Databases
StackOverflow2013
Postsdbo
POASP.NET 3.5 IIS7 Roles Security Implementation
 

Note that there are some explanatory texts on larger screens.

plurals
  1. POASP.NET 3.5 IIS7 Roles Security Implementation
    primarykey
    data
    text
    <p>I'm working on a ASP.NET 3.5 application running on IIS7 (Server '08) using the stock MS Forms Authentication and SqlRolesProvider. (I used the <a href="http://msdn.microsoft.com/en-us/library/ms998314.aspx" rel="nofollow noreferrer">aspnet_regsql</a> tool to generate the tables).</p> <p>We have three roles: SysAdmins, AppAdmins, and Users. All users are in Users, and a user can be in either SysAdmins, AppAdmins or both. </p> <p>I can't seem to get an Admin directory to block access to users not in SysAdmins and AppAdmins. Either it lets in all logged-in users, or no one. </p> <p>Here are the relevant bits of my current configuration:</p> <pre><code>&lt;configuration&gt; ... &lt;system.web&gt; &lt;authentication mode="Forms"&gt; &lt;forms loginUrl="/client/security/login.aspx" timeout="480" /&gt; &lt;/authentication&gt; &lt;authorization&gt; &lt;/authorization&gt; &lt;roleManager defaultProvider="SqlRoleProvider" enabled="true" cacheRolesInCookie="true" cookieName="EquityTouch.Roles" cookieProtection="All" cookieSlidingExpiration="true" cookieTimeout="60"&gt; &lt;providers&gt; &lt;clear /&gt; &lt;add name="SqlRoleProvider" applicationName="EquityTouch" connectionStringName="SQLProvider" type="System.Web.Security.SqlRoleProvider, System.Web, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /&gt; &lt;/providers&gt; &lt;/roleManager&gt; ... &lt;/system.web&gt; &lt;system.webServer&gt; &lt;security&gt; &lt;authorization&gt; &lt;add accessType="Deny" users="?" /&gt; &lt;/authorization&gt; &lt;/security&gt; ... &lt;/system.webServer&gt; &lt;location path="admin"&gt; &lt;system.webServer&gt; &lt;security&gt; &lt;authorization&gt; &lt;remove users="*" roles="" verbs=""/&gt; &lt;add accessType="Allow" roles="SysAdmins,AppAdmins" /&gt; &lt;/authorization&gt; &lt;/security&gt; &lt;/system.webServer&gt; &lt;system.web&gt; &lt;authorization&gt; &lt;deny users="*"/&gt; &lt;allow roles="SysAdmins,AppAdmins"/&gt; &lt;/authorization&gt; &lt;/system.web&gt; &lt;/location&gt; &lt;/configuration&gt; </code></pre> <p>I believe this configuration currently blocks everyone. I've done similar configurations that block no one. </p> <p>I suspect the issue lies in using both system.web and system.webserver sections. Any help with getting this configuration working correctly would be greatly appreciated.</p> <p><strong>UPDATE</strong></p> <p>Removing the &lt;system.webServer&gt; section from the &lt;location&gt; element makes the .aspx pages in that folder return correctly! Unfortunately, the .js files in that folder are still blocked to all users... Ideally I would like to lock the .js files as well from unpriviledged eyes. So I'm still looking for help.</p>
    singulars
    1. PO
      singulars
      1. PTAnswer
    1. This table or related slice is empty.
    1. PTQuestion
    1. USToby
    1. USToby
    plurals
    1. PL
      singulars
      1. LTLinked
    1. This table or related slice is empty.
    1. This table or related slice is empty.
    1. PO
      singulars
      1. PTAnswer
    1. VO
      singulars
      1. POASP.NET 3.5 IIS7 Roles Security Implementation
      1. This table or related slice is empty.
      1. VTUpMod
    2. VO
      singulars
      1. POASP.NET 3.5 IIS7 Roles Security Implementation
      1. This table or related slice is empty.
      1. VTUpMod
    3. VO
      singulars
      1. POASP.NET 3.5 IIS7 Roles Security Implementation
      1. This table or related slice is empty.
      1. VTUpMod
    1. COThis is the same issue: http://stackoverflow.com/questions/991045/asp-net-authentication-with-roles-in-iis7-integrated-mode-for-static-content
      singulars
      1. POASP.NET 3.5 IIS7 Roles Security Implementation
      1. USToby
 

Querying!

 
Guidance
A row detail

Detail views are divided into sections. All the information in the data section comes from columns in the selected row. The other sections display data from other, related rows.

Related data can be related in a to-one or a to-many fashion. Captions of data related in a to-many fashion link to a list view showing a filtered view of the table.

Try moving around until you find a non-empty to-many entry and click on the label to get to one. You can move back to the root by clicking on the database name in the header.

SQuiL has stopped working due to an internal error.

If you are curious you may find further information in the browser console, which is accessible through the devtools (F12).

Reload