My web config, which is a config file in a folder (a config file additional to the main config file in the virtual directory):
> <?xml version="1.0"?>
<configuration>
<system.web>
<authentication mode="Forms">
<forms name=".MyCookie" loginUrl="~/Registration.aspx" protection="All" timeout="43200" path="/">
<credentials passwordFormat="MD5">
<user name="user" password="ca064d0730abfeb09e383a0e82e65f73"/>
</credentials>
</forms>
</authentication>
<authorization>
<deny users="?"/>
<allow roles="Moderator"/>
<deny users="*"/>
</authorization>
</system.web>
</configuration>
The error that I get:
Error 3 It is an error to use a section registered as allowDefinition='MachineToApplication' beyond application level. This error can be caused by a virtual directory not being configured as an application in IIS. 5
I am trying to redirect any anonymous users from the administrator and moderator directories.. so I want any anonymous user or users with no role to be redirected to register.aspx..but i dont get it to work because I get that error and I dont know why!! :(
the authentication tag is not permited on subdirectories web.config, unless you define this subdirectory as a full asp.net application, means a diferent aplication than the root - I not suggest it.
so remove this, and keep it to the root web.config only.
<authentication mode="Forms">... </authentication>
You should define your sub directory as location in your web.config.
Check location element. Also check this scenario.
This article explains how to organize your web.configs and location elements.
This is because the section is only supported in IIS
application directories, which doesn't include subdirectories of an
IIS application.
Related
please bear with me: i am pretty new to all of this
i am working on integrating openid connect with a pair of applications developed by the company.
we are using custom/company specific openid connect libraries that are, i think, essentially wrappers around Microsoft.Owin.Security.OpenIdConnect and Owin.Security.OpenIdConnect.Server
in the idP application web.config, we have something like:
<location path="." inheritInChildApplications="false">
<authentication mode="Forms">
<forms loginUrl="~/Login" name="{....}" protection="All" path="/" slidingExpiration="true" requireSSL="false" defaultUrl="~/Home" cookieless="UseCookies" />
</authentication>
<authorization>
<deny users="?" />
<!-- denies anonymous users to all pages, except those defined under location nodes -->
</authorization>
</location>
plus a bunch of location nodes to allow/deny access to specific pages/resources
the problem is that when the openid connect stuff tries to access /.well-known/openid-configuration when the user is not logged in (or, it seems in the process of logging in),
the response is a 302 redirect to the login page
obviously this is causing problems when a JSON response is expected
i have tried adding a location node to the web.config:
<location path= "~/.well-known/openid-configuration">
<system.web>
<authorization>
<allow users="*" />
</authorization>
</system.web>
</location>
(i also tried with path = "~/.well-known")
but i am still getting redirected to the login page
to be clear, there is no actual directory /.well-known in the idP application; the file seems to be constructed somewhere in Owin.Security.OpenIdConnect.Server.
the file seems to be constructed somewhere in Owin.Security.OpenIdConnect.Server
Yes, it is.
Try calling app.UseStageMarker(PipelineStage.Authenticate) immediately after registering the OIDC server middleware to prevent ASP.NET from applying the authorization policies before it has a chance to be invoked:
app.UseOpenIdConnectServer(options => {
options.AllowInsecureHttp = true;
});
app.UseStageMarker(PipelineStage.Authenticate);
Note that you shouldn't need an exception for ~/.well-known/openid-configuration in your web.config when using app.UseStageMarker().
I'm fairly new too but I think you a path to a .aspx page in the location and the rest is inherited.Just change deny to allow users with the asterix. Also make sure the web.config is in the directory. Sounds like you do but in well-known should be the web.config with allow all users.
<?xml version="1.0"?>
<configuration>
<location path="Manage.aspx">
<system.web>
<authorization>
<deny users="?"/>
</authorization>
</system.web>
</location>
</configuration>
I have an ASP.NET website hosted on IIS 7.5 as below:
I have "customwebsite.com" as the website and in it I have two Web Applications - uk & us - so that I can access these application as customwebsite.com/uk & customwebsite.com/us.
customwebsite.com directory does not have any web.config and have only two folders for web application us and uk.
Both us and uk web application have their individual web.config and have Form Authentication specified as below:
<authentication mode="Forms">
<forms loginUrl="/static/login.aspx" name="login" timeout="20"/>
</authentication>
<authorization>
<deny users="?" />
</authorization>
At this path: /static, there is a web.config with following content:
<?xml version="1.0" encoding="UTF-8"?>
<configuration>
<system.web>
<authorization>
<allow users="?" />
</authorization>
</system.web>
</configuration>
When I hit the root URL for us application, the Website loads correctly but if I loads from uk, I got the error as below:
I have checked the Folder Security, and all the required users have been granted permission and are same for both us and uk applications.
I have checked the IIS logs and below is the response codes of the request in case of failure: 401 0 0 1519 296
Can someone help me resolving this issue.
Got it resolved.
There was two more folders where the redirection of /static/login.aspx happens.
We need to allow access to all such redirecting folders by having a web.config files in those folders with below content:
<?xml version="1.0" encoding="UTF-8"?>
<configuration>
<system.web>
<authorization>
<allow users="?" />
</authorization>
</system.web>
</configuration>
Ran into this same error, but had a different resolution. In our case we had to set:
<machineKey compatibilityMode="Framework45" />
Details here:
http://ardalis.com/asp-net-shared-authentication-problem-solved
In our case we had an error on the login page that redirected to the an error page that the user did not have rights to see, so it redirected to the login page... cycle rinse repeat.
We removed all the controls from the UI, then added them back one by one until the page crashed. Then we could narrow down the controls that had an error.
And yes, we gave all users access to the error page.
Check below IIS setting
Authorization Rules -must contain only allow user setting not any any other rule ex. deny user rule.
Under the root directory I have the following structure
..
..
..
web.config
Report Folder
- Login.aspx
- Web.config
|
|-> ViewReport
|
|-> Report.aspx
In my web.config file in the Report folder I have the following:
<?xml version="1.0"?>
<configuration>
<system.web>
<authentication mode="Forms">
<forms loginUrl="Login.aspx" defaultUrl="ViewReport/Report.aspx">
<credentials passwordFormat="Clear">
<user name="Johl" password="pass888"/>
</credentials>
</forms>
</authentication>
</system.web>
<location path="ViewReport/Report.aspx">
<system.web>
<authorization>
<allow users="Johl"/>
<deny users="*"/>
</authorization>
</system.web>
</location>
</configuration>
When I start debugging I get the following message:
It is an error to use a section registered as allowDefinition='MachineToApplication' beyond application level. This error can be caused by a virtual directory not being configured as an application in IIS.
NOTE that in my root web.config I have something like the following:
In my root, I already have the following:
<system.web>
<authentication mode="Forms">
<forms loginUrl="Str/StrUserLogin.aspx" timeout="2880" slidingExpiration="true" />
</authentication>
<authorization>
<allow users="*" />
</authorization>
</system.web>
Create a virtual directory at the site root. This can be done via project properties in VS under the Web tab.
It's also possible that you have things defined in the sub-directory that should be in the root config file. See similar question here:
Error to use a section registered as allowDefinition='MachineToApplication' beyond application level
Converting your folder/project into an application in IIS can resolved this error.
This error seems to occur if you try to open an asp.net WEBSITE and run it while it was originally encapsulated by a SOLUTION.
Do this: Close the website, find the related solution (.sln-file) further up in the file system and open this in stead. Inside the solution you will now be able to use your website without getting this error.
It would be nice if Microsoft could guide people in the right direction when they get lost in asp.net like this. The present error message about allowDefinition=MachineToApplication is not understandable for normal humans like me.
If you put the published files in inetpub/wwwroot/../ Make sure to add the root folder as an application in IIS Manager.
The contents of the web.config in the subdirectory should be placede in the root directory. The configuration in the subdirectory is making IIS treat the subdirectory as the application root but it is not the application root. This is why you get the error allowDefinition='MachineToApplication'.
I deleted my bin and obj folder for the project and then rebuilt the solution and everything was working fine...not a technically savvy answer but it works.
Just add this below lines in your csproject file to clean up the obj/bin folder automatically.
<Target Name="BeforeBuild">
<!-- Remove obj folder -->
<RemoveDir Directories="$(BaseIntermediateOutputPath)" />
<!-- Remove bin folder -->
<RemoveDir Directories="$(BaseOutputPath)" />
</Target>
I opened the web site from IIS instead of file system and it worked.
In my case, my website was working before deploying the new version.
I found an incorrect Web.config inside Views folder. I replaced it with original file and the problem resolved.
This error occur if your web.config file and your all aspx file are not in the same folder. so please put all the files in the same folder.
Thanks.
I worked long time back on a website and it has been working fine, recently a problem has been reported, which I need to go through.
In my site there is a folder named repository, which contains files like word and PDF documents and ideally only logged in users are allowed to download them but now it has been observed that anyone who is not logged into the website, can even also download them :(
Is there any wayout to handle it without moving the folder out of the web directory? Like making that folder password protected and only my pages can access the content, any code sample or link will be of high use.
My web application is in ASP.NET 2.0 with C# and server has IIS 6.0.
Thanks in Advance
Edit:
My Web.Config has these tags in it:
<authentication mode="Forms">
<forms slidingExpiration="true" loginUrl="Login.aspx" defaultUrl="HomePage.aspx" name=".ASPXMAIN" timeout="30">
</forms>
</authentication>
<authorization>
<deny users="?" />
</authorization>
Use the <location /> tags in the web.config, http://msdn.microsoft.com/en-us/library/b6x6shw7(v=vs.71).aspx
<location path="content">
<system.web>
<authorization>
<allow users="*"/>
</authorization>
</system.web>
</location>
See this answer for more links to msdn documentation: https://stackoverflow.com/a/4280257/426894
You can try with this config in your Web.config (location permit you to define path)
This sample use roles in order to design profil.
Also use users in order to design user.
<location path="~/MembersOnly" >
<system.web>
<authorization>
<allow roles="Members"/>
<deny users="?" />
</authorization>
</system.web>
</location>
Context:
IIS 6 on Windows 2003 Server
ASP.NET 3.5 sp1
C# Web Application running from a virtual directory
There are a few files that I would like not to serve. For example, there's a hibernate.cfg.xml in the root directory that should not be accessible. There are also log files in a logs directory. On the local development server (Visual Studio 2008) The NHibernate config file can be protected in a couple of ways through Web.config:
<location path="hibernate.cfg.xml">
<system.web>
<authorization>
<deny users="?"/>
<deny users="*"/>
</authorization>
</system.web>
</location>
OR
<httpHandlers>
...
<add path="*.cfg.xml" verb="*" type="System.Web.HttpForbiddenHandler" />
</httpHandlers>
The logs in a different directory can be protected through another Web.config file:
<?xml version="1.0"?>
<configuration>
<system.web>
<authorization>
<deny users="*"/>
</authorization>
</system.web>
</configuration>
None of these work when the application is compiled using aspnet_compiler.exe and deployed to an IIS 6 server. No errors in the logs. The files are readable to anyone. The application is compiled and installed using MSBuild as follows:
<AspNetCompiler Force="true" Debug="true" PhysicalPath="$(DeploymentTempPath)\$(DeploymentAppName)" TargetPath="$(DeploymentPath)\$(DeploymentAppName)" VirtualPath="/$(DeploymentAppName)" />
How do I make IIS 6 respect the authorization rules in Web.config.
Note: assume that I can't move these files outside of the deployment directory.
It looks like IIS does not forward the request for .xml or .txt files to ASP.NET, so it has no chance to apply its authorization controls.
To work around this, I had to do the following (from this forum post):
From IIS Console, open properties of the virtual directory of my app.
Virtual Directory > Configuration
Add new handler for extension ".xml" using the ASP.NET filter (c:\windows\microsoft.net\framework\v2.0.50727\aspnet_isapi.dll in my case)
All verbs. Uncheck both "Script engine" and "Verify that file exists".
Is there any way to do this from within Web.config?
Try this:
<location path="hibernate.cfg.xml">
<system.web>
<authorization>
<deny users="?"/>
<deny users="*"/>
</authorization>
</system.web>
</location>
Static files such as .jpg, .xml and .pdf are by default handled directly by the kernel mode http.sys driver. Unless you've mapped these extensions to ASP.NET they will never hit the ASP.NET pipeline and hence the authorisation mechanism within ASP.NET.
To force static files such as .xml to be processed by .NET on .NET 2.0/3.5/4.0 and IIS6, do the following:
1) Add the entries for.xml (or other file type) to IIS as described above (IIS6 website properties, Home Directory, Configuration)
2) in web.config add the location for the restricted directory or file
<location path="directory_or_file_name">
<system.web>
<authorization>
<deny users="?"/>
</authorization>
</system.web>
</location>
3) Add the following to the httpHandlers section:
<add path="*.xml" verb="*" type="System.Web.StaticFileHandler" validate="true" />
This will force .NET to only serve .xml files as specified in the <location> tag to authenticated users.
URL Authorization: The URLAuthorizationModule class is
responsible for URL authorization on
Windows 2003. This mechanism uses the
URL namespace to store user details
and access roles. The URL
authorization is available for use at
any time. You store authorization
information in a special XML file in a
directory. The file contains tags to
allow or deny access to the directory
for specific users or groups. Unless
specified, the tags also apply to
subdirectories.
You need to do the following:
<deny users="?"/>
<deny users="*"/>
The wild card entry "?" means that no one else will be able to gain access to this directory.