views:

37

answers:

2

Hi, I just start to learn web programming using IIS 7.5 in windows 2008 R2, and ASP.Net 4.

I notice that both IIS and ASP.Net can define Authentication rules. In IIS, there is a form authentication setting where I can redirect user to specified page for authentication, like below:

alt text

And then, in ASP web.config file, I find similar settings:

<authentication mode="Forms">
  <forms loginUrl="~/Account/Login.aspx" timeout="2880" />
</authentication>

When I finish both settings, I assume any page request will be redirect to the login.aspx page. But it didn't. So I am confused. How do the 2 sets of configs work together? And why page request is not redirected?

Thanks

Update

Finally I get it working and I think I understand it now. My website structure is like below:

alt text

It is about modifying Autherization rules. Deny all unauthorized users for root:

    <authorization>
        <deny users="?" />
    </authorization>

CSS files should be allowed for all users, so I have Styles\web.config:

    <authorization>
        <allow users="*" />
    </authorization>

and only allow unauthorized users to access register.aspx, so I have Account\web.config:

  <location path="Register.aspx">
    <system.web>
      <authorization>
        <allow users="*"/>
      </authorization>
    </system.web>
  </location>

  <system.web>
    <authorization>
      <deny users="?"/>
    </authorization>
  </system.web>
+3  A: 

There's another component you need to configure: authorization. If you don't, unauthorized users have access to all pages and will not be redirected to the login page. For example:

<authorization>
    <deny users="?" />
</authorization>

This specifies that all unauthenticated users are denied access to pages in your application. The authorization element is part of the system.web configuration section.

Ronald Wildenberg
Hi, i added this but it gives me same error rather than redirection. Seems redirection is not automatic?
Sheen
Glad you worked it out. If this helped you answer your question, could you mark it as answered?
Ronald Wildenberg
+1  A: 

When you set something in IIS with authentication ( in your case form authentication). It also change your mapped project webconfig file with the same settings. That's why you see same information in both modules.

Liuksas
@Liuksas, you are right. And when I enable all 3 methods in IIS, web.config only uses 'Forms'. Does that mean Form method takes priority?
Sheen
Try <system.web> <authorization> <deny users="?"/> </authorization> </system.web> <location path="login.aspx"> <system.web> <authorization> <allow users="*"/> </authorization> </system.web> </location>Let user to connect to mentioned page in webconfig.
Liuksas
<authentication mode="Forms"> <forms loginUrl="~/Account/Login.aspx" timeout="2880" /></authentication>This section sets the authentication policies of the application. Possible modes are "Windows", "Forms", "Passport" and "None". Because you have one of these, webconfig contains only one.
Liuksas
Good job for you :)
Liuksas