Skip to content

Commit 3998da2

Browse files
span786span786
authored
Merge pull request #405 from puppetlabs/CAT-2303-support-managing-forms-within-authentication-info-for-puppetlabs-iis-resources-case-01325478
(CAT-2303): Enhance FormsAuthentication handling for IIS applications
2 parents b24fa92 + e63f342 commit 3998da2

File tree

7 files changed

+173
-15
lines changed

7 files changed

+173
-15
lines changed

‎lib/puppet/provider/iis_application/webadministration.rb‎

Lines changed: 16 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -37,7 +37,8 @@ def sslflags=(value)
3737
def authenticationinfo=(value)
3838
# Using property flush to find just the changed values, for speed
3939
@property_flush[:authenticationinfo] = value.select do |k, v|
40-
authenticationinfo.key?(k) && authenticationinfo[k] != v
40+
auth_info = authenticationinfo.is_a?(Hash) ? authenticationinfo : @resource[:authenticationinfo]
41+
auth_info.key?(k) && auth_info[k] != v
4142
end
4243
end
4344

@@ -90,9 +91,20 @@ def update
9091
"-Filter 'system.webserver/security/access' -Name 'sslFlags' -Value '#{flags}' -ErrorAction Stop"
9192
end
9293

93-
@property_flush[:authenticationinfo]&.each do |auth, _enable|
94-
inst_cmd << "Set-WebConfigurationProperty -Location '#{self.class.find_sitename(resource)}/#{app_name}' " \
95-
"-Filter 'system.webserver/security/authentication/#{auth}Authentication' -Name enabled -Value #{@property_flush[:authenticationinfo][auth]} -ErrorAction Stop"
94+
@property_flush[:authenticationinfo]&.each do |auth, enable|
95+
if auth == 'forms'
96+
# Handle formsAuthentication separately
97+
mode_value = enable ? 'Forms' : 'None'
98+
# For Forms authentication, we need to set the mode value in the system.web section, not the system.webserver section
99+
# This is a workaround for the fact that the WebAdministration module does not support setting the mode value for Forms authentication
100+
# at the site level
101+
inst_cmd << "Set-WebConfigurationProperty -PSPath 'IIS:/Sites/#{self.class.find_sitename(resource)}/#{app_name}' " \
102+
"-Filter 'system.web/authentication' -Name 'mode' -Value '#{mode_value}' -ErrorAction Stop"
103+
else
104+
# Handle other authentication types
105+
inst_cmd << "Set-WebConfigurationProperty -Location '#{self.class.find_sitename(resource)}/#{app_name}' " \
106+
"-Filter 'system.webserver/security/authentication/#{auth}Authentication' -Name enabled -Value #{enable} -ErrorAction Stop"
107+
end
96108
end
97109

98110
if @property_flush[:enabledprotocols]

‎lib/puppet/provider/iis_site/webadministration.rb‎

Lines changed: 22 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -62,13 +62,29 @@ def update
6262

6363
cmd << self.class.ps_script_content('serviceautostartprovider', @resource)
6464

65-
@resource[:authenticationinfo]&.each do |auth, _enable|
65+
@resource[:authenticationinfo]&.each do |auth, enable|
6666
args = []
67-
args << "-Filter 'system.webserver/security/authentication/#{auth}Authentication'"
68-
args << "-PSPath 'IIS:\\'"
69-
args << "-Location '#{@resource[:name]}'"
70-
args << '-Name enabled'
71-
args << "-Value #{@resource[:authenticationinfo][auth]}"
67+
if auth == 'forms'
68+
# Handle formsAuthentication separately
69+
mode_value = enable ? 'Forms' : 'None'
70+
# For Forms authentication, we need to set the mode value
71+
# in the system.web section, not the system.webserver section
72+
args << "-Filter 'system.web/authentication'"
73+
74+
# This is a workaround for the fact that the WebAdministration module
75+
# does not support setting the mode value for Forms authentication
76+
# at the site level
77+
args << "-PSPath 'IIS:\\Sites\\#{@resource[:name]}'"
78+
args << "-Name 'mode'"
79+
args << "-Value '#{mode_value}'"
80+
else
81+
# Handle other authentication types
82+
args << "-Filter 'system.webserver/security/authentication/#{auth}Authentication'"
83+
args << "-PSPath 'IIS:\\'"
84+
args << "-Location '#{@resource[:name]}'"
85+
args << '-Name enabled'
86+
args << "-Value #{enable}"
87+
end
7288
cmd << "Set-WebConfigurationProperty #{args.join(' ')} -ErrorAction Stop\n"
7389
end
7490

‎lib/puppet/provider/templates/webadministration/_getwebsites.ps1.erb‎

Lines changed: 9 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -24,8 +24,15 @@ Get-WebSite | % {
2424
'forms'
2525
)
2626
$authenticationTypes | Foreach-Object -Begin { $info = @{} } -Process {
27-
$p = Get-WebConfiguration -Filter "system.webserver/security/authentication/$($_)Authentication" -PSPath "IIS:\sites\$($name)"
28-
$info["$($_)"] = $p.enabled
27+
if ($_ -eq 'forms') {
28+
# Special handling for formsAuthentication
29+
$p = Get-WebConfigurationProperty -Filter "system.web/authentication" -Name "mode" -PSPath "IIS:\Sites\$($name)" -ErrorAction SilentlyContinue
30+
$info["$($_)"] = if ($p -eq 'Forms') { $true } else { $false }
31+
} else {
32+
# Handle other authentication types
33+
$p = Get-WebConfiguration -Filter "system.webserver/security/authentication/$($_)Authentication" -PSPath "IIS:\sites\$($name)" -ErrorAction SilentlyContinue
34+
$info["$($_)"] = $p.enabled
35+
}
2936
}
3037
$authenticationinfo = New-Object -TypeName PSObject -Property $info
3138

‎lib/puppet/provider/templates/webadministration/getapps.ps1.erb‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -26,7 +26,7 @@ Get-WebApplication | % {
2626
clientCertificateMapping = [bool](Get-WebConfiguration -Location "${site}/${name}" -Filter "system.webserver/security/authentication/clientCertificateMappingAuthentication").enabled
2727
iisClientCertificateMapping = [bool](Get-WebConfiguration -Location "${site}/${name}" -Filter "system.webserver/security/authentication/iisClientCertificateMappingAuthentication").enabled
2828
windows = [bool](Get-WebConfiguration -Location "${site}/${name}" -Filter "system.webserver/security/authentication/windowsAuthentication").enabled
29-
forms = [bool](Get-WebConfiguration -Location "${site}/${name}" -Filter "system.webserver/security/authentication/formsAuthentication").enabled
29+
forms = [string](Get-WebConfigurationProperty -Location "${site}/${name}" -Filter "system.web/authentication" -Name "mode") -eq "Forms"
3030
}
3131
enabledprotocols = [string]$_.enabledProtocols
3232
}

‎metadata.json‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,7 @@
1010
"dependencies": [
1111
{
1212
"name": "puppetlabs/pwshlib",
13-
"version_requirement": ">= 0.4.0 < 2.0.0"
13+
"version_requirement": ">= 0.4.0 < 2.1.0"
1414
}
1515
],
1616
"operatingsystem_support": [

‎spec/unit/puppet/provider/iis_application/webadministration_spec.rb‎

Lines changed: 55 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -80,7 +80,61 @@
8080

8181
describe 'updating physicalpath'
8282
describe 'updating sslflags'
83-
describe 'updating authenticationinfo'
83+
describe 'updating authenticationinfo for IIS_Application' do
84+
let(:params) do
85+
{
86+
title: 'foo\bar',
87+
name: 'foo\bar',
88+
ensure: :present,
89+
sitename: 'foo',
90+
applicationname: 'bar',
91+
applicationpool: 'DefaultAppPool',
92+
enabledprotocols: 'http,https',
93+
authenticationinfo: {
94+
'anonymous' => true,
95+
'basic' => false,
96+
'clientCertificateMapping' => false,
97+
'digest' => false,
98+
'iisClientCertificateMapping' => false,
99+
'windows' => true,
100+
'forms' => false
101+
},
102+
}
103+
end
104+
let(:authenticationinfo) do
105+
{
106+
'anonymous' => true,
107+
'basic' => false,
108+
'clientCertificateMapping' => false,
109+
'digest' => false,
110+
'iisClientCertificateMapping' => false,
111+
'windows' => false,
112+
'forms' => true
113+
}
114+
end
115+
116+
before :each do
117+
cmdtext = "$webApplication = Get-WebApplication -Site 'foo' -Name 'bar'"
118+
cmdtext += "\n"
119+
authenticationinfo.each do |auth, enable|
120+
if auth == 'forms' # Forms authentication requires a different command
121+
mode_value = enable ? 'Forms' : 'None'
122+
cmdtext += "Set-WebConfigurationProperty -PSPath 'IIS:/Sites/foo/bar' " \
123+
"-Filter 'system.web/authentication' -Name 'mode' -Value '#{mode_value}' -ErrorAction Stop\n"
124+
else
125+
cmdtext += "Set-WebConfigurationProperty -Location 'foo/bar' " \
126+
"-Filter 'system.webserver/security/authentication/#{auth}Authentication' -Name enabled -Value #{enable} -ErrorAction Stop\n"
127+
end
128+
end
129+
allow(Puppet::Provider::IIS_PowerShell).to receive(:run).and_return(exitcode: 0)
130+
end
131+
132+
it 'updates value' do
133+
iis_application_provider.authenticationinfo = authenticationinfo
134+
iis_application_provider.update
135+
end
136+
end
137+
84138
describe 'updating enabledprotocols' do
85139
let(:params) do
86140
{

‎spec/unit/puppet/provider/iis_site/webadministration_spec.rb‎

Lines changed: 69 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,7 @@
11
# frozen_string_literal: true
22

33
require 'spec_helper'
4+
require 'puppet/provider/iis_powershell'
45

56
describe Puppet::Type.type(:iis_site).provider(:webadministration) do
67
subject(:webadministration) { described_class.new }
@@ -57,4 +58,72 @@
5758
end
5859
end
5960
end
61+
62+
context 'updating authenticationinfo for IIS_Site' do
63+
let(:iis_site_resource) do
64+
result = Puppet::Type.type(:iis_site).new(
65+
name: 'foo',
66+
ensure: :present,
67+
physicalpath: 'C:\inetpub\wwwroot\foo',
68+
applicationpool: 'MyAppPool',
69+
enabledprotocols: 'http,https',
70+
authenticationinfo: {
71+
'anonymous' => true,
72+
'basic' => false,
73+
'clientCertificateMapping' => false,
74+
'digest' => false,
75+
'iisClientCertificateMapping' => false,
76+
'windows' => false,
77+
'forms' => true
78+
},
79+
)
80+
result.provider = webadministration
81+
result
82+
end
83+
let(:authenticationinfo) do
84+
{
85+
'anonymous' => true,
86+
'basic' => false,
87+
'clientCertificateMapping' => false,
88+
'digest' => false,
89+
'iisClientCertificateMapping' => false,
90+
'windows' => false,
91+
'forms' => true
92+
}
93+
end
94+
95+
before :each do
96+
cmd = []
97+
cmd << described_class.ps_script_content('_setwebsite', iis_site_resource)
98+
cmd << described_class.ps_script_content('trysetitemproperty', iis_site_resource)
99+
cmd << described_class.ps_script_content('generalproperties', iis_site_resource)
100+
cmd << described_class.ps_script_content('bindingproperty', iis_site_resource)
101+
cmd << described_class.ps_script_content('logproperties', iis_site_resource)
102+
cmd << described_class.ps_script_content('limitsproperty', iis_site_resource)
103+
cmd << described_class.ps_script_content('serviceautostartprovider', iis_site_resource)
104+
authenticationinfo.each do |auth, enable|
105+
args = []
106+
if auth == 'forms' # Forms authentication requires a different command
107+
mode_value = enable ? 'Forms' : 'None'
108+
args << "-Filter 'system.web/authentication'"
109+
args << "-PSPath 'IIS:\\Sites\\foo'"
110+
args << "-Name 'mode'"
111+
args << "-Value '#{mode_value}'"
112+
else
113+
args << "-Filter 'system.webserver/security/authentication/#{auth}Authentication'"
114+
args << "-PSPath 'IIS:\\'"
115+
args << "-Location 'foo'"
116+
args << '-Name enabled'
117+
args << "-Value #{enable}"
118+
end
119+
cmd << "Set-WebConfigurationProperty #{args.join(' ')} -ErrorAction Stop\n"
120+
end
121+
allow(Puppet::Provider::IIS_PowerShell).to receive(:run).and_return(exitcode: 0)
122+
end
123+
124+
it 'updates value' do
125+
webadministration.authenticationinfo = authenticationinfo
126+
webadministration.update
127+
end
128+
end
60129
end

0 commit comments

Comments
 (0)