<?xml version="1.0" encoding="utf-8"?>
<configuration>
  <appSettings>
    <add key="Users" value="BobJ,JosephB"/>
  </appSettings>
  <system.webServer>
    <handlers>
      <add name="HTML" path="*.html" verb="GET, HEAD, POST, DEBUG"   type="System.Web.UI.PageHandlerFactory" resourceType="Unspecified" requireAccess="Script" />
      <add name="HTM" path="*.htm" verb="GET, HEAD, POST, DEBUG" type="System.Web.UI.PageHandlerFactory" resourceType="Unspecified" requireAccess="Script" />
    </handlers>
  </system.webServer>
  <system.web>
    <authentication mode="Forms">
      <forms name="appNameAuth" path="/" loginUrl="login.aspx" defaultUrl="index.html" protection="All" timeout="525600">
        <credentials passwordFormat="Clear">
          <user name="[user]" password="[password]" />
        </credentials>
      </forms>
    </authentication>
    <authorization>
      <deny users="?" />
    </authorization>
    <compilation debug="true" targetFramework="4.5">
      <buildProviders>
        <add extension=".html" type="System.Web.Compilation.PageBuildProvider" />
        <add extension=".htm" type="System.Web.Compilation.PageBuildProvider" />
      </buildProviders>
    </compilation>
    <httpRuntime targetFramework="4.5" />
    <customErrors mode="Off"/>
  </system.web>
</configuration>

protected void Page_Load(object sender, EventArgs e)
{
    string htmlPage = Convert.ToString(Request.QueryString["ReturnUrl"]);
    string user = Request.LogonUserIdentity.Name;

    string users = ConfigurationManager.AppSettings["Users"].ToString();

    string[] allUsers = users.Split(',');

    if (allUsers.ToList().Contains(user))
    {
        Response.Redirect(htmlPage);
    }
    else
    {
        Response.Redirect("InvalidUser.html");
    }

}