Almost all the info available on web is for MVC only. I have a subdomain called "foo" for my site "bar.com".
The folder structure is /Account/login.aspx and /Account/foo.aspx
So, when i enter foo.bar.com, I need to route to either login.aspx(if not logged in) or foo.aspx(if logged in).
I'm using asp.net web server. No IIS please.
In global.cs file :
Route Admin = new Route("admin.localhost", new CustomRouteHandler("~/Account/foo.aspx"));
routes.Add(Admin);
In my web.config
<location path="Account">
<system.web>
<authorization>
<deny users="?"/>
<allow users ="*" />
</authorization>
</system.web>
and
<authentication mode="Forms">
<forms loginUrl="~/Account/Login.aspx" name=".SAKKU" protection="All" path="/" timeout="30"/>
</authentication>
<authorization>
<!--<deny users ="?" />-->
<allow users = "*" />
</authorization>
My host file
127.0.0.1 admin.localhost
Now, whenever i type foo.bar.com, it takes me to the Default.aspx page and not the login or foo page.
Thanks,
Dev
Related
I followed this site to integrate WIF in my MVC web app: https://msdn.microsoft.com/en-us/library/hh291061.aspx
It works well, users can log in with SSO and anonymous users are forwarded to the SSO page.
I want to deny access to everyone but a certain AD group / user and I can't figure out where to place the rules.
I tried in system.web
<system.web>
<authentication mode="None" />
<authorization>
<allow users="<domain>\<username>"/>
<deny users="*" />
</authorization>
</system.web>
But that doesn't seem to work, the specified allowed user is denied (401).
I tried in FederationMetadata and that didn't work either
<location path="FederationMetadata">
<system.web>
<authorization>
<allow users="<domain>\<username>"/>
<deny users="*"/>
</authorization>
</system.web>
</location>
I can't for the life of me figure this out. Any suggestions?
You could change the web.config back to:
<authorization>
<allow users="*" />
</authorization>
And then perform your own authz, authn globally for the site in the HttpApplication.PostAuthenticateRequest.
I started with a default WebForms project with Individual Accounts. I have a bunch of content that I've built with database connections. I want to restrict all content to authenticated users with the exception of the default.aspx
I have successfully established the Identity table structures in my SQL database and can "register" new users. This all works fine. However, when I add the authentication setup to the web.config see below, it all breaks.
<system.web>
<authentication mode="Forms">
<forms name=".FormsAuth" loginUrl="Login.aspx" protection="All" slidingExpiration="false" requireSSL="false" />
</authentication>
<authorization>
<deny users="?"/>
</authorization>
</system.web>
<location path="Default.aspx">
<system.web>
<authorization>
<allow users="*"/>
</authorization>
</system.web>
</location>
I would expect this to allow me to view my Default.aspx page and redirect if I moved off of it. Instead I attempts to redirect to \account\login and fails with this message.
HTTP Error 404.15 - Not Found The request filtering module is
configured to deny a request where the query string is too long.
The ReturnURL is huge and seems to repeat itself. I've tried looking around for a start from scratch example but have not found one that works. This should be simple.
http://localhost:58573/Account/Login?ReturnUrl=%2FAccount%2FLogin%3FReturnUrl%3D%252FAccount%252FLogin%253FReturnUrl%253D%25252FAccount%25252FLogin%25253FReturnUrl%25253D%2525252FAccount%2525252FLogin%2525253FReturnUrl%2525253D%252525252FAccount%252525252FLogin%252525253FReturnUrl%252525253D%25252525252FAccount%25252525252FLogin%25252525253FReturnUrl%25252525253D%2525252525252FAccount%2525252525252FLogin%2525252525253FReturnUrl%2525252525253D%252525252525252FAccount%252525252525252FLogin%252525252525253FReturnUrl%252525252525253D%25252525252525252FAccount%25252525252525252FLogin%25252525252525253FReturnUrl%25252525252525253D%2525252525252525252FAccount%2525252525252525252FLogin%2525252525252525253FReturnUrl%2525252525252525253D%252525252525252525252FAccount%252525252525252525252FLogin%252525252525252525253FReturnUrl%252525252525252525253D%25252525252525252525252FAccount%25252525252525252525252FLogin%25252525252525252525253FReturnUrl%25252525252525252525253D%2525252525252525252525252FAccount%2525252525252525252525252FLogin%2525252525252525252525253FReturnUrl%2525252525252525252525253D%252525252525252525252525252FAccount%252525252525252525252525252FLogin%252525252525252525252525253FReturnUrl%252525252525252525252525253D%25252525252525252525252525252FAccount%25252525252525252525252525252FLogin%25252525252525252525252525253FReturnUrl%25252525252525252525252525253D%2525252525252525252525252525252FAccount%2525252525252525252525252525252FLogin%2525252525252525252525252525253FReturnUrl%2525252525252525252525252525253D%252525252525252525252525252525252FAccount%252525252525252525252525252525252FLogin%252525252525252525252525252525253FReturnUrl%252525252525252525252525252525253D%25252525252525252525252525252525252FAccount%25252525252525252525252525252525252FLogin%25252525252525252525252525252525253FReturnUrl%25252525252525252525252525252525253D%2525252525252525252525252525252525252FAccount%2525252525252525252525252525252525252FLogin%2525252525252525252525252525252525253FReturnUrl%2525252525252525252525252525252525253D%252525252525252525252525252525252525252FDefault
I figured this out. I had to remove the general "deny all anonymous" statement from web.config:
<!--<authorization>
<deny users="?"/>
</authorization>-->
...which I was trying to use to restrict ALL but the login page.
I moved all of my content into a few subfolders then called them out with the location tags and the same deny users statement.
<location path="System">
<system.web>
<authorization>
<deny users="?"/>
</authorization>
</system.web>
</location>
<location path="Reports">
<system.web>
<authorization>
<deny users="?"/>
</authorization>
</system.web>
</location>
At this point it seems to be working "properly" and now redirects users to login.aspx if not authenticated.
The \account\login.aspx was denyed because of the web.config.
...
<authorization>
<deny users="?"/>
</authorization>
When you redirect to the login page, because anonymous access is forbidden, you are redirected to the login page again, resulting in recursion.
You can create web.config in the account folder.The content is like this:
<system.web>
<authorization>
<allow users="*"/>
</authorization>
I am using ASP.net and having problems redirecting the the original requested URL after login. The URL is showing clearly in the address bar but when signing it it takes me to Default.aspx every time:
http://development-4/login.aspx?ReturnUrl=%2fControls%2fFinancial%2fAddressBook.aspx
The .NET framework already handles automatically redirecting using the 'ReturnUrl' value. Unless you're taking the user somewhere other than they attempted to go, use the following to redirect them to their requested page.
Replace 'userName' with the username they provided while logging in. 'isPersistant' refers to whether the cookie should persist browser sessions or be deleted when their window is closed.
FormsAuthentication.RedirectFromLoginPage("userName", isPersistant);
If you have chosen to take the user somewhere else, your code should look similar to this.
FormsAuthentication.SetAuthCookie("userName", isPersistant);
Response.Redirect("~/SomePage.aspx");
Because you didn't provide very much background information, I'll add the following config. you should have something similar.
<system.web>
<authentication mode="Forms">
<forms name="loginCookieName" loginUrl="~/login.aspx" protection="All" timeout="60" path="/" />
</authentication>
<authorization>
<deny users="?" />
</authorization>
</system.web>
<location path="login.aspx">
<system.web>
<authorization>
<allow users="*" />
</authorization>
</system.web>
</location>
I am new to MVC and I don't know how to use authentication and authorization attributes in MVC application, I have used these in asp.net webform application as follows;
<authentication mode="Forms">
<forms loginUrl="login.aspx" defaultUrl="home.aspx" protection="All" timeout="2880"/>
</authentication>
<authorization>
<deny users="?"/>
</authorization>
which works fine for me, Now When I use same in MVC application with following changes;
<authentication mode="Forms">
<forms loginUrl="~/Account/Login" defaultUrl="~/Home/Index" timeout="2880" />
</authentication>
<authorization>
<deny users="?"/>
</authorization>
also I have used [Authorize] keyword on ActionResult Login(), which is allowing the users access to the website.
but it shows me error as follows;
The requested page cannot be accessed because the related configuration data for the page is invalid.
Please suggest me what amendments or addition should I do to make it working. Thanks in advance.
You can go through this Tutorial. It might help.
i am in a very tricky situation..
I have a page that is a part of my project and i want to access it without logging in or doing anything..
Explanation:
I have a test project which has a login page, default page, Admin folder, Guest folder, and a showmessage page.
the Admin folder has pages that are accessible to only admins
the Guest folder has pages that are accessible to all users.
now when ever i type in http://localhost/Default.aspx or any other page it first takes me to the login page and only after i enter the login credentials i go to the default page and from there to the other pages.
this system works fine for me and i dont wish to change it,
but there is this page similar to default called showmessage.aspx page.
what i want is when i type http://localhost/showmessage.aspx it should ignore all the login pages and take me directly to this page.. is there a way to do that.
i have this in my webconfig:
<authentication mode="Forms">
<forms loginUrl="Login.aspx" defaultUrl="~/Default.aspx" name="GUI" slidingExpiration="true" timeout="30" path="/">
</forms>
</authentication>
<location path="Admin" allowOverride="true">
<system.web>
<authorization>
<allow roles="Administrators" />
<deny users="*" />
</authorization>
</system.web>
</location>
Please can some1 help me.
appreciate all the help i can get. thanks
You should be able to specify the path directly to the page and allow everyone.
<location path="ShowMessage.aspx">
<system.web>
<authorization>
<allow users="*" />
</authorization>
</system.web>
</location>