I have a website that will:
1) Authenticate local intranet users automatically
2) But still allow *all* users to use the website (they just get different privileges).
The *only* way I have been able to get the Identity of the user visiting the website, is if I put:
<authorization>
<deny users="?"/>
</authorization>
In my web.config. I don't understand what, exactly, that means though, and that bothers me. Will this allow any user to visit the website? If I *dont* have this line in the config, than HttpContext.User.Identity is anonymous and has no authorization information (no user name, etc). Can anyone clarify what's going on here?
...
Go to the complete details ...