Location element in the Web.config file. Allow System Admin whole directory, allow others specific page

[Ryan Taylor]

Hello.

I am developing an ASP.net C# application using forms authentication. I have
a directory ManageUsers and I want all pages in that directory to be
accessed by the system administrator. But, there is one page,
ChangePassword.aspx that any authenticated user should be able to access.

How exactly does the location element assign permissions to directories and
pages? I thought that permissions would be applied in the order that the
location elements were defined in the web.config file. With the latest
location element defining the permissions.

The following is what I have attempted. But when the Change Password role is
assigned to the user, he/she is able to view all pages in the ManageUsers
directory and not just the ManageUsers/ChangePassword.aspx

<location path="ManageUsers" allowOverride="false">
<system.web>
<authorization>
<allow roles="System Administrator, Requesting Organization
Administrator, Responding Organization Administrator" />
<deny users="?" />
</authorization>
</system.web>
</location>

<location path="ManageUsers/ChangePassword.aspx" allowOverride="false">
<system.web>
<authorization>
<allow roles="Change Password, System Administrator, Requesting
Organization Administrator, Requesting Organization User, Responding
Organization Administrator, Responding Organization User" />
<deny users="?" />
</authorization>
</system.web>
</location>


Thanks in advance for any assistance.
Ryan Taylor

[Ryan Taylor]

I found that part of my problem was that I was allowing all authenticated
users access to the pages. So I replaced the '?' with a '*' and this solved
the problem I also moved the ChangePassword.aspx file to its own location
just to be thorough.

Ryan Taylor

[chandrabhan singh]

Hi,

I have a wired scenario in one of my ASP.net application.

I am using ASP.net membership with my custom "roleManager",

and having below tag in web.config to restrict any user not having role of "Keywords"(roles) to access "Keywords"(path) folder

<location path="Keywords">

<system.web>

<authorization>

<allow roles="Keywords"/>

<deny users="*" />

</authorization>

</system.web>

</location>

If any user with some other role allow to assess this URL (Keywords in this case) will be redirected to a custom- Access denied page.

Now things working fine but when I left my application with a inactivity of 30 min I am not able to visit the "Keywords", all the time I end up with the custom- Access denied page, if I close the browser, login again it start working fine.

Please help me in this case.

Thanks in advance