Enabling FormsAuthentication for multiple subfolders on a site
We are trying to implement formsAuthentication on our site, but in a scenario that we haven't been able to find yet, other than creating our own HttpModule and implementing custom logic ourselves, so I thought I'd throw a question to make sure this is really the only solution.
We would like to use formsAuthentication on top of custom membership providers, but would like to use a different provider for different folders. Our site separates these sections with subfolders (ex: ~ / Admin, ~ / GoldCustomer, ~ / SilverCustomer, ~ / BronzeCustomer), so we would like to use a different membership provider for each section / subfolder. Using a framework to support this, we will implement our web.config as:
<configuration xmlns="http://schemas.microsoft.com/.NetConfiguration/v2.0">
<location path="Admin">
<system.web>
<authentication mode="Forms">
<forms name="AdminAuth" loginUrl="~/AdminLogin.aspx" />
</authentication>
<membership defaultProvider="AdminProvider" >
<providers >
<add connectionStringName="ConnString" name="AdminProvider" type="Assembly.AdminMembershipProvider" ... />
</providers>
</membership>
</system.web>
</location>
<location path="GoldCustomer">
<system.web>
<authentication mode="Forms">
<forms name="GoldCustomerAuth" loginUrl="~/GoldCustomerLogin.aspx" />
</authentication>
<membership defaultProvider="GoldCustomerProvider" >
<providers >
<add connectionStringName="ConnString" name="GoldCustomerProvider" type="Assembly.GoldCustomerMembershipProvider" ...="" />
</providers>
</membership>
</system.web>
</location>
<system.web>
<compilation debug="true" />
<authentication mode="Forms" />
</system.web>
</configuration>
Doing this results in a runtime error:
An error occurred using a section registered as allowDefinition = 'MachineToApplication' above the application level. This error can be caused because the virtual directory is not configured as an application in IIS.
Line 11: <location path="Admin">
Line 12: <system.web>
Line 13: <authentication mode="Forms">
Line 14: <forms name="FormsAdmin" loginUrl="~/login.aspx" />
Line 15: </authentication>
It seems that the only way to accomplish what we are trying to do with a custom HttpModule is or to change our approach (for example, split folders into different web applications in IIS). Is this correct or am I missing something? Or are there other alternatives that I am not aware of?
Thanks for your help!
source to share
First of all, I believe that role-based security makes sense for your application if you have control over the databases. But if you can't change it, that's not-go.
An alternative solution could be a gateway login form that redirects the user form to login to a folder based on the ReturnUrl
querystring variable and that form will use the provider who wants to validate the user. It then uses FormsAuthentication.RedirectFromLoginPage
to set the authentication cookie and redirect to the previous page. You can install roles and use role-based security to control access to each folder tagged <authorization>
in web.config
.
source to share