ASP.NET authentication with IIS7 integrated roles for static content

Question

I am experimenting with built-in authentication mode for static content in IIS7. I followed the instructions in this article: http://aspnet.4guysfromrolla.com/articles/122408-1.aspx It works fine if I enable / disable access by login status (as in the article). However, I want to allow / deny role-based access (using ASP.NET built into Roles Provider). When I set the allow rule for the "Admin" role to the web.config and deny rules for all other users, I cannot access static files even when I log in as an administrator. The same folder contains non-static content (aspx pages) that can only be accessed in an order based on the information from the role provider.

Any ideas?

Answer 1

Try adding the <system.webServer> <modules>following to the block :

<configuration>
  <system.webServer>
    <modules>
      <remove name="FormsAuthentication" />
      <add name="FormsAuthentication" type="System.Web.Security.FormsAuthenticationModule" />
      <remove name="UrlAuthorization" />
      <add name="UrlAuthorization" type="System.Web.Security.UrlAuthorizationModule" />
      <remove name="DefaultAuthentication" />
      <add name="DefaultAuthentication" type="System.Web.Security.DefaultAuthenticationModule" />
      <remove name="RoleManager" />
      <add name="RoleManager" type="System.Web.Security.RoleManagerModule" />
    </modules>
  </system.webServer>
</configuration>

The bit RoleManageris the key, and it is not included in any of the online examples I could find. Without this, user role membership is not initialized for static content, so role-based authorization always fails.

(Disclaimer: I put this together on my own, based on my limited understanding of IIS, but it seems to work.)

( ): , , RoleManager . IIS , c:\Windows\System32\inetsrv\config\applicationHost.config ( , Windows Vista), ( managedHandler , RoleManager ), MSDN RoleManagerModule System.Web.Security, , .

Answer 2

, , ASP.NET, IIS.

, script?