Mixing ASP.NET Webforms and ASP.NET MVC

Question

I am having trouble with forms authentication. The root web.config is setup to deny access to all non authenticated users with a structure like:

Controllers
Folder - Webforms
Folder1 - Webforms
Model
Public Folder - Webforms with web.config to allow public access
Views
web.config with deny

I need to have the home controller public as well, but if I leave the authorize attribute off the root web.config will still block access to the views folder. I want to avoid doing something like below I can avoid it.

Controllers
Webforms
-Folder
-Folder2
-web.config with deny unauthorized users
Views
web.config with public access

Does anyone have any thoughts to make the first directory structure work?

Answer 1

I'm having trouble seeing what the config sections actually look like. Can you edit the post and drop those sections into a Code Sample block (the button with binary in the text editor toolbar).

Is the goal to lock down everything that's WebForms and make the MVC driven bits public?

(Would have just put this in a comment, but I don't have the rep points to leave comments yet.)

[Edit] For sake of offering something useful, but acknowledging I still don't know the end goal for which bits you want to lock down, on the MVC side, is it feasible for you to use the security attributes within your Controllers? For example, instead of trying to lock actions (or entire controllers) down in the web.config, you can add the [Authorize(Roles="YourRoles")] to the specific actions or to the top of the controller. Pros and cons to this approach, but I like it as I don't have to mess around with the config file much which is something I simply don't enjoy. This is of course assuming you're using the standard ASP.NET membership provider, but even if you've rolled your own, you should be able to accomplish the task in a similar manner with some additional effort. Just a thought...