URL authorization failed for the request

Question

I am in the process of moving some sites over to a new windows 2003 installation running IIS6. However I am running into problems with forms authentication. The sites in question run fine on the old box which is the same OS and IIS version.

When I try to login to the website I get a event log "URL authorization failed for the request" and the page redirects back to:-

http://www.demo.socialclause.net/logout.aspx?ReturnUrl=/Secure/Procurement/Default.aspx

Both the old and new servers contain the same set-up and the same permissions. Obviously I am missing a setting somewhere but cant fathom it out. Can anyone help?

My web.config contains this:-

<authentication mode="Forms">
  <forms slidingExpiration="true" name=".ASPXAUTH" protection="All" loginUrl="~/logout.aspx" timeout="60" ></forms>
</authentication>

and inside the /secure dir (this is not a virtual directory) my web.config contains:-

<?xml version="1.0"?>
<configuration>
  <system.web>
    <authorization>
      <allow roles="ClauseAdmin"/>
      <allow roles="ProcurementAdmin"/>
      <allow roles="ReportAdmin"/>
      <allow roles="SystemAdmin"/>
      <deny users="*"/>
    </authorization>
  </system.web>
</configuration>

The event log shows:

Event Type: Information
Event Source:   ASP.NET 2.0.50727.0
Event Category: Web Event 
Event ID:   1314
Date:       26/05/2009
Time:       21:01:05
User:       N/A
Computer:   WILDEAA1
Description:
Event code: 4007 
Event message: URL authorization failed for the request. 
Event time: 26/05/2009 21:01:05 
Event time (UTC): 26/05/2009 20:01:05 
Event ID: af3bac34e6d74630b937a5a05d0f25f2 
Event sequence: 4 
Event occurrence: 1 
Event detail code: 0 

Application information: 
    Application domain: /LM/W3SVC/2067908276/Root-1-128878416581538912 
    Trust level: Full 
    Application Virtual Path: / 
    Application Path: C:\Inetpub\websites\www.demo.socialclause.net\htdocs\ 
    Machine name: WILDEAA1 

Process information: 
    Process ID: 1076 
    Process name: w3wp.exe 
    Account name: NT AUTHORITY\NETWORK SERVICE 

Request information: 
    Request URL: http://demo.socialclause.net/Secure/Procurement/Default.aspx 
    Request path: /Secure/Procurement/Default.aspx 
    User host address: 91.84.25.241 
    User: richard@wildesoft.net 
    Is authenticated: True 
    Authentication Type: Forms 
    Thread account name: NT AUTHORITY\NETWORK SERVICE 

Answer 1

Try deny users ? (anonymous) instead of * (all)

<authentication mode="Forms">
    <forms name=".ASPXFORMSAUTH" loginUrl="~/Common/Login.aspx" timeout="450" />
  </authentication>
  <authorization>
    <deny users="?" />
    <allow roles="Admin" />
  </authorization>

Answer 2

Try this? Basically, you were stating allow x, y, z and then deny all.

<?xml version="1.0"?>
<configuration>
  <system.web>
    <authorization>
      <deny users="*"/>
      <allow roles="ClauseAdmin"/>
      <allow roles="ProcurementAdmin"/>
      <allow roles="ReportAdmin"/>
      <allow roles="SystemAdmin"/>
    </authorization>
  </system.web>
</configuration>

If that doesn't work, try this.

<?xml version="1.0"?>
<configuration>
  <system.web>
    <authorization>
      <allow roles="ClauseAdmin"/>
      <allow roles="ProcurementAdmin"/>
      <allow roles="ReportAdmin"/>
      <allow roles="SystemAdmin"/>
      <deny users="?"/>
    </authorization>
  </system.web>
</configuration>

Answer 3

I had the same error message cropping up and it turned out that my role names in the authorization section of my web.config were spelled incorrectly.

Answer 4

I have only used the sql role provider so far... i think the answer lies in your role provider you are using. Your users don't seem to be getting assigned roles. Can you supply you web.config section on this? For example this is mine:

      <roleManager enabled="true" defaultProvider="IDTSqlRoleProvider" cacheRolesInCookie="true" cookieProtection="All">
    <providers>
      <clear/>
      <add
        name="IDTSqlRoleProvider"
        type="System.Web.Security.SqlRoleProvider"
        connectionStringName="SqlMembershipConnectionString"
        applicationName="ConsumerSynergy"/>
    </providers>
  </roleManager>

Answer 5

Just guessing here, because I wouldn't use IIS if you paid me, but perhaps you're missing some certificates or password files that need to be installed on the server? Maybe you need to tell IIS about the Roles/Users you're trying to match.

EDIT: Going by the additional information you have revealed I'd rule out certificates and concentrate on how roles are defined. You say they are defined in the database but the fact they became invalid when you switched server suggests three possibilities:

1. Your roles are defined as Windows System Accounts or IIS users.
2. Your roles are defined as database users but your only copied the data tables, not the users (by that I mean database users, not a "users" table in the database).
3. Your roles are defined but permissions to read them have changed.

I suspect it's 1.) IIS users.