title: ASP.NET + IIS6: whitelist users via authorization section in web.config
body: <p>Consider an IIS6 Application under a web site:</p>
  
  <ul>
  <li>Windows authentication is enabled.</li>
  <li>anonymous is off</li>
  </ul>
  
  <p>This is an ASP.NET MVC application with Areas. The root web.config has the authentication and authorization nodes as follows:</p>
  
  <pre><code>&lt;authentication mode="Windows"&gt;&lt;/authentication&gt;
  
  &lt;authorization&gt; 
      &lt;allow users="domain\abc, domain\xyz, domain\foo, domain\bar"/&gt;   
  &lt;/authorization&gt;
  </code></pre>
  
  <p>My identity is NOT in the list of allowed users. Entering the URL in the browser, I can view and navigate to all the pages within. I know I am being authorized properly, as my Active Directory name is displayed on the site.</p>
  
  <p><strong>Problem:</strong> I am given access to the site.</p>
  
  <p><strong>Question:</strong> Using the web.config, how can I restrict users based on their Windows credentials to this IIS6 Application?</p>