authenticationiisweb-configapplicationhost

IIS Authentication in web.config

In our project, a user can upload documents to a directory. The problem is that a user cannot access those files via the URL.

After playing around with permissions in IIS, I was able to download a file by changing the permissions on the file (or folder) to allow "Read" by IIS_IUSRS. My issue is that the folders are also dynamically generated and I do not want to manually have to go through and change the permissions on each.

I'm attempting to get the web.config file to allow reading of these files, but I cannot get the proper configuration.

In the site's web.config file I have:

<?xml version="1.0" encoding="UTF-8"?>
<configuration>
    <location path="path/to/upload/directory">
        <system.webServer>
            <security>
                <authentication>
                    <windowsAuthentication enabled="false" />
                    <anonymousAuthentication enabled="true" />
                </authentication>
            </security>
        </system.webServer>
    </location>
</configuration>

However upon accessing the file again, I get a 500.19 error:

AnonymousAuthenticationModule
This configuration section cannot be used at this path. This happens when the section is locked at a parent level. Locking is either by default (overrideModeDefault="Deny"), or set explicitly by a location tag with overrideMode="Deny" or the legacy allowOverride="false".

Following this answer, I set AnonymousAuthenticationModule to lockItem="false", anonymousAuthentication to Allow in applicationHost.config, and restarted the server. After all of that, I still get the same 500.19 error.

Solution

  • When you say the folders are generated dynamically, do you mean generated through code? If so, you could make sure the parent directory has the required permissions and then set the permissions on its subdirectories to "inherit". For a file, it would be

    Dim perms = File.GetAccessControl(targetFile)
perms.SetAccessRuleProtection(False, False)
File.SetAccessControl(targetFile, perms)

    I expect that you can find the equivalent for a directory.