response.redirect not working with folders

Question

The response.redirect is not working. I am using Visual Studios .net it works without the folders but I am doing roles and permissions so I need to folders for that. Why are my url's not working? Can not get pages to show while in a directory.

  protected void Login1_Authenticate(object sender, AuthenticateEventArgs e)
    {

        if (Membership.ValidateUser(Login1.UserName, Login1.Password) == true)
        {
            Login1.Visible = true;
            Session["user"] = User.Identity.Name;
            FormsAuthentication.RedirectFromLoginPage(Login1.UserName, true);
           // Response.Redirect("");
            if (Roles.IsUserInRole(Login1.UserName, "CEO"))
            {
                Response.Redirect("~/CEOPages/CEO.aspx");
            }
            else if (Roles.IsUserInRole(Login1.UserName, "IALO"))
            {
                Response.Redirect("~/IALOPages/IALO.aspx");
            }
            else if (Roles.IsUserInRole(Login1.UserName, "Staff"))
            {
                Response.Redirect("~/Staff Pages/Staff.aspx");
            }

        }
        else
        {
            Response.Write("Invalid Login");
        }
    }

This is the folders config file

 <configuration>
     <system.web>
         <authorization>
              <deny users="*" />
              <allow roles="CEO" />
              <deny roles="Staff" />
              <deny roles="IALO" />
          </authorization>
      </system.web>
  </configuration>

I get errors when trying to reach the pages in folders. I removed them from the folders and used forms authentication denied access based on credentials on those pages. How do you the pages to show if they are in a directory.

Answer 1

You need to specify each folder in your web.config;

  <location path="IALOPages">
    <system.web>
      <authorization>
          <deny users="*" />
          <allow roles="CEO" />
      </authorization>
    </system.web>
  </location>

This should resolve your issue,

Answer 2

The allow entries should precede the deny entries, like so:

<configuration>
     <system.web>
         <authorization>
              <allow roles="CEO" />
              <deny roles="Staff" />
              <deny roles="IALO" />
              <deny users="*" />
          </authorization>
      </system.web>
</configuration>

From MSDN: "At run time, the authorization module iterates through the allow and deny elements, starting at the most local configuration file, until the authorization module finds the first access rule that fits a particular user account. Then, the authorization module grants or denies access to a URL resource depending on whether the first access rule found is an allow or a deny rule."

http://msdn.microsoft.com/en-us/library/8d82143t%28v=vs.80%29.aspx