I have made a web application with Form Based Authentication that uses a custom form. Then each user is suppsed to enter the restricted area with their specific permissions. What happens instead is that having set in the Policy for Web Application, "All Authenticated Users" to Full Control, the users retain those permissions even after login.

From how I see things, I have to give users permission or they won't be able to login at all, but they shouldn't retain those permissions.

Is there a way I can set another policy about already logged users and to set them the correct permissions they should invidually have?

Thank you for the help.

2 Answers 2


Any permission you give through Policy for Web Application trumps what is given to that user at site collection/site scope.

You should not give users any rights to login, only to let them access that they should access.

Specifying a page as login page in web.config will give anonymous users access to that page.

  • Thank you for your help. Being still a beginer here could some1 pls tell me, or post some usefull link, how to specify the login page for the FBA in the web.config?
    – iris
    Sep 28, 2012 at 10:33
  • For SharePoint 2010 it's not set in the web.config - if you want a custom login page you specify it in Central Admin -> Manage Web Applications -> Authentication Providers. Anonymous custom application pages need to inherit from UnsecuredLayoutsPageBase to have anonymous access. Oct 3, 2012 at 17:40

Instead of giving rights at web application level, you can configure permissions at site collection level. To achieve this, configure anonymous access with option of settings at "Lists and Libraries". Then enable anonymous access to the individual lists/libraries as per your requirements.

Please note that, with "Anonymous access at List and Libraries" setting, you wont be able to access root site directly like "http://servername" without logging in. This will give u access denied error.

To resolve this, u have to use below script:

web.AnonymousState = SPWeb.WebAnonymousState.Enabled;
web.AnonymousPermMask64 = SPBasePermissions.Open | SPBasePermissions.ViewPages;

Hope this helps!!

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.