title: Asp .net mvc 2 forms authentication not working on iis 6. Need helps determining correct routes
body: <p>I'm trying to setup Forms Authentication in an asp.net mvc 2 application that will be hosted on IIS 6. There's an issue somewhere in my routing, but I can't pinpoint exactly where it is.</p>
  
  <p>Here is the route entries I'm using to route the mvc requests through the aspx processing on IIS 6. These may or may not be the "right" way, but they do work on the server at current.</p>
  
  <pre><code>        routes.MapRoute(
              "Default",
              "{controller}.aspx/{action}/{id}",
              new { action = "LogOn", id = "" }
            );
  
          routes.MapRoute(
            "Root",
            "",
            new { controller = "Main", action = "LogOn", id = "" }
          );
  </code></pre>
  
  <p>I've put the [Authorize] attribute on my Main controller.</p>
  
  <p>In my web.config I have: </p>
  
  <pre><code>    &lt;authentication mode="Forms"&gt;
          &lt;forms  loginUrl="~/Main.aspx/LogOn" timeout="2880"/&gt;
      &lt;/authentication&gt;
  </code></pre>
  
  <p>When the application starts, a blank page loads. The page is quite literally blank. I haven't found a way to amend the loginUrl to actually execute the LogOn action &amp; View for my Main controller.</p>
  
  <p><strong>Edited</strong></p>
  
  <p>Just as an fyi, I've setup my routing based on this article so that the mvc routing can work on IIS 6.</p>
  
  <p><a href="http://www.asp.net/mvc/tutorials/using-asp-net-mvc-with-different-versions-of-iis-cs" rel="nofollow noreferrer">http://www.asp.net/mvc/tutorials/using-asp-net-mvc-with-different-versions-of-iis-cs</a></p>
  
  <p>I'm guessing the problem here is that the windows form authentication settings aren't syncing with the routes setup so the app can run on IIS 6 via the aspx extension. </p>
  
  <p>Anyone have thoughts on how I could fix this?</p>
  
  <p><strong>Edit 2</strong></p>
  
  <p>Tried adding the following route:</p>
  
  <pre><code>        routes.MapRoute(
              "Login",
              "Login",
              new { controller = "Main", action = "LogOn" }
            );
  </code></pre>
  
  <p>Amended the web.config to: </p>
  
  <pre><code>    &lt;authentication mode="Forms"&gt;
          &lt;forms  loginUrl="~/Login" timeout="2880"/&gt;
      &lt;/authentication&gt;
  </code></pre>
  
  <p>The result is the same white screen as I originally got. It seems like the page doesn't get processed at all. Viewing the source from page generated shows absolutely nothing....no markup...no html declaration....just nothing.</p>
  
  <p><strong>EDIT 3</strong></p>
  
  <p>It seems that I can't seem to get the correct routing configured with the default forms authentication via the web.config. To circumvent this, I've created my own Authorize attribute class. At current, I only care that the user has logged into the system. To accomodate this, I moved the LogOn &amp; LogOff actions to an Account controller. I've remapped the root path to point to this controller. In my custom Authorize attribute, I check to see if the user is logged in and redirect them back to the LogOn page if they aren't. Here is the code:</p>
  
  <pre><code>        routes.MapRoute(
            "Root",
            "",
            new { controller = "Account", action = "LogOn", id = "" }
          );
  </code></pre>
  
  <p>And here's the code for the RequireLoginAttribute class I derrived.</p>
  
  <pre><code>     [AttributeUsage(AttributeTargets.Class | AttributeTargets.Method)]
          public class RequireLoginAttribute : AuthorizeAttribute, IAuthorizationFilter
          {
              #region IAuthorizationFilter Members
  
              public override void OnAuthorization(AuthorizationContext filterContext)
              {
                  if (!filterContext.HttpContext.Request.IsAuthenticated) 
                  {   
                      //This didn't work...it would try routing to urls like
                      //http://localhost:1524/Main.aspx/Account.aspx/Logon
                      //new RedirectResult("Account.aspx/Logon");
  
                      //This seems sloppy to me somehow, but it works.
                      filterContext.Result = new RedirectToRouteResult(new RouteValueDictionary(new { controller = "Account", action = "LogOn" }));
                  }
  
              }
  
              #endregion
          }
  </code></pre>
  
  <p>Now, I can just apply the [RequireLogin] attribute to the Main controller and it ensures the user must be authenticated.</p>
  
  <p>For the curious, and completeness of this scenerio, I am using the following code in the LogOn action (repository isn't ready yet so things are hard coded):</p>
  
  <pre><code>        public ActionResult LogOn(LogOnModel login, String returnUrl)
          {
              if (ModelState.IsValid)
              {
                  FormsAuthentication.SetAuthCookie(login.UserName, false);
                  return Redirect(returnUrl ?? Url.Action("NextPage", "Main"));
              }
              else
              {
                  return View(login);
              }
          }
  </code></pre>
  
  <p>The returnUrl is a throwback to the Windows Forms authentication. Since I can't seem to get that working here, the parameter will always be null.</p>
  
  <p>Please, critique this if you see specific areas that need improvement. I'm reading what I can and trying to do things right, so all input is greatly appreciated. Thanks!</p>