Question: It was really easy to install elmah with nuget and get it working right away.

The challenge came in while trying to password protect the page. 

In the project I have, there is an `Admin controller` which I use mvc 3 sql membership provider which comes out of the box when u start an mvc 3 app. The default impl is not using any roles. It just validates the user, and only the authorized users can use the admin anyway.

In the elmah log :

```
<authorization>  
    <allow roles="admin" />  
    <allow roles="dev" />  
    <deny users="*" />  
</authorization>  

```

how does this work? how can i define and pass these roles so elmah would understand this?

is there an easier way to do this?

Answer: 
You look like you're on the right track. Since you trust any logged in user, you first deny anonymous user access and then allow authorized user access like this:

```
<authorization>
  <deny users="?"/>
  <allow users="*"/>
</authorization>

```
There's a Nuget package by Alexander Beletsky that makes it very easy to integrate Elmah with MVC and role-based security: [Elmah.MVC](http://nuget.org/packages/Elmah.MVC). It works great and creates a controller that can be secured by role and allows nice routing as well. 

Here is the [project page](https://github.com/alexanderbeletsky/elmah.mvc.controller).