Configuring the Web Application to Work with Roles On the Security page of the WSAT, you saw a section called Access Rules. This part of the tool enables you to block or open up resources in your site. It enables you to define rules such as “This folder is blocked for anyone except for users in the Managers role,” or “Anyone can access this file,
except for the users in the Members role and the Joe account.” The tool is quite intuitive to use, so
it isn’t difficult to set up the different rules. However, it has one downside: it stores the security settings
in separate Web.config files, one for each sub folder you configure.
This makes it somewhat difficult to get an overview of all the different security settings. Fortunately,
ASP.NET also enables you to configure the same settings in the main Web.config using
elements. A element has a path attribute that points to a file or folder you want
to confi gure differently. You can use the element for many (but not all) other settings
from Web.config as well (for example, you could set the theme attribute of the element for
the Management folder in the main Web.config). For the following exercise, you only set the child
elements of to those related to security.