AllowAnonymousLogIn

Greg,

You need to have anonymous access enabled in IIS because otherwise, the user won't even be able to access public resources such as the login and registration pages. The trick is that you specify another directive in your config which requires a (forms) authentication cookie for all pages (or all pages except for login, registration, etc), and redirects the user to a specified location if they don't have it.

This article on MSDN, although old, should have the information you want http://msdn.microsoft.com/en-us/library/ff647070.aspx. What you're looking for is entirely within the area of IIS administration, so you may be able to save yourself some time by asking a web admin or IT guy to do it.

-- Robert

Greg,

Oh, sorry about that! Too many concepts using the same keywords...

If you look at the section on Security in the DRC, at http://drc.ideablade.com/xwiki/bin/view/Documentation/authorize, you'll see a sections on RequiresAuthorization. If you don't want  your authorization logic to be in the query interceptor itself, you can instead add this attribute to your partial class, or inject a base class into that partial class which has it. (Similarly, you could use RequiresRoles, supplying one role to your authenticated users, and a different role to the guest user.) Otherwise, I believe you'll have to continue validating access with each query, as described on this DRC page.

We do have an example of a robust security model for SilverLight applications in the DRC, at http://drc.ideablade.com/xwiki/bin/view/Documentation/code-sample-secure-infrastructure.

Let me know if I'm still missing something here... thorough, explicit, examination of data access is part of a robust security model in public applications of any sort. It is good of you to be concerned about maintaining that security, even while trying to simplify the development structure of your app.

-- Robert