Using DNN built in file manager has a secure folder option. The only thing this does is obfuscate the url. In my opinion it does not really enforce a security policy.

If someone were to distribute the url for a secure file location, any non register/logged in user could access contents.

A good example would be the fact I'm a subscriber to the videos on this site. If I were to login and download a video, I can simply logout and paste the link and download again without being prompted for password. The mechanism just hides the link, not the actual content. Isn't this a serious flaw?

How can I implement a more secure folder. I have been trying to add a web.config file in the protected folder but have only been able to lockout all users. It seems that the DNN authentication method is not a TrustedProvider in IIs.

I'm running Server2008r2, IIS 7.5, and DNN 5.06. If I try to access the .NET users icon withing IIS manager I get error that it's not a trusted provider, and the Administrator would need to add info to Global Assembly Cache (GAC).

In what other ways are folks protecting content, particularly without needing to add Windows Users to the Operating system?

My goal is to limit access to users located in a specific Role.

If you also put the file in a File Manager folder and set permissions such that only certain roles can view the file, then non-logged in users and logged in users who don't have the right security role membership will not be able to download the file. This will work if you create the link using LinkClick to create the link.

Joseph,

Thank you for taking the time.

Oddly, I never did scroll down in file manger to expose the additional permissions settings.

I have had no joy implementing them though.

If I set file permissions on a "secure file-system folder" (limiting file access, and browse access to a role) it seems the role is ignored, and only Host user has access to these files, a 404 error is given otherwise. I even tried allowing registered users browse access, but still get the 404 error for all but Host user.

If I limit access to a standard folder to a role, even non logged users can access files in the folder.

I gather, this is why linkClick?FileTicket was mentioned as required.

Obviously I'm missing something.

It is always a good idea to operate after a good night's sleep.

I am still learning the ins and outs of the file manager.

The reason my secure links got 404 error was because I had X'd out (deny) the tick box for all users, view files and browse. I made the tick box blank and all is well.

It would be nice if I could get the same behavior with regular folders, as I'd like a more scalable approach to create the links to files. It seems setting the folder permissions with standard files does absolutely nothing and really should not be present as a choice since it is misleading.

Thanks again for the help!