NPM and Windows Authentication

[Guest]

These are the settings that I put so as far as I can tell this is all that is needed to disable windows authentication (from the web.config on :

<system.web>
    <customErrors mode="Off" />
    <compilation debug="false" targetFramework="4.0" tempDirectory="C:\ProgramData\ProGet\Temporary ASP.NET Files" />
    <authentication mode="None">
      <forms defaultUrl="/" loginUrl="/log-in" />
    </authentication>
    <httpHandlers>
      <clear />
      <add path="WebResource.axd" verb="GET" type="System.Web.Handlers.AssemblyResourceLoader" validate="true" />
      <add type="Inedo.Web.Handlers.DynamicHttpHandling,InedoLib" verb="*" path="*" />
    </httpHandlers>
    <httpModules>
      <clear />
      <add name="ProGetHttpModule" type="Inedo.ProGet.WebApplication.ProGetHttpModule" />
    </httpModules>
    <httpRuntime requestValidationMode="2.0" requestPathInvalidCharacters="" maxRequestLength="1048576" executionTimeout="86400" />
        <anonymousIdentification enabled="true" />
  </system.web>

Authentication mode is set to none and anonymous authentication is enabled. I've also disabled the other authentication types in the website.

I'm also curious since they are both pointing to the same folder they are both sharing the same web.config file so if I change something for the annonymous website it would affect the other one.

How is this supposed to work?

[Guest]

You'll want to configure via IIS interface, not by editing web.config.

ProGet is installed with a "Classic" pipeline mode, so this configuration file is not used by IIS. This is how two sites work.

[Guest]

I configured through IIS interface. This doesn't allow you to post screenshots which is why I showed the resulting config file.

Is there a set of instructions that Inetdo provides regarding this setup?

[Guest]

If editing via the web interface changed the web.config file, then the AppPool pipeline is probably configured for "Integrated" mode. So, if you change it to "classic" ,then you can make this setting outside of the config file.

[Guest]

I confirmed the app pool is set to classic pipeline mode.

I confirm that if I go to chrome and attempt to access the feed via a url like this:

http://<host>:<port>/npm/QBS_Core_Release_npm/jquery

I get a prompt for credentials even though annonymous authentication is enabled in IIS management and everything else is disabled.

[Guest]

Hmm that's strange, it should work... it's been reported to by other users; perhaps try copying the webapp on disk and then set up a second app pool as well.

One key thing to look for in the message is the "IIS/Microsoft" HTML styling, as opposed ProGet; if the request is reaching ProGet, you'll either get a very short message (like from the API) or one with tons of HTML/JavaScript/CSS (as opposed to the very simple HTML from above).

Lastly --- we are working on a "per feed" setting to disable this, it's not easy, but we hope to have it in next ProGet (4.6).

[Guest]

Do you know the estimated release date for version 4.6?

If its coming out very soon I might just wait until then else I would need to keep trying to get this work around going.

[Guest]

We're currently targeting Dec 2

[Guest]

I see that the new version was released. I looked at the release notes and didn't find an explicit item indicating the security per feed for NPM. Can you confirm if this new feature made it to the new release or not?

[Guest]

We weren't able to get this fix in v4.6.0, but we did add some infrastructure to support it. We're targeting v4.6.1 currently.

[Guest]

Do you know the scheduled release date for 4.6.1?

[Guest]

In the next day or two is our target.

[Guest]

Is there any update on this yet?

[marc.woolfson_6961]

I've managed to get this working in v5.0.11 by setting up the second ProGet website in IIS with anonymous authentication enabled and pointing to the same physical path as the original website. The same AppPool is shared between the two and is using the Integrated pipeline. No other IIS or .config configuration was required.

In ProGet, for the npm feed that required anonymous access I added the Anonymous user to the feed permissions under Administration > Security > Users & Tasks. Restarting the web services then enabled the anonymous access to the feed using the second website's bindings.