"reverse" authorized pages being redirected to login

Question

So, I have a page that I want only anonymous users to see, and authenticated users to be redirected. So, like this:

<location path="Login_ForgotUserID.aspx">
    <system.web>
        <authorization>
            <allow users="?" />
            <deny users="*" />
        </authorization>
    </system.web>
</location>

The problem is, when an authenticated user attempts to access it, it redirects them to the login page. How can I send them someplace more logical? obtw, I'm confined to .NET v2.0x

Answer 1

Not sure how to do this in the web.config. In the Login_ForgotUserID.aspx page probably check if the user was authenticated before loading/rendering. If the user is authenticated then redirect them to some harmless home or default page.

Answer 2

Why not just add if ( Request.IsAuthenticated ) { Response.Redirect ... to the Page_Load event of the page you don't have to worry about configuring it out? Unfortunately you can only config a single page to handle Login and if someone doesn't have access they will be directed to it. You could also just check the ReturnURL on Login to see if it came from a page and the user is Authenticated, but that to me is a hokey solution.

Answer 3

Ok, so the answer is that I need to modify the menu before it renders. I never found a way to handle the SiteMap by changing the authoriztion/SecurityTrimming. So I decided to try to modify the SiteMap at the source, and I found out how to modify the MenuItems as they were bound. This seemed the most effective course.

Answer 4

You could look at using roles here as well.

If you were to add all users by default to a role, say "authenticated" then you could have:

<location path="Login.aspx">
  <system.web>
    <authorization>
        <deny roles="authenticated" />
        <allow users="*" />
    </authorization>
  </system.web>
</location>

You must ensure that deny is fisrt in the list, as these are processed in order, and the first match is used.

Two other methods to do a similar thing:

1. Write a custom sitemap provider to ensure that these pages aren't returned to the tree view control when the user is authenticated.
2. Write a control adapter for your treeview control to ensure that these pages aren't rendered by it.