Have Geek Brain

Using system.web.authorization options in web.config to protect classic asp files?

I have a virtual directory with an extensive hierarchy of subfolders and thousands of classic ASP files, all of which have different permissions set at the NT folder level (don't ask .. shakes his head).

Is there a way to configure all of these virtual directories with my own web.config so that I can control access by tweaking the system.web.authorization settings and eliminating folder level permissions?

I tried and so far could only have this work with asp.net files and not classic ASP.

If this is not possible, can anyone suggest some alternatives?

+1


a source to share


2 answers


Since ASP.NET clasic has no idea about the ASP.NET runtime due to the fact that it is a) classic and 2) not .NET, you cannot use .NET configuration to manage permissions.

Your options would be as follows:

  • Migrating to IIS7
  • Rename all asp pages to aspx
  • Change the asp handler to aspnet_isapi.dll (which is the .net handler)


While 2 and 3 may work, you will need to fully check these pages to ensure that they still work as intended.

I would argue that the best option would be to simply use the filesystem ACL to control who can access the folders. Just because you don't understand them doesn't mean they don't have their place.

+3


a source


You can use wildcard mapping so that all file types are processed by the ASP.NET runtime in IIS6; however, even when enabled, permissions are not handled through the web.config. Windows Authentication in classic and .NET uses file permissions to determine access.



+2


a source






More articles:


All Articles