Wix MSI Installer:How to allow anonymous authentication when set to override="deny" in applicationHost.Config

Question

I have a web application that we install via a Wix MSI project. The web.config includes the authentication nodes below. Everything installs correctly but after installation, I get the error message: "The configuration section cannot be used at this path". This is due to the configuration locking in applicationHost.config .

<system.webServer>
    <security>
        <authentication>
            <anonymousAuthentication enabled="false" />
            <basicAuthentication enabled="true" />
            <windowsAuthentication enabled="false" />
        </authentication>
    </security>
</system.webServer>

How can I override the applicationHost.config settings during the installation? I do install required Windows Features during the install, but am I missing one?

Same as https://stackoverflow.com/questions/9794985/iis-this-configuration-section-cannot-be-used-at-this-path-configuration-lock ? — PhilDW, Oct 30 '17 at 17:10
No, this is specific to WiX, how to do that from the installer. — Ryannet, Oct 31 '17 at 11:38

score 0 · Accepted Answer · answered Jan 10 '18 at 17:38

This is the solution that worked for me, calling appcmd from a custom action, before InstallFinalize.

<CustomAction Id="UnlockAnonymousAuthentication"
             Execute="deferred"
             Impersonate="no"
             Return="check"
             Directory="TARGETDIR"
             ExeCommand="[SystemFolder]inetsrv\appcmd unlock config /section:anonymousAuthentication" />

<CustomAction Id="UnlockBasicAuthentication"
             Execute="deferred"
             Impersonate="no"
             Return="check"
             Directory="TARGETDIR"
             ExeCommand="[SystemFolder]inetsrv\appcmd unlock config /section:basicAuthentication" />

<CustomAction Id="UnlockWindowsAuthentication"
             Execute="deferred"
             Impersonate="no"
             Return="check"
             Directory="TARGETDIR"
             ExeCommand="[SystemFolder]inetsrv\appcmd unlock config /section:windowsAuthentication" />

<InstallExecuteSequence>
    <Custom Action="UnlockAnonymousAuthentication" Before="InstallFinalize"><![CDATA[NOT Installed]]></Custom>
    <Custom Action="UnlockBasicAuthentication" Before="InstallFinalize"><![CDATA[NOT Installed]]></Custom>
    <Custom Action="UnlockWindowsAuthentication" Before="InstallFinalize"><![CDATA[NOT Installed]]></Custom>
</InstallExecuteSequence>

Hope this helps someone.

score 0 · Answer 2 · answered Jul 21 '20 at 07:10

Here is currently a way to do this directly using the WiX IIS extension WebDirProperties element:

https://wixtoolset.org/documentation/manual/v3/xsd/iis/webdirproperties.html

Something similar to this should work. Notice the critical piece is the WebDirProperties element that specifies the AnonymousAccess="yes" BasicAuthentication="no" WindowsAuthentication="no" which modify the IIS properties you are looking to change during installation.

<?xml version="1.0" encoding="UTF-8"?>
<Wix xmlns="http://schemas.microsoft.com/wix/2006/wi"
 xmlns:iis="http://schemas.microsoft.com/wix/IIsExtension" >

    <Fragment>

    <!-- Install to default web site -->
    <iis:WebSite Id="DefaultWebSite" Description='Default Web Site'>
      <iis:WebAddress Id="AllUnassigned" Port="80" />
    </iis:WebSite>


    <!-- References the installation folder specified in the Product.wxs file under the INSTALLFOLDER -->
    <DirectoryRef Id="WEB_INSTALLFOLDER">

      <!-- Configure virtual dir -->
      <Component Id="VirtualDirectoryComponent"
             Guid="{INSERT-YOUR-OWN-GUID-2C27-427A-A7B1-DA4DBCC79117}"
             KeyPath="yes" >
        <iis:WebVirtualDir Id="VirtualDirectory"
                  Alias="[WEB_DIRECTORY_ALIAS]" Directory="WEB_INSTALLFOLDER"
                  WebSite="DefaultWebSite">
          <iis:WebDirProperties Id="VirtualDirectoryProperties"
             AnonymousAccess="yes" BasicAuthentication="no"
             WindowsAuthentication="no" />
          <iis:WebApplication
             Id="MyWebApplication"
             Name="MyWebApplication" />
        </iis:WebVirtualDir>
      </Component>

    </DirectoryRef>

    </Fragment>

</Wix>

Wix MSI Installer:How to allow anonymous authentication when set to override="deny" in applicationHost.Config

2 Answers2