ASP.NET Tutorial/Configuration/authentication

Allowing a single user through the web.config file

<configuration> 
    <system.web>
       <authentication mode="Windows" />
          <allow users="DomainName\Bill" />
          <deny users="*" />
       </authorization>
    </system.web>
</configuration>

Denying all users through the web.config file

<configuration> 
    <system.web>
       <authentication mode="Windows" />
       <authorization>
          <deny users="*" />
       </authorization>
    </system.web>
</configuration>

Modifying the web.config file to add username/password values

<system.web>
   <authentication mode="Forms">
      <forms name="Wrox" loginUrl="Login.aspx" path="/">
         <credentials passwordFormat="Clear">
            <user name="userName" password="Bubbles" />
         </credentials>
      </forms>
   </authentication>
   
   <authorization>
      <deny users="?" />
   </authorization>
</system.web>

Specify all users with the use of the asterisk (*)

<configuration> 
    <system.web>
       <authentication mode="Windows" />
            <allow roles="*" />
       </authorization>
    </system.web>
</configuration>

The <authentication> Node

<configuration> 
    <system.web>
        <authentication mode="Windows|Forms|Passport|None">
            
        </authentication> 
    </system.web>
</configuration>

To allow more than one user

<configuration> 
    <system.web>
       <authentication mode="Windows" />
            <allow users="MyDomain\User1" /> 
            <allow users="MyDomain\User2" />
       </authorization>
    </system.web>
</configuration> 

or you can use the following:
<configuration> 
    <system.web>
       <authentication mode="Windows" />
            <allow users="MyDomain\User1, MyDomain\User2" />
       </authorization>
    </system.web>
</configuration>

web.config file for forms-based authentication

<system.web>
   <authentication mode="Forms">
      <forms name="formName" loginUrl="Login.aspx" path="/" />
   </authentication>
    
   <authorization>
      <deny users="?" />
   </authorization>
</system.web>