Enabling FormsAuthentication for multiple subfolders in a site

Question

We're trying to implement formsAuthentication on our site, but in a scenario that we haven't been able to find a solution for yet - other than creating our own HttpModule and doing the custom logic ourselves - so I thought I'd toss the question out there to see if this was indeed the only solution.

We'd like to use formsAuthentication on top of custom Membership providers, but would like to use a different provider for different folders. Our site partitions these sections with subfolders (eg: ~/Admin, ~/GoldCustomer, ~/SilverCustomer, ~/BronzeCustomer), so we'd like to use different Membership providers for each section/subfolder. Using the framework to support this, we'd implement our web.config like:

<configuration xmlns="http://schemas.microsoft.com/.NetConfiguration/v2.0">
<location path="Admin">
<system.web>
  <authentication mode="Forms">
    <forms name="AdminAuth" loginUrl="~/AdminLogin.aspx" />
  </authentication>
  <membership defaultProvider="AdminProvider" >
    <providers >
      <add connectionStringName="ConnString" name="AdminProvider" type="Assembly.AdminMembershipProvider" ... />
    </providers>
  </membership>
</system.web>
</location>
<location path="GoldCustomer">
  <system.web>
  <authentication mode="Forms">
    <forms name="GoldCustomerAuth" loginUrl="~/GoldCustomerLogin.aspx" />
  </authentication>
  <membership defaultProvider="GoldCustomerProvider" >
    <providers >
      <add connectionStringName="ConnString" name="GoldCustomerProvider" type="Assembly.GoldCustomerMembershipProvider" ...="" />
    </providers>
  </membership>
</system.web>
</location>
<system.web>
  <compilation debug="true" />
  <authentication mode="Forms" />
</system.web>
</configuration>

Doing this though results in the runtime error:

It is an error to use a section registered as allowDefinition='MachineToApplication' beyond application level. This error can be caused by a virtual directory not being configured as an application in IIS.

Line 11:   <location path="Admin">
Line 12:     <system.web>
Line 13:       <authentication mode="Forms">
Line 14:         <forms name="FormsAdmin" loginUrl="~/login.aspx" />
Line 15:       </authentication>

It seems that the only way to accomplish what we're trying is with a custom HttpModule - or change our approach (like breaking the folders up into different web apps in IIS). Is this correct, or am I missing something? Or are there other alternatives I'm not aware of?

Thanks for your help!

Answer 1

First of all, I think role-based security makes perfect sense for your application if you have control over the databases. But if you can't change it, it's a no-go.

The alternative solution can be a gateway login forms that redirects user to folder specific login form based on ReturnUrl querystring variable and that form will use the provider it wants to validate the user. Then it uses the FormsAuthentication.RedirectFromLoginPage to set an authentication cookie and redirect to the previous page. You can set the roles and use role based security to control access to each folder with <authorization> tag in web.config.

Answer 2

I'm not sure what you're trying to do but how about Roles for each of these customer types? Limit access by a role for each sub folder but you'd still have 1 membership provider and 1 role provider.