Question

I managed to secure a folder structure with URL authorization in IIS7 with the following :

<location path="Reports"> 
  <system.webServer> 
    <security> 
      <authorization> 
        <remove users="*" roles="" verbs="" /> 
      </authorization> 
    </security> 
  </system.webServer> 
</location> 

<location path="Reports/Company1"> 
  <system.webServer> 
    <security> 
      <authorization> 
        <add accessType="Allow" users="User1"/> 
      </authorization> 
    </security> 
  </system.webServer> 
</location> 

<location path="Reports/Company2"> 
  <system.webServer> 
    <security> 
      <authorization> 
        <add accessType="Allow" users="User2" /> 
      </authorization> 
    </security> 
  </system.webServer> 
</location> 

Now my problem is that when User1 from Company1 tries to access a file from the Company2 folder, it gets prompted for credentials. I would like that he receives an “access denied” message. I tried to add a in the second location tag but without success.

Answer 1

Not possible as far as I can see. You need to at least attempt to verify the user before you can display the access denied (by means of custom errors perhaps). However, before this verification has started, there is also no way to determine which user it is.