title: ASP.NET Forms Auth Allowing access to specific file in subdirectory when all others should be denied
body: <p>I am having problems allowing a specific Role access to a specific page in a subdirectory.</p>
  
  <p>My ASP.NET application has a directory, ~/Forms/Administration that has limited access.  There is a specific file, ~/Forms/Administration/Default.aspx that I want to give 1 additional user role access to, as well as the Admin role.</p>
  
  <p>In ~/Forms/Administration, I have a web.config file that looks like this:</p>
  
  <pre><code>   &lt;?xml version="1.0" encoding="utf-8"?&gt;
  &lt;configuration&gt;
      &lt;system.web&gt;
          &lt;authorization&gt;
              &lt;allow roles="Administrator, User" /&gt;
              &lt;deny users="*"/&gt;
          &lt;/authorization&gt;
      &lt;/system.web&gt;
  
      &lt;location path="Forms/Administration/Default.aspx"&gt;
          &lt;system.web&gt;
              &lt;authorization&gt;
                  &lt;allow roles="Administrator, User, AdditionalUser" /&gt;
              &lt;/authorization&gt;
          &lt;/system.web&gt;
      &lt;/location&gt;
  
  &lt;/configuration&gt;
  </code></pre>
  
  <p>The Admin user works just fine, but AdditionalUser always fails.  I've tried a number of things - listing the location as </p>
  
  <pre><code>&lt;location path="Forms/Administration/Default.aspx"&gt;
  </code></pre>
  
  <p>And as</p>
  
  <pre><code>&lt;location path="~/Forms/Administration/Default.aspx"&gt;
  </code></pre>
  
  <p>Is the deny="*" from the first generic rule taking precedent?  I tried changing </p>
  
  <pre><code>&lt;deny users="*"/&gt;
  </code></pre>
  
  <p>To</p>
  
  <pre><code>&lt;deny users="?"/&gt;
  </code></pre>
  
  <p>But that ends up giving AdditionalUser access to <em>everything</em>.  Suggestions?</p>
  
  <p>EDIT: I tried putting the location specific allow <em>before</em> the generic deny rule, in case order mattered.  Same problem.</p>
  
  <p>UPDATE: I am clearly missing something here: I removed the deny * config, and left <em>only</em> the location specific section.  Then, instead of allowing on certain roles, I set that one to deny all (*).  However, it is not denying me at all when I login. I even reduced the rule to not be file specific, but apply to the whole directory, and it's not denying me anything.  However, the original non-location specific rules do work, so I know this config file is being read.</p>
  
  <pre><code>&lt;?xml version="1.0" encoding="utf-8"?&gt;
  &lt;configuration&gt;
      &lt;location path="Forms/Administration"&gt;
          &lt;system.web&gt;
              &lt;authorization&gt;
                  &lt;deny users="*" /&gt;
              &lt;/authorization&gt;
          &lt;/system.web&gt;
      &lt;/location&gt;
  &lt;/configuration&gt;
  </code></pre>