Add authentication to subfolders without creating a web application

Question

We have an existing publicly accessible web application with user controls, data access libraries, graphics, etc. We want to create a new secure section of the site that accesses some of the already existing resources.

Initially we created the new section of the site as a virtual directory which (we hoped) would allow us to access the parent site's resources. We added the appropriate location information to the base web.config (authentication and authorization) but we continue to see the following error "Parser Error Message: It is an error to use a section registered as allowDefinition='MachineToApplication' beyond application level. This error can be caused by a virtual directory not being configured as an application in IIS."

In response to that error we created the directory as a new application. This allows us to authenticate properly but has the drawback of not being able to access any of the resources in the parent directory (since it's outside the application scope).

Is there any way to secure the new section of the site while at the same time utilize the already existing resources?

Answer 1

In your web.config file in the root of your site, if you add:

<location path="relativePathToDir">
     <system.web>
      <authorization>
       <deny users="?"/>
      </authorization>
     </system.web>
    </location>

This is working for me using FormsAuthentication, the user gets redirected to the default login page if not authenticated

Answer 2

Remove the application, then add this to the top-level web.config:

<configuration>
    <system.web>
        <!-- applies application wide -->
    </system.web>

    <location path="securedirectory" allowOverride="false">
        <system.web>
            <!-- applies only to the path specified -->
        </system.web>
    </location>

</configuration>

MSDN Reference