• Collect credentials using an HTML form directly from the client (i.e. Forms-based authentication)
  
   
• Prevent anonymous Web user access

When used together with the Login.aspx page we just created, it will allow us to force users to successfully login before visiting our Master/Details data reporting page. To enable this, please follow the steps below:

1. Select New from the File menu. You will see the New File dialog box appear.
2. Select (General) from the Templates pane.
3. Select the Web.Config template.
4. Type a file path in the Location box.
5. Type Web.config in the Filename box (default).
6. Click OK. The web.config file will open. 

   

7. Set the mode attribute of the authentication tag to Forms (the default is Windows). This section sets the authentication policies of the application:

    

   <authentication mode="Forms">
   

   Note Forms-based authentication is an ASP.NET authentication service that enables applications to provide their own logon UI and do their own credential verification.

8. Remove the (default) allow sub-tags of the authorization tag. This section sets the authorization policies of the application:

    

   <allow users="joeuser" />
   <allow roles="Admins" />
   

   Note You can allow or deny access to application resources by user or role.

9. Set the deny sub-tag of the authorization tag to ? (the default is *):

    

   <deny users="?" />
   

   Note In addition to user or role names, you can specify one of the following wildcard values: "*" means everyone, "?" means anonymous. Denying the anonymous user access to the pages within the directory disallows any user who is not logged in from visiting a page -- and will instead send them to the login page we created earlier. They will not have access to any page until they successfully enter their username/password on the login page.

10. Save the file.

    Note You cannot run a Web.config file.

Next Step >>