如何拒绝使用ASP.NET Web配置访问文件，而不仅仅是本地？

I have a problem with ASP.NET web configuration file. I want to deny some users or roles to accessing a specific PDF file. I am using ASP.NET membership and role management system. So I added this lines of codes to a Web.config file:I have a problem with ASP.NET web configuration