ASP.NET auth，排除root并允许匿名

Question

We have a weird issue found during setting up a new Windows 2003 Server with IIS6.0 & ASP.NET 2.0, our site is built using ASP.NET forms authentication with general authorization to deny access to all users & allow explicitly to static, home pages etc, -- web.config setting for forms auth looking as below:

     <authentication mode="Forms">
        <forms name="appNameAuth" path="/" loginUrl="~/Pages/Users/Login.aspx" protection="All" timeout="60" defaultUrl="~/Pages/Inner.aspx">
        </forms>
    </authentication>
    <authorization>
        <deny users="?"/>
    </authorization>

Issue is this:

If we access the site as localhost/default.aspx works fine & can view the home page of our website, but if we access using localhost/ - expect to view the default.aspx (as it's set as default document), but for some reason ASP.NET Forms Authentication thinks "/" is a protected page or content & redirects me to login page.

I couldn't find anyway to inform "/" as allow = *, in web.config... thought it might be linked with some NTFS & IIS permission issue with folders, could not get much update about..

Any help to resolve this, would be appreciated.

Thanks

Bhaskara

Answer 1

Over the weekend, above stated problem re-surfaced on our servers... while doing some other configuration changes & eventually found the root cause of issue (and not the simple "re-create" website suggested earlier).

Here is the issue & solution:

1. We have our main website as simple ASP.NET based & NOT MVC app.

2. Website contains 1 virtual directory, build on MVC framework & as per the guidelines to enable MVC (http://haacked.com/archive/2008/11/26/asp.net-mvc-on-iis-6-walkthrough.aspx) - we were supposed to setup the .mvc pattern & subsequent wildcard mapping for extension less URLs

3. Mistake we did was, instead of setting up MVC properties at the virtual directory, it was setup at root level... main website was set for forms-auth & wildcard mapping ended up triggering asp.net forms auth

4. Issue was resolved, when removed wildcard mapping at root & only setup on the virtual directory (that was not set with asp.net auth & allowed anonymous access to all pages)