Develop Reference

ASP.NET Forms authentications

I have created new Project > ASP.NET Web Application (with individual user accounts). To root web.config I have added `
<authentication mode="Forms">
<forms loginUrl="log.aspx" defaultUrl="about.aspx"/>
</authentication>
<authorization>
<deny users="?"/>
</authorization>`
in order to redirect every not authenticated user to log.aspx (it exists in project root). But when I run my project now I got error
HTTP Error 404.15 - Not Found
The request filtering module is configured to deny a request where the
query string is too long.
Requested URL http://localhost:55371/Account/Login?ReturnUrl=%2FAccount%2FLogin%3FReturnUrl%3D%252FAccount%252FLogin%253FReturnUrl%253D%25252FAccount%25252FLogin%25253FReturnUrl%25253D%2525252FAccount%2525252FLogin%2525253FReturnUrl%2525253D%252525252FAccount%252525252FLogin%252525253FReturnUrl%252525253D%25252525252FAccount%25252525252FLogin%25252525253FReturnUrl%25252525253D%2525252525252FAccount%2525252525252FLogin%2525252525253FReturnUrl%2525252525253D%252525252525252FAccount%252525252525252FLogin%252525252525253FReturnUrl%252525252525253D%25252525252525252FAccount%25252525252525252FLogin%25252525252525253FReturnUrl%25252525252525253D%2525252525252525252FAccount%2525252525252525252FLogin%2525252525252525253FReturnUrl%2525252525252525253D%252525252525252525252FAccount%252525252525252525252FLogin%252525252525252525253FReturnUrl%252525252525252525253D%25252525252525252525252FAccount%25252525252525252525252FLogin%25252525252525252525253FReturnUrl%25252525252525252525253D%2525252525252525252525252FAccount%2525252525252525252525252FLogin%2525252525252525252525253FReturnUrl%2525252525252525252525253D%252525252525252525252525252FAccount%252525252525252525252525252FLogin%252525252525252525252525253FReturnUrl%252525252525252525252525253D%25252525252525252525252525252FAccount%25252525252525252525252525252FLogin%25252525252525252525252525253FReturnUrl%25252525252525252525252525253D%2525252525252525252525252525252FAccount%2525252525252525252525252525252FLogin%2525252525252525252525252525253FReturnUrl%2525252525252525252525252525253D%252525252525252525252525252525252FAccount%252525252525252525252525252525252FLogin%252525252525252525252525252525253FReturnUrl%252525252525252525252525252525253D%25252525252525252525252525252525252FAccount%25252525252525252525252525252525252FLogin%25252525252525252525252525252525253FReturnUrl%25252525252525252525252525252525253D%2525252525252525252525252525252525252FAccount%2525252525252525252525252525252525252FLogin%2525252525252525252525252525252525253FReturnUrl%2525252525252525252525252525252525253D%252525252525252525252525252525252525252FAbout.aspx
Physical Path
D:\Visual Studio workplace\WebApplication4\WebApplication4\Account\Login
Suggested fix is change maxquerystring so I did it as here. And then error changed
Exception Details: System.Web.HttpException: The length of the query string for this request exceeds the configured maxQueryStringLength value.
To me it looks like some infinite loop. Could you please tell me why the first error mentions /account/login which is default in this project? Also what is a solution in this situation?
I am using VS2015 with IIS Express.

When you select "Individual User Accounts" during project creation you are setting up authentication to use ASP.Net Identity which is a completely different system than Forms Authentication.
You don't want to mix them, use one or the other. But be aware Forms Auth is now much weaker security than Identity which basically sets up a modern Token server within your website.

I have seen this same error posted many times and as I have encountered the same problem myself and all of the answers were not helping me, until I found the real solution to the problem.
The original question says:
"I have created new Project > ASP.NET Web Application ..." and it says he changed the web.config file.
Indeed there is an infinite loop that is occuring because the web.config is set to deny access to any unauthenticated user to every page of the site that is including the login page itself! That is causing the loop.
In order to avoid the infinite loop one should grant access to at least the login page. I made that, placing another web.config file inside the folder where my login page is placed, and with the following code inside it:
<?xml version="1.0" encoding="utf-8"?>
<configuration>
<system.web>
<authorization>
<allow users="?"/>
</authorization>
</system.web>
</configuration>
This grants unauthorized access to all pages inside the folder, so be sure to put your login page there and that's all.
Edited: it is important to say that this approach is using Forms Authentication.

Web.config authorization issue using Active Directory groups that contain additional subgroups

When you use the following code in your web.config, is there a way to allow for authorization of individuals who might be within subgroups of the listed AD role?
<location path="Restricted.aspx">
<system.web>
<authorization>
<allow roles="FOOMAIN\AccessGroup" />
<deny users="*" />
</authorization>
</system.web>
</location>
The AD groups are setup as such:
AccessGroup
Subgroup1
Subgroup2
John.Foo
Jane.Bar
Subgroup1
Billy.Jean
Other.Individuals
Currently, when Billy.Jean tries to access Restricted.aspx, they are rejected.
We'd love to be able to use AccessGroup in the web.config and be able to add subgroups for future access instead of having to make web.config or code changes. The possibility of just doing the authorization on PageLoad has been proposed but the business prefers to have these things set in configuration. The application is currently using Windows authentication and denies anonymous access site-wide.
Any ideas? Is there something I'm missing with how IIS performs this lookup? Is there a setting within AD that needs to be changed for the AccessGroup? I have no access to the IIS or AD settings and their respective admins are less than helpful.
Thanks.

I was able to finally sort this all out. The reason that Subgroup1 and Subgroup2 were not being accessed was because they are distribution groups and not security groups. When a respective security group is added that contains Billy.Jean, everything works properly. Basic answer to an infuriating problem.

Need to login to view video asp.net

I am a beginner with C# and Asp.net. I will try to explain this as best I can. I work at a university that allows access to a lot of different sites, payroll, hr, databases...etc. through a central authentication unit. You login on a subdomain of the site and based on your account, you have access to whatever is allowed to you.
I am working with a small department that wants a video on their website, but they want employees to have to login first, in order to see that video.
Can anyone recommend on how to achieve this, I am kind of dead in the water here. Any help is appreciated. Is there a way I can use asp.net to check if they are logged in? Or is this beyond my hands.

To deny access to a specific page say: video.aspx, you can use location element in your web.config. This will always deny access to users who are not logged in and will redirect them to your default login page configured.
<configuration>
<location path="root/video.aspx"> //Specify your correct Path to Video Page
<system.web>
<authorization>
<deny users="?"/>
</authorization>
</system.web>
</location>
</configuration>
However, if you want authentication on whole of a section of website, which will be a separate folder in VisualStudion, make sure in the root of this separate folder, you place a web.config with below entry. Only thing that your code to validate user in login page will be using the Central authentication standards.
<system.web>
<authentication mode="Forms">
<forms loginUrl="login.aspx" />
</authentication>
<authorization>
<deny users="?" />
</authorization>
</system.web>
You can refer this URL for a very basic startup: http://www.codeproject.com/Articles/13872/Form-authentication-and-authorization-in-ASP-NET

Authorizing a single aspx page with log in

I Have an ASP.net application where I have a page named foo.aspx where some secured data is placed.
I want to denny the access to this page to users not logged in, and this login Username and Password must set by me in web.config or somewhere else.
But I have a problem that there is already a Admin Panel which is restricted to normal users
by Username , Password I have set in web.config using authentication mode set to forms.
Now how can I restrict foo.aspx page as authentication code can't duplicate and also want separate log in page.

In web.config, you could define elements (after system.web closure) where you set a specific configuration for a specific zone/page of your app.
Eg:
<configuration>
<system.web>
....
</system.web>
<location path="Foo.aspx">
<system.web>
<authorization>
<allow users="*" />
</authorization>
</system.web>
</location>
</configuration>
There, you may set a different authorization mode than the one in use by your app.
With the above example, your page won't be protected by the standard authorization mode configured globally, but you have the choiche to protect your page in a custom way, directly in the page itself.

At the top of your foo.aspx page you have
if(login == false)
send them to login page;
This will make sure that they are logged in before they can even access the foo page.

The best way to achieve this is to have two different asp.net applications. You can still configure your IIS to have your Foo application in another folder / subdomain.
You can, however, try to develop your own AuthenticationModule which will need to have a list of urls protected by Admin-authent and a list of urls protected by Foo-authent, each one with its specific Login page and a default login-pwd pair or a table of users. Here's a tutorial for developing custom Authent module : http://www.codeproject.com/Articles/5353/Custom-Authentication-provider-by-implementing-IHt
Good Luck

You can add your page foo.aspx to a folder and you can protect this folder by adding a new web.config file
for example ,
Folder
-foo.aspx
-web.config
in new web.config file
<?xml version="1.0" encoding="utf-8"?><configuration>
<system.web>
<authorization>
<deny users="?" />
</authorization>
</system.web>
</configuration>

Utilize a Banned Role - ASP.NET MVC

<location path="CreateArticle">
<system.web>
<authorization>
<deny roles="banned"/>
<deny users="?"/>
</authorization>
</system.web>
The code above works fine but when I ban myself, It automatically redirects to the login page. I don't want this, If a person is banned I want it to redirect to a banned page. is this possible in MVC?

It sounds like you are using the built in asp.net membership/roles provider. This is the design of the system.
You can code around this yourself. Here's an example of this:
.net Membership deny login
The code in this sample was with web forms in mind not MVC so you will need to adapt it but it should get you down the right path.

well you can check inside your controller if the user is banned and make a proper decision
if (User.IsInRole("Banned"))
{
// do something here
}