I have spent a day and a half trying to resolve this issue. Bascially have an ASP.net website with Forms Authentication on IIS7 using Framework 4.0.
The Authorizati
I had a similar problem today. I was trying use the integrated pipeline to secure non-asp.net resources (static files, php, etc.).
I had a rule in my root web.config that had , then I was allowing access to specific resources on a case by case basis.
This worked except that requests to "/" could never be authenticated (endlessly redirecting to the login page), while requests to "/Default.aspx" were fine.
My problem was because the Asp.Net UrlAuthentication module was enabled for all resource types, and apparently this doesn't work for my scenario. Instead I had to change that module to work for managed resources only and install IIS7's non-managed url authentication. I then had to configure that (since it uses different authentication settings), and make sure that the RoleManager was enabled for non-managed resources (since I was authenticating on roles). This URL might be helpful: http://learn.iis.net/page.aspx/142/understanding-iis-70-url-authorization/