.net - Cannot Set Authorization Rules In Web.config For WCF Service

Feb 9, 2011

I read on a post that you can use ASP.Net authorization in the web config to control access to a WCF web service to replace the following attribute:

[PrincipalPermission(SecurityAction.Demand, Role="Administrators")]

To test I have been using "Administrators" which is a valid role so should allow me access and "TEST" which isnt. This works fine when using the above attribute however when I comment that out and use this in my Web.Config file:

<authentication mode="Windows" />
<authorization>
<allow roles=".TEST"/>
<deny roles="*"/>
</authorization>

It still allows me access.

So I was wondering if I have just got something wrong in the web.config or whether what I read was wrong saying to use that.

Just for reference this is the post I looked at:

Using Windows Role authentication in the App.config with WCF

and the following is my web.config:

<?xml version="1.0"?>
<configuration>
<system.web>
<compilation debug="true" targetFramework="4.0" />
<authentication mode="Windows" />
<authorization>
<allow roles=".TEST"/>
<deny users="*"/>
</authorization>
</system.web>
<system.serviceModel>
<bindings>
<basicHttpBinding>
<binding name="BasicHttpEndpointBinding">
<security mode="TransportCredentialOnly">
<transport clientCredentialType="Windows" />
</security>
</binding>
</basicHttpBinding>
</bindings>
<services>
<service behaviorConfiguration="WcfService1.ServiceBehaviour1" name="WcfService1.Service1">
<endpoint address="" binding="basicHttpBinding" bindingConfiguration="BasicHttpEndpointBinding"
name="BasicHttpEndpoint" contract="WcfService1.IService1">
<identity>
<dns value="localhost"/>
</identity>
</endpoint>
</service>
</services>
<behaviors>
<serviceBehaviors>
<behavior name="WcfService1.ServiceBehaviour1">
<!-- To avoid disclosing metadata information, set the value below to false and remove the metadata endpoint above before deployment -->
<serviceMetadata httpGetEnabled="true"/>
<!-- To receive exception details in faults for debugging purposes, set the value below to true. Set to false before deployment to avoid disclosing exception information -->
<serviceDebug includeExceptionDetailInFaults="false"/>
</behavior>
</serviceBehaviors>
</behaviors>
<serviceHostingEnvironment multipleSiteBindingsEnabled="true" />
</system.serviceModel>
<system.webServer>
<modules runAllManagedModulesForAllRequests="true"/>
</system.webServer>
</configuration>

View 1 Replies


Similar Messages:

Web.config - How To Combine The Authorization Rules

Jan 28, 2010

I have the following authorization rules in my web.config:

[code]....

Except for the path attribute these two rules are the same. Is there a way to combine these two rules into one like path = Register.aspx, ForgotCredentials.aspx.

View 3 Replies

IIS7 Authorization Rules / Config - Prompting Perpetually

Dec 8, 2010

I am trying to secure an application in IIS7 using .NET Authorization Rules.

By default, the web server allows all users access (which is inherited).

I have added, just for this one application directory, a deny all users command, as well as an allow command for specific users.

<?xml version="1.0" encoding="UTF-8"?>
<configuration>
<system.web>
<authorization>
<allow users="myusername" />
<deny users="*" />
</authorization>
</system.web>
</configuration>

I have Windows Authentication enabled, and I can verify that without the line that my REMOTE_USER is MYDOMAINmyusername.

However, when I try to deny all users, I am prompted with the typical Windows domain username/password box. If I enter the username password, the prompt comes back up again 3 times until finally presenting me with a failure message. (I have also tried to no avail)

Looking in the event viewer, it appears as if my login using the username and pw is successful in the audit ... and to further that point, my account is not being locked out (which it would if I were failing to login over and over). So it's as if I am logging in, but the configuration is not seeing what I entered as matching my login.

Below is the message I see (even when connecting from the server using localhost):

**Access is denied.

Description: An error occurred while accessing the resources required to serve this request. The server may not be configured for access to the requested URL.

Error message 401.2.: Unauthorized: Logon failed due to server configuration. Verify that you have permission to view this directory or page based on the credentials you supplied and the authentication methods enabled on the Web server. Contact the Web server's administrator for additional assistance.**

View 2 Replies

Roles Authentication Works Using Authorization Attribute But Not Via Authorization In Web.config?

Mar 29, 2011

I am using ASP.NET MVC 3 and am trying to do something that should be really straight forward...

My application uses Forms authentication and that is working perfectly for controllers/actions. For example if I decorate either a controller or an action with the attribute below only members of the administrators group can view them:

[Authorize(Roles="Administrators")]

However I have a folder under the default Scripts folder called Admin. I only want members of the Administrators group to be able to access scripts within this directory so I created a new web.config in the directory with the following inside:

[code]....

However no matter whether a user is a member of the Administrators group or not they receive a 302 Found message and are then redirected to the login page.

If I change the web.config to allow user="*" then it works. It also works if I add an allow users="Username" for a specific user I am testing with.

View 1 Replies

HttpHandlers / Modules :: Rewrite Rules In Your Web.config

Oct 14, 2010

modifying the code to redirect to https only if the page url has signup4 and paymentinfo in it. using below code i can redirect all pages to https....

<system.webServer>
<rewrite>
<rules>
<rule name="Redirect to HTTPS" stopProcessing="true">
<match url=".*" />
<conditions>
<add input="{HTTP_CLUSTER_HTTPS}" pattern="^on$" negate="true" />
<add input="{HTTP_CLUSTER-HTTPS}" pattern=".+" negate="true" />
</conditions>
<action type="Redirect" url="https://{HTTP_HOST}{SCRIPT_NAME}" redirectType="SeeOther" />
</rule>
</rules>
</rewrite>
</system.webServer>

View 1 Replies

Url Rewriting In Web.config With Regex Rules Only For Html File?

Sep 7, 2010

I have set up url rewriting in my web.config with regex rules and it works correct for all html files.
Problem:

[code]...

View 6 Replies

Security :: Login Contols And A Web Service - Web Service To Do The Membership Authentication And Authorization?

Jan 23, 2010

I am writing two ASP.NET apps. One is a web service that provides xml data and the other is a web client that will use the service to display and manipulate data. I would like for the web service to do the membership authentication and authorization. Is there any way to simply point the login controls in my client application to the web service instead of to a database. I assume I would have to provide the necesarry methods in my web service interface, which would then use the membership provider database I created and pass the results back through to the client.

Is this possible? I have seen many articles on security provisioin from a web service but none has really been what I am looking for. I was hoping that, since my service and my client are both written in ASP.NET, there might be some built functionality that would benefit me.

View 8 Replies

IIS Ignores Authorization In Web.config?

Sep 2, 2010

I have a problem using windows authentication and the authorization-tag in web.config for my asp.net application. When I host the application in IIS (both in IIS 6 and IIS 7) the authorization-tag is ignored. When I run the application in asp.net development server that comes with visual studio 2010, it works perfect.

Why will it not work in IIS? And how to solve it?

[code]....

View 1 Replies

Web.config - Wildcards In Location And Authorization?

Dec 7, 2010

In my ASP.Net application I'm using URL routing.

The url format is somewhat like: [URL] To allow users to visit the login and recovery page, I've added the following entries to my web.config:

[code]....

Is there a form of notation so that I can skip the en-GB part and replace it with a wildcard? I want the login and recovery page etc. to be available regardless of the culture.

View 3 Replies

Using Multiple Authorization Elements In Web.config?

Feb 4, 2011

Is it possible to use multiple authorization elements in a single web.config to allow additional users access to one file?

E.g., I would like to allow User1 access to the whole application (including Page1.aspx), and User2 access to only Page1.aspx:

[code]....

View 2 Replies

Web Config - How To Apply The Authorization In Two Different Folders

Feb 18, 2011

I have two folders in my asp.net website namely VENDORS and ADMIN

i want when any user access any of the page inside the ADMIN folder it redirects to Admin/login.aspx until they login ....

i want when any user access any of the page inside the VENDORS folder it redirects to Vendors/login.aspx until they login ....

How to do that using web.config authorization ....

View 2 Replies

Security :: Web.Config Authorization Not Working At All?

Sep 30, 2010

I'm using a Custom Role Provider for authorization.

There are 2 roles: "VIEWER" and "SYSTEM_ADMINISTRATOR".

I have set up my role for my account as "VIEWER".

Roles.GetRolesForUser(this.User.Identity.Name) returns "VIEWER"
User.IsInRole("SYSTEM_ADMINISTRATOR") returns false

Web.Config contains below:

<location path="Administration">
<system.web>
<authorization>
<allow roles="SYSTEM_ADMINISTRATOR"/>
<deny users="*"/>
</authorization>
</system.web>
</location>

However, I can still access the ~/Administration pages.

Even if I change the web.config to:

<location>
<system.web>
<authorization>
<deny users="*"/>
</authorization>
</system.web>
</location>

I can still access any of the pages, but I shouldn't be able to access any page when this is set. Correct?

I'm pretty sure my Role Manager is working fine (see above calls to User and Roles), but here's the config:

<roleManager enabled="true" defaultProvider="MyRoleProvider" >
<providers>
<clear/>
<add type="MyNamespace.MyRoleProvider" name="MyRoleProvider"/>
</providers>
</roleManager>

I'm testing this on my local dev environment using Cassini and on a test web server running IIS 6. Both systems/sites work the same way and allow anyone access to any page. Both systems/sites also return correct data when programmatically checking Roles.GetRolesForUser and User.IsInRole.

View 1 Replies

Security :: Login Authorization In The Web.config?

Jul 2, 2010

Trivial question:

Noticed the following error whilst trawling the logs:

Authorization rule names cannot contain the '*' character

I have the code:

[Code]....

Does that mean I don't need to make and authorisation rules - I had used:

[Code]....

Now - is that completely redundant? Also, is * wrong syntactically?

View 2 Replies

C# - Create A Exception In Authorization Tag In Web.config?

Jun 14, 2010

How i create a exception in location to allow access to page GanttViewer.aspx with other rol and others pages only with Admin rol

<location path="Admin">
<system.web>
<authorization>
<allow roles="Admin"/>
<deny users="*"/>
</authorization>
</system.web>
</location>

View 1 Replies

C# - Is It Possible To Have Location Authorization Nodes In A Web.config Be External

Sep 20, 2010

Is it possible to have location authorization nodes in a web.config be external?

Such that I could take all of the nodes simlar to

[code]....

And move them outside of the web.config or something simlar? I find these nodes at an extreme amount of noise to a web.config when they're relatively static. Normally my approach would be to config source something like this but since it falls under the root node I'm not sure of it's possible with these nodes.

View 1 Replies

Requiring Multiple Roles In Web.config Authorization?

Apr 29, 2010

Is it possible to specify that multiple roles are required inside the authorization element of the web.config file? I currently have this block in one web.config of my site for a specific directory:

<authorization>
<allow roles="Global, Region" />
<deny users="*" />
</authorization>

I've just identified a special case where a person with two lower-level permissions than Global and Region should also have access to this directory. Roughly, I want something like this:

<authorization>
<allow roles="GlobalManager, RegionManager, SiteManager && FooSite" />
<deny users="*" />
</authorization>

I realize I probably should have a new role for this scenario, but I'd like to avoid that.

View 1 Replies

Security :: Cannot Get Location / System.web / Authorization (web.config) To Work

Aug 4, 2010

look at the attached web.config? The last part doesn't seem to work although the path is correct. I've tried logging on the site with a use which is in no groups, but it can still access the page...

[Code]....

View 5 Replies

Security :: Master Page Won't Load When Using Authorization In Web.config?

Sep 14, 2010

I don't have any sub catalogs for the .aspx files and this is my web.config file:

[Code]....

It's as if the Login.aspx won't grab the Site.Master if I add this authorization.

I get directed to the Login.aspx if I try to enter any other page, but without seeing the master page.

Is this enough info to solve this or do you need to know how the other pages looks like?

View 2 Replies

Configuration :: How To Get Compilation Debug And Authorization Values Out Of Web.config

May 20, 2010

how can I access the following settings in the web.config through code? Cheers

<compilation debug="true">
<authorization>
<allow roles="MyGroups" />
<deny users="*" />
</authorization>

View 2 Replies

Security :: Authorization Section - Web.config Denying All Users

Jan 1, 2011

In my web.config file, I have an authorization section that is supposed to deny all users EXCEPT for those included in the group specified. However, my login form doesn't allow these users to proceed to the next page - the login form just reappears as if the user has been denied. Code:

[Code]....

I have a user named 'test' that is in the Student Council group. I've tried 'allow users' and 'allow roles' with no success. I've also confirmed that the user is able to log into any workstation in my domain.

View 20 Replies

VS 2010 - Combining Web Config Role Authorization With Web Sitemap?

Jun 13, 2012

I have a sitemap defined in a web.sitemap file and I'm also doing role-based authorization for locations using web.config. I'm using the web.sitemap to generate a menu structure on a Master page, and I wanted to somehow hook the role-based auth from web.config into my menu to hide links to pages that would be denied access from the roles auth.

Is it possible to read the list of <location path=""> and associated role authorizations (allow or deny) from web.config so I can check that against the web.sitemap when generating the menu structure?

View 8 Replies

How To Store System.web.authorization Details In An External Config File

Sep 25, 2010

I want to maintain different user authorization lists for different environments. I know that connectionstrings can be broken out in an external file with configSource, but how would I do this for the following?

<authorization>
<allow users="someuser1"/>
<allow users="someuser2"/>
<allow users="someuser3"/>
<deny users="*"/>
</authorization>

View 1 Replies

Configuration :: Programmatically Update Authorization In Specific Location In Web.config?

Nov 4, 2010

My web.config file has several authorization. May i know how can i update the roles value in to allow 'Staff' to access Page1.aspx programmatically.

[code]....

View 5 Replies

Membership / Authorization Over A REST Service?

Mar 23, 2011

I'm investigating creating a WCF REST service for an existing asp.net application to be consumed by various clients including Windows Phone 7, Android, iPhone apps etc.Creating a simple WCF REST service and consuming it from the above platforms is not a problem and works really well. What I am struggling to get my head around is authorization.The asp.net application uses the Membership provider to provide authentication and authorization and I'm comfortable in using that API from the REST service.

How do I secure my REST service so that the first call has to be to authenticate (passing the username and password) and following calls know who is 'logged in'. I'm guessing the authenticate method will have to pass back some sort of token to be used in subsequent calls identifying the caller. Is this secure enough as the whole site / service is over SSL?

View 2 Replies

Configuration :: Setting Authorization For Images Folder Using Location Tag In Web.config Is Not Working?

Oct 28, 2010

I implemented the Location tag in the web.config file to authorize the anonymous users for Images folder. I deployed the code in IIS6.0 with Forms authentication mode enabled for the virtual directory. I disabled all other authentication modes. When I browse the login page, Images are not displaying. When I set Anonymous authentication in IIS6.0 for the Image folder, it works fine.

See below the code implemented in web.config:

[Code]....

View 2 Replies







Copyrights 2005-15 www.BigResource.com, All rights reserved