Page level web security using AD

Try this site for starters

http://www.ddj.com/windows/184406424

and

http://blogs.msdn.com/gduthie/archive/2005/08/17/452905.aspx

I'm still having issues. I added the web.config to the directory I want to lock down but had to config it as an application in IIS for it to compile... Also, once it compiled, I'm having problems limiting users...

Ideas?

Here's my web.config (editted of course)


<configuration>
    <appSettings/>
  <connectionStrings>
    <add connectionString="LDAP:// <my ldap string>"
         name="ADConnString"/>
  </connectionStrings>
    <system.web>
      <authentication mode="Forms"></authentication>
      <authorization>
        <allow users ="domain\username"/>
      </authorization>
      <membership defaultProvider="AspNetActiveDirectoryMembershipProvider">
        <providers>
          <add name="AspNetActiveDirectoryMembershipProvider"
             type="System.Web.Security.ActiveDirectoryMembershipProvider,
         System.Web, Version=2.0.3600.0, Culture=neutral,
         PublicKeyToken=b03f5f7f11d50a3a"
             connectionStringName="ADConnString"
             connectionUsername="computername\Administrator"
             connectionPassword="password" attributeMapUsername="SAMAccountName" />
        </providers>
      </membership>
     
    </system.web>
</configuration>

Is Web.Config file should be in the root of your application?

You've currently got your authentication mode set to "Forms" The following items need to be set

<identity impersonate="true"/>
<authentication mode="Windows"/>

I have no way of testing against an AD from here so I'm not sure I can help much more

You should be able to call user.IsInRole("Test") from your code to check if the current user is in the AD groups "Test"

Okay, those changes helped. It's authenticating by user. How about roles. I'm still looking for documentation but am having trouble.

Also, (trying to stay on topic) is there a way to have a default  accss denied page? I'm not getting any intellisense in my web.config.

You should be able to call user.IsInRole("Test") from your code to check if the current user is in the AD groups "Test"

or you can define certan directories to only be accessable to people in certan roles

              <location path="admin">
            <system.web>
                  <authorization>
                        <allow roles="admin"/>
                        <deny users="*"/>
                  </authorization>
            </system.web>
      </location>

The page below should give you exactly what you need

Redirecting to custom 401 page when "Access denied" occures within an ASP.NET application with Windows authentication

http://www.codeproject.com/aspnet/Custon401Page.asp?df=100&forumid=204516&exp=0&select=1196647

Have you soved your problem, Can I be of any further assistance?

I'm getting the role to work but am having trouble limiting it to a directory.  Administration is my directory. I have this. When I use the location tag, i get  'Error 101 <location> sections are allowed only within <configuration> sections.'

Here's what I used...
 <location path="Administration">
      <authentication mode="Windows">
        <forms loginUrl="logon.aspx" name="adAuthCookie" timeout="60" path="/" >
        </forms>
      </authentication>
      <authorization>
        <allow roles="domain\groupname"/>
        <deny users="*"/>
      </authorization>
    </location>


Is there a way to specify role permissions multiple directories and specify different groups for each directory? For example, group A and B have access to directory 1 but only B has access to directory 2.

Thanks!!!

yes, the location settings need to be children of the configuration node.

And you can have multiple Location nodes

See below: -

      <location path="directory1">
            <system.web>
                  <authorization>
                        <allow roles="groupA"/>
                        <allow roles="groupB"/>
                        <deny users="*"/>
                  </authorization>
            </system.web>
      </location>
      <location path="directory2">
            <system.web>
                  <authorization>
                        <allow roles="groupB"/>
                        <deny users="*"/>
                  </authorization>
            </system.web>
      </location>

Perfect!! Thanks for all the help!!!