Does validation allow subgroups in web.config?

Question

If I put something like this in my ASP.NET web.config web application:

   <authorization>
       <allow roles="MyUsers" />
       <deny users="*" />
   </authorization>

and then have the ActiveDirectory group SpecialGroupinside MyUsers, is the SpecialGroup member allowed to access my application?

Answer 1

Yes it will. When you log in, a security token is created that contains information about all the elements you are from, and which includes all nested groups. This token is used to determine access. This is why you need to log out when you are added to a group.

, , , , .

¹ , , ( ), "n" ( , ).