guest denied access to admin folder redirected to Login.aspx

Question

I am using the following in my webconfig, so that only admin an access the admin folder.

<location path="Admin" allowOverride="true">
<system.web>
  <authorization>
    <allow roles="Administrators" />
    <deny users="*" />
  </authorization>
</system.web>

Now when the guest user tries to access this he is redirected to the Login page.

I want the user to either sho a popup that user cannot access it or just stay on the same page with some error message in a label on that page...

Any suggestions??

thanks

Here is more code in webconfig

<authentication mode="Forms">
    <forms loginUrl="Login.aspx" protection="All" name="Cookie" timeout="120" path="/" slidingExpiration="true"
       defaultUrl="Default.aspx">
    </forms>

Answer 1

Instead of denying access in the web.config you can deny access programmatically in the code behind.

        if (User.IsInRole("Administrators"))
        {
            accessDeniedMessage.Visible = true;
            adminPage.Visible = false;
        }
        else
        {
            adminPage.Visible = true;
            // show admin page
        }

Answer 2

this is what i did in my login page..

if (!IsPostBack)
        {

            if (User.Identity.IsAuthenticated)
            {
                if (!string.IsNullOrEmpty(Request.QueryString["ReturnUrl"]))
                {
                    Response.Redirect("~/Guest/Pagedenied.aspx");
                }
            }

        }

this way the admin folder is denied weather it is aspx pages or any other file in it... and the login screen is also avoided...

If any one has anything better please suggest..

Thanks

Answer 3

You can use custom errors. Look here, and note that the error to be redirected is 401 and not 404.