title: ccnet webdashboard authentication forms mode how to set it up so its secure
body: <p>I am sure I am just doing this wrong but for the life of me I can not get things to play nicely.  I am just starting to install and configure CruiseControl.net on a WS2008 X64 VM.  The install seemed to go a little funny as it didn't create an IIS site for the dashboard, I ended up just doing that my self and pointing it at:</p>
  
  <p>C:\Program Files (x86)\CruiseControl.NET\webdashboard</p>
  
  <p>(had to add permissions for iis_iusrs for it to deal with config files, not sure how good that actually is).</p>
  
  <p>Anyway, so I can view the web dashboard now and get into the admin section etc.  Ultimately I want this site to be accessible online for ease of use by the team so it needs to be locked down and secure.  So to that end I put the following sections on the web.config:</p>
  
  <pre><code>&lt;authentication mode="Forms"&gt;
          &lt;forms name="appNameAuth" path="/" loginUrl="server/local/SimpleUserLogin.aspx" protection="All" timeout="30"&gt;
              &lt;credentials passwordFormat="Clear"&gt;
                  &lt;user name="jon" password="test" /&gt;
                  &lt;user name="mike" password="test" /&gt;
              &lt;/credentials&gt;
          &lt;/forms&gt;
      &lt;/authentication&gt;
  </code></pre>
  
  <p>If I put the following section in I can get to the login screen but will always be sent back to it even after I login and can never see any other pages:</p>
  
  <pre><code>    &lt;authorization&gt;         
          &lt;deny users="?" /&gt;
      &lt;/authorization&gt;
  </code></pre>
  
  <p>I also have this outside of the system.web section:</p>
  
  <pre><code>&lt;location path="server/local/SimpleUserLogin.aspx"&gt;
      &lt;system.web&gt;
          &lt;authorization&gt;
              &lt;allow users ="*" /&gt;
          &lt;/authorization&gt;
      &lt;/system.web&gt;
  &lt;/location&gt;
  </code></pre>
  
  <p>My goal is to direct all non logged in users to the login page and no where else, once logged in they can view any page.  Am I being a blonker here?</p>
  
  <p>Thanks</p>