title: How do I secure Elmah on ASP.Net MVC 4 with Windows Integrated Security : Elmah ignores my settings
body: <p>I've added elmah to an asp.net mvc 4 application.
  Logging is working and now I am trying to configure security but elmah is not picking up the settings and the logs remain visible by all users.</p>
  
  <p>This is an intranet app and as such we are using windows integrated secuirty. I am trying to restrict access so that only members of the domain\log_readers ad group can read the logs.</p>
  
  <p>I've read the setup guide here: <a href="http://code.google.com/p/elmah/wiki/SecuringErrorLogPages" rel="noreferrer">http://code.google.com/p/elmah/wiki/SecuringErrorLogPages</a> and I've also read several posts on SO and other formums which has led me to add the roleManager and WindowsRoleProvider configuration, all to no avail.</p>
  
  <p>Here are the elmah parts of my web.config: </p>
  
  <pre><code>&lt;elmah&gt;
  &lt;!--
      See http://code.google.com/p/elmah/wiki/SecuringErrorLogPages for 
      more information on remote access and securing ELMAH.
  --&gt;
  &lt;security allowRemoteAccess="true" /&gt;
  &lt;errorLog type="Elmah.XmlFileErrorLog, Elmah" logPath="~/Logs" /&gt;  
  &lt;/elmah&gt;
  &lt;location path="elmah.axd" inheritInChildApplications="false"&gt;
  &lt;system.web&gt;
    &lt;authentication mode="Windows" /&gt;
  
    &lt;roleManager defaultProvider="WindowsProvider"
        enabled="true" cacheRolesInCookie="false"&gt;
      &lt;providers&gt;
        &lt;add
          name="WindowsProvider"
          type="System.Web.Security.WindowsTokenRoleProvider" /&gt;
      &lt;/providers&gt;
    &lt;/roleManager&gt;
    &lt;httpHandlers&gt;
      &lt;add verb="POST,GET,HEAD" path="elmah.axd" type="Elmah.ErrorLogPageFactory, Elmah" /&gt;
    &lt;/httpHandlers&gt;
    &lt;!-- 
      See http://code.google.com/p/elmah/wiki/SecuringErrorLogPages for 
      more information on using ASP.NET authorization securing ELMAH.
    --&gt;
    &lt;authorization&gt;
      &lt;allow roles="domain\log_readers"/&gt;
      &lt;deny users="*" /&gt;
    &lt;/authorization&gt;
  
  &lt;/system.web&gt;
  &lt;system.webServer&gt;
    &lt;handlers&gt;
      &lt;add name="ELMAH" verb="POST,GET,HEAD" path="elmah.axd" type="Elmah.ErrorLogPageFactory, Elmah" preCondition="integratedMode" /&gt;
    &lt;/handlers&gt;
  &lt;/system.webServer&gt;
  &lt;/location&gt;
  </code></pre>
  
  <p>I have also tried a complete lock down by setting my autorisation config to deny everyone</p>
  
  <pre><code>&lt;authorization&gt;
  &lt;deny users="*" /&gt;
  &lt;/authorization&gt;
  </code></pre>
  
  <p>and also </p>
  
  <pre><code>&lt;authorization&gt;
  &lt;deny users="?" /&gt;
  &lt;/authorization&gt;
  </code></pre>
  
  <p>The logs remain open to everyone.  </p>
  
  <p>I suspect the problem may be with the location. I've made no changes to the elmah location. It is accessed from default location (<a href="http://server/myapp/elmah" rel="noreferrer">http://server/myapp/elmah</a>)</p>