FBA web app user permissions replicate to full control even after login

Question

I have made a web application with Form Based Authentication that uses a custom form. Then each user is suppsed to enter the restricted area with their specific permissions. What happens instead is that having set in the Policy for Web Application, "All Authenticated Users" to Full Control, the users retain those permissions even after login.

From how I see things, I have to give users permission or they won't be able to login at all, but they shouldn't retain those permissions.

Is there a way I can set another policy about already logged users and to set them the correct permissions they should invidually have?

Thank you for the help.

Answer 1

Any permission you give through Policy for Web Application trumps what is given to that user at site collection/site scope.

You should not give users any rights to login, only to let them access that they should access.

Specifying a page as login page in web.config will give anonymous users access to that page.

Answer 2

Instead of giving rights at web application level, you can configure permissions at site collection level. To achieve this, configure anonymous access with option of settings at "Lists and Libraries". Then enable anonymous access to the individual lists/libraries as per your requirements.

Please note that, with "Anonymous access at List and Libraries" setting, you wont be able to access root site directly like "http://servername" without logging in. This will give u access denied error.

To resolve this, u have to use below script:

web.AnonymousState = SPWeb.WebAnonymousState.Enabled;
web.AnonymousPermMask64 = SPBasePermissions.Open | SPBasePermissions.ViewPages;
web.Update();

Hope this helps!!