Roles not working the way I expected.... any help appreciated.

[rob lynch]

web.config
<system.web>
<authorization>
<deny users="?"/>
<allow roles="Members"/>
</authorization>
</system.web>

What I want is for only members of the Members Role to have access to the
directory, however authenticated users who are not in this role can access
the site.

I have tried changing the role to Admin, but that still doen't work. Am I
misssing something simple?

Do I need to actually check the group at the page level?

If so, why have the option in the web.config?

I did see a Deny for the role, but that only works if the member is part of
a role as it doesn't like wildcards or empty strings. Which lets the evil
individual who isn't a member of a role access to the directory.

Asp ver 2.0


TIA


Rob

 

[Dominick Baier [DevelopMentor]]

append a

<deny users="*" /> at the end....

http://www.leastprivilege.com/ASPNETAuthorizationSettings.aspx

 

[rob lynch]

Dominick,

Thank you!

I had deny users=* before the role earlier and that seemed to block all

Again, Thanks!!!!


Rob