Our application is using forms authentication and the solution has been working well.
Recently one of our 2008 servers developed a problem where the authorization is not being propagated to subdirectories. In other words in the main web.config we have the following authorization settings.
<authorization> <deny users="?" /> <allow users="*" /> </authorization>
This causes a redirect to the login page for unauthenticated users (pretty standard).
The stylesheets are in the subdirectory /Content/Styles and the Contents directory has another web.config that overrides the authorization with the following:
<?xml version="1.0" encoding="utf-8"?> <configuration> <system.web> <authorization> <allow users="?" /> </authorization> </system.web> </configuration>
This should allow access to the stylesheets directory for unauthenticated users (also pretty standard).
The problem is that the server requests for stylesheets are being redirected to the login page.
I have tried removing the site and application pools and rebuilding them and I have also removed the IIS Role from the server including WAS (windows process activation service) and reinstalled. Neither of these resolved the problem.
I know the configuration is correct because I can take the same application and drop it on a new install of Server 2008 and it works.
Any idea how I can fix this problem without rebuilding the entire machine?