 11 Sep 2003 15:28:38 -0700
Lines: 36
Message-ID: <06****************************@phx.gbl>
MIME-Version: 1.0
Content-Type: text/plain;
charset="iso-8859-1"
Content-Transfer-Encoding: 7bit
X-Newsreader: Microsoft CDO for Windows 2000
X-MimeOLE: Produced By Microsoft MimeOLE

V5.50.4910.0300Thread-Index: AcN4tAwIiQDIbifhTH6DG1udCyABfQ==
Newsgroups: microsoft.public.dotnet.general
Path: cpmsftngxa06.phx.gbl
Xref: cpmsftngxa06.phx.gbl

microsoft.public.dotnet.general:108209

NNTP-Posting-Host: TK2MSFTNGXA11 10.40.1.163
X-Tomcat-NG: microsoft.public.dotnet.general

I have a website which has both secure and non-secure
pages. I want to uses forms authentication. How do I
accomplish this?

Originally I had my web.config file in the root with

Forms

Authentication set up and it worked just fine. Then I
realized that I needed to have some pages unsecure.

I then created 2 directories. One named Secure and the
other named Public. I placed my web.config file in my
Secure Folder with Forms Authentication On and also

placed

a web.config in the root with Authentication set to noneand allow users="*". Doing this I get the following

error.

It is an error to use a section registered as
allowDefinition='MachineToApplication' beyond

application

level. This error can be caused by a virtual directory

not

being configured as an application in IIS.

If I make the Secure Directory an application in IIS I
don't get that error but I get a different error. It

says

cannot load type CSEPP.Login.

If I remove the web.config from the secure directory andalso remove the application from the Secure Directory inIIS it does run and displays any page within the SecureDirectory correctly but of course there is no
authentication without the web.config file in that
directory.

Please help. I know this is possible but don't rememberhow to set it up properly.

Thanks,

Billy Jacobs
.

.

[Peter Huang [MSFT]]

Hi Billy,

Have you try the example I refered in my last post, which works fine in my
machine? This will help me isolate the problem.

You may try to set the <location> of the web.config file. Here is a KB link.

Configuration <location> Settings
http://msdn.microsoft.com/library/de...us/cpguide/htm
l/cpconconfigurationlocationsettings.asp

INFO: ASP.NET Configuration Overview
http://support.microsoft.com/default...b;EN-US;307626

Here is a sample web.config.
<?xml version="1.0" encoding="utf-8" ?>
<configuration>
<system.web>
<authentication mode="Forms" >
<forms loginUrl="Admin/Login.aspx" name="AdminLogin" protection="None"
path="/" timeout="20" >
</forms>

</authentication>
</system.web>
<location path="Admin">
<system.web>
<authorization>
<deny users="?"/>
<allow users="*"/>
</authorization>
</system.web>
</location>

</configuration>

You may have a try and let me know if this works for you.

Regards,
Peter Huang
Microsoft Online Partner Support
Get Secure! www.microsoft.com/security
This posting is provided "as is" with no warranties and confers no rights.

--------------------

Content-Class: urn:content-classes:message
From: "Billy Jacobs" <bi********@csa.com>
Sender: "Billy Jacobs" <bi********@csa.com>
References: <06****************************@phx.gbl> <wS**************@cpmsftngxa06.phx.gbl>
<1a****************************@phx.gbl>
<U#*************@cpmsftngxa07.phx.gbl>Subject: RE: Secure and Unsecure Web Directories using Forms Authentication
Date: Mon, 15 Sep 2003 06:07:51 -0700
Lines: 249
Message-ID: <08****************************@phx.gbl>
MIME-Version: 1.0
Content-Type: text/plain;
charset="iso-8859-1"
Content-Transfer-Encoding: 7bit
X-Newsreader: Microsoft CDO for Windows 2000
X-MimeOLE: Produced By Microsoft MimeOLE V5.50.4910.0300
Thread-Index: AcN7il5raugSOvBFSp6snF+X4rv9qA==
Newsgroups: microsoft.public.dotnet.general
Path: cpmsftngxa07.phx.gbl
Xref: cpmsftngxa07.phx.gbl microsoft.public.dotnet.general:108218
NNTP-Posting-Host: tk2msftngxa12.phx.gbl 10.40.1.164
X-Tomcat-NG: microsoft.public.dotnet.general

After moving my files to my "Secure" and "Unsecure"
directory, if I make the directories Applications in IIS
then I get an error saying:

"Could not load type 'CSEPPPortal.Login'.

My Login.aspx was originally in the root then I moved it
to the secure folder.

Do you have any idea what may be causing this?

Billy Jacobs

-----Original Message-----
Hi Billy,

I modify the example I refer in my last post.
This is my directory structure in the IIS configuration.

[I move the files

in the root to the Logon directory for demostrating your

question]

http://localhost/Test-------AddUser Web.config [This

one will make the

directory visited free, note it as webconfig1, unsecure]
|--------Logon Web.config

[This one will make

the directory visited with form authentication, note it

as webconfig2,

secure]
[Test, AddUser and Logon directories are all configured

as an application

in IIS.]
[NOTE, the AddUser and Logon are the alias names that you

set when you

confugured a virtual directory
And the webconfig in the AddUser virtual directory will

be read , as it is

unsecure config(webconfig1), then all the aspx page in

the virtual

directory will be free visited
similarly, the webconfig in the Logon virtual directory

will be read , as

it is secure config(webconfig2), then all the aspx page

in the virtual

directory will be visited with authentication.]

[webconfig1]
<configuration>
<system.web>
<identity impersonate="true"/>
<authorization>
<allow users="*"/>
</authorization>
</system.web >
</configuration>

[webconfig2]
<configuration>
<system.web>
<authentication mode="Forms">
<forms loginUrl = "../adduser/adduser.aspx"

name =

"FORMSAUTHCOOKIE"/>
</authentication>
<authorization>
<deny users="?"/>
</authorization>
</system.web>
</configuration>

You may try to modify the example I post last as what I

have said to see if

it meet your question.
Did I misunderstand your meaning?

Regards,
Peter Huang
Microsoft Online Partner Support
Get Secure! www.microsoft.com/security
This posting is provided "as is" with no warranties and

confers no rights.

--------------------

Content-Class: urn:content-classes:message
From: "Billy Jacobs" <bi********@csa.com>
Sender: "Billy Jacobs" <bi********@csa.com>
References: <06****************************@phx.gbl>

<wS**************@cpmsftngxa06.phx.gbl>

Subject: RE: Secure and Unsecure Web Directories usingForms AuthenticationDate: Fri, 12 Sep 2003 09:30:58 -0700
Lines: 125
Message-ID: <1a****************************@phx.gbl>
MIME-Version: 1.0
Content-Type: text/plain;
charset="iso-8859-1"
Content-Transfer-Encoding: 7bit
X-Newsreader: Microsoft CDO for Windows 2000
Thread-Index: AcN5Sz8Df03oA781TQyUZyKJFEEbMg==
X-MimeOLE: Produced By Microsoft MimeOLE V5.50.4910.0300
Newsgroups: microsoft.public.dotnet.general
Path: cpmsftngxa06.phx.gbl
Xref: cpmsftngxa06.phx.gblmicrosoft.public.dotnet.general:108306NNTP-Posting-Host: TK2MSFTNGXA13 10.40.1.165
X-Tomcat-NG: microsoft.public.dotnet.general

This does not answer my question.

Please read it more carefully.

I need 2 web.config files. It is my understanding thatitis ok to have a web.config in multiple directories and
that the settings in the subdirectory web.config file
overrides the web.config file in the parent directoryforthe subdirectory.

At the root of my web app and all folders EXCEPT
the "Secure" Folder I don't need forms authentication. I
need forms authentication in the Secure Directory Only.

Thanks,

Billy Jacobs
-----Original Message-----
Hi Billy,

You may take a look at the link below.
Forms Authentication Using An XML Users File
http://msdn.microsoft.com/library/default.asp?
url=/library/en-us/cpguide/htm
l/cpconcookieauthenticationusinganxmlusersfile.asp

If you can not adduser in the example above, you mayneedto modify one of
the web.config as below.
[NOTE: <identity impersonate="true"/> will allow you to
impersonate the
account you use to access the aspx page,
so that, you have write permission to the user.xmlfile,or you may need to
guarantee that the ASP_NET account has enoughpermissionto
access the user.xml file]
<configuration>
<system.web>
<identity impersonate="true"/>
<authorization>
<allow users="*"/>
</authorization>
</system.web >
</configuration>

Did the example works for you?

Regards,
Peter Huang
Microsoft Online Partner Support
Get Secure! www.microsoft.com/security
This posting is provided "as is" with no warranties and
confers no rights.
--------------------
>Content-Class: urn:content-classes:message
>From: "Billy Jacobs" <bi********@csa.com>
>Sender: "Billy Jacobs" <bi********@csa.com>
>Subject: Secure and Unsecure Web Directories usingFormsAuthentication
>Date: Thu, 11 Sep 2003 15:28:38 -0700
>Lines: 36
>Message-ID: <06****************************@phx.gbl>
>MIME-Version: 1.0
>Content-Type: text/plain;
> charset="iso-8859-1"
>Content-Transfer-Encoding: 7bit
>X-Newsreader: Microsoft CDO for Windows 2000
>X-MimeOLE: Produced By Microsoft MimeOLEV5.50.4910.0300>Thread-Index: AcN4tAwIiQDIbifhTH6DG1udCyABfQ==
>Newsgroups: microsoft.public.dotnet.general
>Path: cpmsftngxa06.phx.gbl
>Xref: cpmsftngxa06.phx.gbl
microsoft.public.dotnet.general:108209
>NNTP-Posting-Host: TK2MSFTNGXA11 10.40.1.163
>X-Tomcat-NG: microsoft.public.dotnet.general
>
>I have a website which has both secure and non-secure
>pages. I want to uses forms authentication. How do I
>accomplish this?
>
>Originally I had my web.config file in the root with
Forms
>Authentication set up and it worked just fine. Then I
>realized that I needed to have some pages unsecure.
>
>I then created 2 directories. One named Secure and the
>other named Public. I placed my web.config file in my
>Secure Folder with Forms Authentication On and also
placed
>a web.config in the root with Authentication set tonone>and allow users="*". Doing this I get the following
error.
>
>It is an error to use a section registered as
>allowDefinition='MachineToApplication' beyond
application
>level. This error can be caused by a virtual directory
not
>being configured as an application in IIS.
>
>If I make the Secure Directory an application in IIS I
>don't get that error but I get a different error. It
says
>cannot load type CSEPP.Login.
>
>If I remove the web.config from the secure directoryand>also remove the application from the Secure Directoryin>IIS it does run and displays any page within theSecure>Directory correctly but of course there is no
>authentication without the web.config file in that
>directory.
>
>Please help. I know this is possible but don'tremember>how to set it up properly.
>
>Thanks,
>
>Billy Jacobs
>

.

.

[valmir cinquini]

Hi Peter,

I'm tracking your support to Billy. I have the same structure Billy
has, and I tryed your sugestion shown below in this message, with no
success.

My folder structure is
d:\conseg (unsecure) <-- only this one is configured as application
in IIS
d:\conseg\consegseguro (secure) <-- this one isn't

Do I need have both folder and sub-folder registered in IIS as
application? Can you figure out if I'm doing some stupid?

My web.config is the following (some lines where put in the same row
for short):
<?xml version="1.0" encoding="utf-8" ?>
<configuration>

<!-- this is for the application root folder -->
<system.web>
<compilation defaultLanguage="c#" debug="true" />
<customErrors mode="Off"/> <!--mode="RemoteOnly"/-->
<authentication mode="Windows" />
<trace enabled="false" requestLimit="10" pageOutput="false"
traceMode="SortByTime" localOnly="true" />
<sessionState mode="InProc"
stateConnectionString="tcpip=127.0.0.1:42424"
sqlConnectionString="data source=127.0.0.1;user id=sa;password="
cookieless="false" timeout="20" />
<globalization requestEncoding="utf-8" responseEncoding="utf-8"
/>
</system.web>

<!-- this is for the application secure sub-folder -->
<location path="consegseguro">
<system.web>
<authentication mode="Forms">
<forms loginUrl="logon.aspx" name="adAuthCookie" timeout="60">
<deny users="?"/>
<allow users="*"/>
</forms>
</authentication>
<identity impersonate="true"/>
</system.web>
</location>

</configuration>

I got this error

Parser Error Message: It is an error to use a section registered as
allowDefinition='MachineToApplication' beyond application level. This
error can be caused by a virtual directory not being configured as an
application in IIS.

Source Error:
Line 32: <system.web>
Line 33:
Line 34: <authentication mode="Forms">
Line 35: <forms loginUrl="logon.aspx" name="adAuthCookie"
timeout="60">
Line 36: <deny users="?"/>

Source File: D:\conseg\web.config Line: 34
I've tryed to use two separated web.config files, one for the unsecure
folder an another for the secure folder, but I got the same error.
Even configuring both folders as application in IIS. :>(

Thanks in advance


v-******@online.microsoft.com (Peter Huang [MSFT]) wrote in message news:<Fm**************@cpmsftngxa07.phx.gbl>...

Hi Billy,

Here is a sample web.config.
<?xml version="1.0" encoding="utf-8" ?>
<configuration>
<system.web>
<authentication mode="Forms" >
<forms loginUrl="Admin/Login.aspx" name="AdminLogin" protection="None"
path="/" timeout="20" >
</forms>

</authentication>
</system.web>
<location path="Admin">
<system.web>
<authorization>
<deny users="?"/>
<allow users="*"/>
</authorization>
</system.web>
</location>

</configuration>

You may have a try and let me know if this works for you.

Regards,
Peter Huang
Microsoft Online Partner Support
Get Secure! www.microsoft.com/security
This posting is provided "as is" with no warranties and confers no rights.