title: MVC 3 location allow users in web.config
body: <p>I am trying to make authorize by using web.config.
  In my user registration, it is not using ASP.NET Configuration.
  I am handling the login page with database.
  I want to protect admin page as manual typing in address from other people.
  I put this code in Web.config.</p>
  
  <pre><code>//Web.config
  &lt;location path="Product"&gt;
  &lt;system.web&gt;
    &lt;authorization&gt;
      &lt;allow users="*"/&gt;
    &lt;/authorization&gt;
  &lt;/system.web&gt;
  </code></pre>
  
  <p></p>
  
  <p>When admin log in website from homepage which has partial logon page, 
  It will get userName and admin whether is false or true through database.</p>
  
  <pre><code>[HttpPost]
      public ActionResult Index(Customer model)
      {
          if (ModelState.IsValid)
          {
              //define user whether admin or customer
              SqlConnection conn = new SqlConnection(ConfigurationManager.ConnectionStrings["rentalDB"].ToString());
              String find_admin_query = "SELECT admin FROM Customer WHERE userName = '" + model.userName + "' AND admin ='true'";
              SqlCommand cmd = new SqlCommand(find_admin_query, conn);
              conn.Open();
              SqlDataReader sdr = cmd.ExecuteReader();
              //it defines admin which is true or false
              model.admin = sdr.HasRows;
              conn.Close();
  
              //if admin is logged in
              if (model.admin == true) {
                  if (DAL.UserIsVaild(model.userName, model.password))
                  {
                      FormsAuthentication.SetAuthCookie(model.userName, true);
                      return RedirectToAction("Index", "Product");
                  }
              }
  
              //if customer is logged in
              if (model.admin == false) { 
                  if (DAL.UserIsVaild(model.userName, model.password))
                  {
                      FormsAuthentication.SetAuthCookie(model.userName, true);                   
                      return RedirectToAction("Index", "Home");
                  }
              }
                  ModelState.AddModelError("", "The user name or password is incorrect.");
          }
          // If we got this far, something failed, redisplay form
          return View(model);
      }
  </code></pre>
  
  <p>Then my question is, how can I define the user by web.config instead of "*", like using model.userName or model.admin? Could you tell me how to define the users? thanks.</p>