Authorization problem in webconfig file

[lupis]

To start with I a am a newbie and I know I have done this wrong, probably in my webconfig file. These are my settings in the webconfig file:

<forms name="appNameAuth" path="/" loginUrl="login.aspx" protection="All" timeout="30">  
    <credentials passwordFormat="Clear">  
    <user name="xxx" password="xxx"/>  
     </credentials>  
   </forms>  
  </authentication>  
    <authorization>  
    <allow users="?"/>  
     </authorization>

For my login.aspx page, this is the function code for "ProcessLogin" for the OnClick event for the submit button:

Sub ProcessLogin(objSender As Object, objArgs As EventArgs)

  If FormsAuthentication.Authenticate(txtUser.Text, txtPassword.Text) Then
     FormsAuthentication.RedirectFromLoginPage(txtUser.Text, chkPersistLogin.Checked)
  Else
     ErrorMessage.InnerHtml = "<b>Nåt gick fel...</b> var vänlig och kontollera användarnamn samt lösenord..."
  End If

End Sub

For the Default.aspx page, this is the onload function:

Sub Page_Load()
  'verify authentication
  If User.Identity.IsAuthenticated Then
    'display Credential information
            displayCredentials.InnerHtml = "Current User : <b>" & User.Identity.Name & "</b>" & _
               "<br>"
               '<br>Authentication Used : <b>" & User.Identity.AuthenticationType & "</b>"
  Else
    'Display Error Message
    displayCredentials.InnerHtml = "Sorry, you have not been authenticated."
  End If
End Sub

and for the same Default.aspx page, this is the funcion code for signing out of that page:

Sub SignOut(objSender As Object, objArgs As EventArgs)
  'delete the users auth cookie and sign out
  FormsAuthentication.SignOut()
  'redirect the user to their referring page
  Response.Redirect(Request.UrlReferrer.ToString())
End Sub

This is what is happening and what i want actually.

• The Default.aspx page is vissible for all, but it should only be accesed from the logon page.
• On load the Default.aspx page show the proper error message "Sorry, you have not been authenticated."
• When clicked the signOut button shows the proper error message "Sorry, you have not been authenticated."but does not revert back to the logon page

I have tested different setttings for the "allow users" and "deny users" with both ? and * but nothing gives me the behavior I desire

-Sohail

[dnanetwork]

Read it and get it done..
FormsAuthentication is very powerful feature of asp.net..

your solution :
http://www.brainbell.com/tutorials/ASP/Basic_Forms_Authentication.html

Lil more advance..
http://www.devhood.com/tutorials/tutorial_details.aspx?tutorial_id=85
http://www.aspnet101.com/2007/09/beginners-guide-to-forms-authentication/

Expert level :
http://www.asp.net/security/

[KushMishra]

are you sure that

allow users="?"

....I think it should be

deny users="?"

[lupis]

Hi,
If I use

deny user="?"

in my webconfig file, and then try to write the defarult.aspx page in my broser, it redirects as it slould to the login.aspx page, but my whole login page is completly without any css formating applied,no images are vissible,for example all my div tags are not at all dispalyed properly, just the text and the login form is vissible.

If i click on the menu containing html code

<li><a href="Login.aspx">Login</a> | </li>

the login.aspx page is displayed properly with all the ccs formating applied and all the images vissible, but if i use the signout button on the default page and invoke the signout function

Sub SignOut(objSender As Object, objArgs As EventArgs)
  'delete the users auth cookie and sign out
  FormsAuthentication.SignOut()
  'redirect the user to their referring page
  Response.Redirect(Request.UrlReferrer.ToString())
End Sub

the login.aspx page is once more displayed with att the css formating gone, but just the form itself loaded normally. What have I missed?

thanks
Sohail

[lupis]

Well, for some reason, its working as it is supposed to *s*