wonky <authorization> (order matters?) -- asp.net security

SpaceMarine
5/20/2008 4:37:05 PM

hello,

i am using Windows authentication w/ my web app and lock it down via
roles. in my testing it seems like the *order* of the <authorization>
elements matters.

eg, this works:

<authorization>
<allow roles="Foo" />
<deny users="?" />
<deny users="*" />
</authorization>

but this doesnt:

<authorization>
<deny users="?" />
<deny users="*" />
<allow roles="Foo" />
</authorization>

....for the latter my browser keeps popping a credentials dialog, even
tho im in the Foo role.

is this expected behavior? ASP.NET v2.

thanks!

Joe Kaplan
5/21/2008 12:15:32 AM

Yes, it does matter. It evaluates each rule in order until it matches and
then it applies the allow or deny based on the match.

Joe K.

--
Joe Kaplan-MS MVP Directory Services Programming
Co-author of "The .NET Developer's Guide to Directory Services Programming"
http://www.directoryprogramming.net
--
[quoted text, click to view]

asp.net security : wonky <authorization> (order matters?)