title: Forms Authentication - Subfolder Web.Config not working
body: <p>I need an area in my website where only certain users can view.</p>
  
  <p>What I did was create a  Video folder. Under that foler I have folders
  One called Login and the other called WatchVid. In the Login folder I have a page called Login.aspx. Once the user logins in they will then go to /WatchVid/Watch.aspx
  Below is a representation:</p>
  
  <pre><code>    Video Folder
        |
        | 
        ----&gt; Login Folder
        |        |
        |        |  
        |        ---&gt; Login.aspx 
        |
        ----&gt; WatchVid Folder
                   |
                   |
                   ---&gt;Watch.aspx                  
  </code></pre>
  
  <p>I have the following web config file in my WatchVid to only allow roles that have VidUser to view the page:</p>
  
  <pre><code>    &lt;?xml version="1.0"?&gt;
      &lt;configuration&gt;
      &lt;system.web&gt;
       &lt;authorization&gt;
          &lt;allow roles="VidUser" /&gt;
          &lt;deny users="?" /&gt;
       &lt;/authorization&gt;
      &lt;/system.web&gt;
      &lt;/configuration&gt;
  </code></pre>
  
  <p>What I am finding is that even if I change:</p>
  
  <pre><code>      &lt;allow roles="VidUser" /&gt; 
  
       To: 
  
        &lt;allow roles="VidUser1" /&gt;
  </code></pre>
  
  <p>I can still get to this the Watch.aspx page <strong><em>even though</em></strong> I do not have a role of VidUser1.</p>
  
  <p>Am I doing something wrong?</p>
  
  <p>Just as a reference below is the code I use once the user logins in with their userid, pwd:</p>
  
  <pre><code>    protected void btnLogin_Click(object sender, EventArgs e)
      {
          if (Roles.IsUserInRole(txtUserName.Text, "StreamingUser"))
           {
               const string url = "~/Video/WatchVid/Watch.aspx";
               Response.Redirect(url);
           }
  </code></pre>
  
  <p>Stephan, I have the following in my root web.config page but still letting me get to the Watch.aspx page:</p>
  
  <pre><code>        &lt;location path="Video/WatchVid"&gt;
          &lt;system.web&gt;
            &lt;authorization&gt;
               &lt;allow roles="StreamingUser1dfdfdfd" /&gt;
               &lt;deny users="?" /&gt;
           &lt;/authorization&gt;
         &lt;/system.web&gt;
         &lt;/location&gt;
  </code></pre>
  
  <p>Note how I created a dummy role of StreamingUser1dfdfdfd just to check  it out. I am still able to get to the Watch.aspx page. </p>
  
  <p><strong>Mike:</strong></p>
  
  <p>I have the following under my WatchVid folder but getting access error when I do it with * - Any idea? :  </p>
  
  <pre><code>     &lt;?xml version="1.0"?&gt;
       &lt;configuration&gt;
       &lt;system.web&gt;
       &lt;authorization&gt;
          &lt;allow roles="StreamingUser" /&gt;
          &lt;deny users="*" /&gt;
        &lt;/authorization&gt;
       &lt;/system.web&gt;
       &lt;/configuration&gt;
  </code></pre>
  
  <p>I get the following message: 
    <em>Unauthorized: Logon failed due to server configuration.  Verify that you have permission to view this directory or page based on the credentials you supplied and the authentication methods enabled on the Web server.  Contact the Web server's administrator for additional assistance.</em></p>
  
  <p>Keep in mind that this still works:</p>
  
  <pre><code>     protected void btnLogin_Click(object sender, EventArgs e)
       {
         if (Roles.IsUserInRole(txtUserName.Text, "StreamingUser"))
         {
           const string url = "~/Video/WatchVid/Watch.aspx";
           Response.Redirect(url);
         }
  </code></pre>
  
  <p>But now it will not let me through to the Watch.aspx page as I get an error.</p>