RE: Secure some pages and not other

From: Steven Cheng[MSFT] (v-schang_at_online.microsoft.com)
Date: 03/02/04 

Date: Tue, 02 Mar 2004 04:05:29 GMT

Hi Shimon,

Thanks for posting in the community!
>From your description, you're using the Formsauthentication in your ASP.NET
web app. And you've some different sets fo files in your web apps which are
protected from different groups of users(protected level). So you're
wanting how to set such multi-authroized configuration in a single ASP.NET
web app, yes?
If there is anything I misunderstood, please feel free to let me know.

Based on my experience, you may have a try on the <location> Element in the
web.config file. This element can help apply a certain sections of
configuration to a certain specified part of a web app(via url path). Here
are the referernce of the <location> Element in MSDN:

#<location> Element
http://msdn.microsoft.com/library/en-us/cpgenref/html/gngrflocationelement.a
sp?frame=true

As for your situation , you can put those different protected files into
several sub dirctories in the web app's root folder. Then use the
<location> Element to specify different authorization settings for these
sub directories. For example:
If we have a web app named MyApp(used formsauthentication) and has the
following folder hierarchy:
MyApp/
           ....public resources
          Admin/
           ....admin protected level resources
          User/
           ....normal user protected level resources

Then we can specify different authorization protections for them via t he
below configuration in web.config
<configuration>
   <system.web>
   <authentication mode="Forms">
      <forms name=".ASPNET_FORM_NAME" loginUrl="login.aspx" >
      </forms>
    </authentication>

      <authorization>
        <allow users="*" />
    </authorization>
   </system.web>
         
   <!¡ª Configuration for the "Sub1" subdirectory. -->
   <location path="Admin">
      <system.web>
          <authorization>
        ..... Authrozation for Admin
          </authorization>
      </system.web>
   </location>
   
   <!¡ª Configuration for the "Sub2" subdirectory. -->
   <location path="sub2">
      <system.web>
         <authorization>
        ..... Authrozation for Normal user

          </authorization>
      </system.web>
   </location>
</configuration>

In addition, here are some further tech references on how to apply
heirarchical configuration Inheritance in web.config:

#Configuration Inheritance
http://msdn.microsoft.com/library/en-us/cpguide/html/cpconconfigurationinher
itance.asp?frame=true

#Configuration <location> Settings
http://msdn.microsoft.com/library/en-us/cpguide/html/cpconconfigurationlocat
ionsettings.asp?frame=true

#Locking Configuration Settings
http://msdn.microsoft.com/library/en-us/cpguide/html/cpconlockingconfigurati
onsettings.asp?frame=true

Please refer to them if you feel anything unclear.

Regards,

Steven Cheng
Microsoft Online Support

Get Secure! www.microsoft.com/security
(This posting is provided "AS IS", with no warranties, and confers no
rights.)

Get Preview at ASP.NET whidbey
http://msdn.microsoft.com/asp.net/whidbey/default.aspx

Relevant Pages

  • Re: Secure some pages and not other
    ... > wanting how to set such multi-authroized configuration in a single ASP.NET ... > web app, yes? ... > Then we can specify different authorization protections for them via t he ... > heirarchical configuration Inheritance in web.config: ...
    (microsoft.public.dotnet.framework.aspnet)
  • Configuration block behavior in n-tier application
    ... I have an n- tier application where a web app calls a web service to ... The Web service is configured to use the data access block. ... the context object's configuration file property points to the web ... How do i specify that the context information should be obtained from ...
    (microsoft.public.dotnet.framework.aspnet)
  • Re: HELP! Really strange problem w/AD and LDAP/LDIFDE
    ... FYI, I've just sent off an email with my "analysis" of what may be going on in this one, particular environment. ... Some behavior which I/we haven't been able to identify with the way that AD handles simple LDAP binds, among the 3 different username formats. ... Re-configure things into a more "orthodox" configuration. ... In particular, I've suggested/recommended that they eliminate the "2nd AD", and let me point my web app at the "1st" AD/Domain controller, since this is how the other sites are configured. ...
    (microsoft.public.windows.server.active_directory)
  • Custom configuration section handlers with Namespaces
    ... conjunction with my web.config in an ASP.NET web app. ... While I can specify a namespace in my ConfigurationSectionHandler, ... Of course, I could make my configuration a little more general, and have ... But it seems a shame to have XML Namespaces, and not be able to use them! ...
    (microsoft.public.dotnet.framework.aspnet)
  • RE: half rendered page on first load :-( after refreshing everything is fine
    ... Thanks for posting in the community! ... Authentication setting? ... folders in that web app as protected from unauthenticated user's ... You may try change the FormsAuthenction web app to use "Windows" ...
    (microsoft.public.dotnet.framework.aspnet)