web.config allow all users from a specific domain, but not another

Question

I have users from two different domains that can access the web site I am currently working on and I would like to only allow users from one of those domain to access the site. I've done some research and the only thing I was able to come up with is allowing users from a specific domain group, but not from an entire domain only.

I've also come across this post that suggest to check the domain manually upon logon:

http://bytes.com/topic/asp-net/answers/343407-using-web-config-allow-access-domain-users-only

I've added this to the web.config, but it does not appear to be working:

<authorization>
  <deny users="?"/>
  <allow users="FirstDomain\Domain Users"/>
  <deny users="SecondDomain\Domain Users" />
</authorization>

Thanks,

Answer 1

Got it working eventually:

<authorization>
  <allow roles="FirstDomain\Domain Users"/>
  <deny users="*"/>
</authorization>

Answer 2

"Allow" should preceed the "Deny" tags, as in your case, everything will be denied access.

<system.web>
 <authorization>
  <allow users="FirstDomain\Domain Users"/>
  <deny users="SecondDomain\Domain Users" />
 </authorization>
</system.web>

Hope this helps.