Re: newbie: asp.net 2.0 security question



Create a location for default.aspx:

<location path="default.aspx">
<system.web>
<authorization>
<allow users="*"/>
</authorization>
</system.web>
</location>

That will solve the problem.

--
Gregory A. Beamer
MVP; MCP: +I, SE, SD, DBA

*************************************************
Think outside of the box!
*************************************************
"Jeff" <it_consultant1@xxxxxxxxxxxxxxxxxx> wrote in message
news:OhJvY%2322GHA.2228@xxxxxxxxxxxxxxxxxxxxxxx
Hey

asp.net 2.0

Below are some settings from my web.sitemap file and my web.config file.
With the current settings unathenticated users cannot view the
Default.aspx page. But I want unathenticated users to be able to view the
Default.aspx page.

web.sitemap:
<?xml version="1.0" encoding="utf-8" ?>
<siteMap xmlns="http://schemas.microsoft.com/AspNet/SiteMap-File-1.0"; >
<siteMapNode url="Default.aspx" title="Home" description="">
<siteMapNode url="~/SecTest.aspx" title="Test" description="" >
</siteMapNode>
... more sitemap nodes

web.config:
<authentication mode="Forms">
<forms cookieless="AutoDetect"
loginUrl="~/AccessDenied.aspx"
name="TBHFORMAUTH" />
</authentication>
<authorization>
<deny users="?"/>
</authorization>

I tryed to modify the "Home" SiteMapNode to <siteMapNode
url="Default.aspx" roles="?" title="Home" description=""> but I get an
error saying that authorization rules cannot contain "?"

What is the best practice here to enable unathenticated users access to
the Default.aspx page?

Jeff





.



Relevant Pages

  • Re: Authorization based on roles or directory access?
    ... It would be fine if the <authorization> setting was only checked as an ... security check for nodes that I in the sitemap decided to show. ... to users in "Members" role. ...
    (microsoft.public.dotnet.framework.aspnet)
  • Re: User.IsInRole with * wildcard, web.sitemap etc.
    ... You don't specify any authorization requirements in web.sitemap!!! ... You use the <authorization> element in web.config for that - the sitemap just uses this information - and the role attribute in the sitemap file allows to override the information found in the authorization element for visual presentation. ...
    (microsoft.public.dotnet.framework.aspnet.security)
  • Re: Sitemap trimming with Forms auth (Active Directory)
    ... Sitemap will pick up these settings. ... The roles attribute in web.sitemap is ONLY for overriding the settings made in <authorization> ... Dim ticket As FormsAuthenticationTicket = ...
    (microsoft.public.dotnet.framework.aspnet.security)
  • Re: Authorization based on roles or directory access?
    ... Your authorization sections in the web.config file can specify a script ... But the roles attribute in the sitemap works for this authorization ... "For navigation node ...
    (microsoft.public.dotnet.framework.aspnet)