SG:



I noticed beta1 docs show a <credentials> subsection in the <security>

section of the config file.  If i place the <credentials> subsection

underneath the <cookie...> section, no error is thrown, but invalid logins

(ones that don't meet the user/paasword pair) are not flagged and the user

is forwarded to the secured page.



<security>

     <authentication mode="[Windows/Cookie/Passport]">

          <cookie cookie="[name]" loginurl="[url]" decryptionkey="[key]">

               <credentials passwordformat="[Clear, SHA1, MD5]">

                    <user name="[UserName]" password="[password]"/>

               </credentials>

           </cookie>

     </authentication>



     <authorization>

           <allow users="[comma separated list of users]"

                  roles="[comma separated list of roles]"/>

           <deny users="[comma separated list of users]"

                  roles="[comma separated list of roles]"/>

     </authorization>



     <identity>

          <impersonation enable="[true/false]"/>

     </identity>

</security>





am i missing something?



MCA