Access Restrictions

[TotalGeek]

I'm probably missing something obvious but having followed previous posts on the subject and I am confused...

I have added this code to my web.config file...

<location path="default.aspx">
        <system.web>
            <authorization>
                <allow roles="Sec_HapUsers" />
                <deny users="*" />
            </authorization>
        </system.web>
    </location>

However when accessing with a user that is not in the [Sec_HapUsers] AD Group it comes up unauthorized but I am still able to browse to My Files from the link that is above the unauthorized text in the drop down menu.

I am using HAP 8.7... Any ideas?

[nickbro]

Is that an AD Group or an AD Org Unit?

[TotalGeek]

Hi Nick

It is an AD Security Group...

[nickbro]

Should be

[TotalGeek]

The problem though is that although I get the unauthorized page I am still able to browse My Files of that user that should be unauthorized.

Is there a way to stop that from happening?

[nickbro]

MyFiles is an unrestricted section, it'll restrict on the mapping definitions.

To stop a specific user group from seeing MyFiles, open ~/myfiles/web.config and edit it like ~/bookingsystem/web.config

[TotalGeek]

Thanks Nick... There wasn't a web.config in the MyFiles directory otherwise I might have guessed to do that myself...

Many thanks for your help and for such a great project.... I am going to try to badger my bursar to give you a donation...

[nickbro]

If you want to stop any tom dick and harry from getting in, you can try

 <system.web>
...
    <authorization>
      <deny users="?" />
    </authorization>
    <customErrors mode="Off" />
    <trace enabled="true" pageOutput="true" localOnly="false"/>
  </system.web>

Change it to

 <system.web>
...
    <authorization>
      <allow roles="HAP Users" />
      <allow roles="Domain Admins" />
      <deny users="*" />
    </authorization>
    <customErrors mode="Off" />
    <trace enabled="true" pageOutput="true" localOnly="false"/>
  </system.web>

See if that works

[TotalGeek]

Yep Tom, Dick and Harry can't get in now