xWebConfigPropertyCollection: Multiple Properties

[pyrostew]

Details of the scenario you tried and the problem that is occurring

I am trying to add some entries to the "system.ftpserver/security/authorization" collection, both in the root of an FTPSite and in 2 virtual directories within that site. Essentially I am trying to match the output of the script below.

import-module webadministration

new-webftpsite -Name "FTPSite" -Port "21" -physicalpath "D:\resources" -Force

set-itemproperty "IIS:\Sites\FTPSite" -name ftpServer.security.authentication.basicauthentication.enabled -Value $true
set-itemproperty "IIS:\Sites\FTPSite" -name ftpServer.security.ssl.controlchannelpolicy -value 0
set-itemproperty "IIS:\Sites\FTPSite" -name ftpServer.security.ssl.datachannelpolicy -value 0
add-webconfiguration "system.ftpserver/security/authorization" -value @{accessType="Allow";users="User1,User2,User3";permissions=3} -PSPath IIS:\Sites\FTPSite

New-WebVirtualDirectory -Site "FTPSite" -Name "Config" -PhysicalPath "D:\Config"
Remove-WebConfigurationProperty "system.ftpserver/security/authorization" -PSPath IIS:\Sites\FTPSite\Config -Name "."
add-webconfiguration "system.ftpserver/security/authorization" -value @{accessType="Allow";users="User2";permissions=3} -PSPath IIS:\Sites\FTPSite\Config

New-WebVirtualDirectory -Site "FTPSite" -Name "AppData" -PhysicalPath "D:\AppData"
Remove-WebConfigurationProperty "system.ftpserver/security/authorization" -PSPath IIS:\Sites\FTPSite\AppData -Name "."
add-webconfiguration "system.ftpserver/security/authorization" -value @{accessType="Allow";users="User3";permissions=3} -PSPath IIS:\Sites\FTPSite\AppData

The problem is that I can't find a way to use the xWebConfigPropertyCollection resource to set an entity in this collection. There are 3 properties that need to be set at the same time, and the resource doesn't seem to have the functionality to achieve this.

I am aware that there is a PR (#425) open with a new feature for adding FTPSites which will cover most of what I need to do, however I don't think it will help with modifying the collections on the Virtual Folders.

If I have completely missed something and this is really simple, please point me in the right direction, otherwise I think there may need to be an enhancement to the resource.

Verbose logs showing the problem

I have tried all the permutations I can think of, which has produced many different errors, far too many to display here.

Suggested solution to the issue

N/A

The DSC configuration that is used to reproduce the issue (as detailed as possible)

This is as far as I have managed to get, I have tried laying this out similar to the examples for this resource without success. I have also tried the format suggested in Issue #379, again without success.

        xWebConfigPropertyCollection FTPRootAuthorizationAccessType
        {
            WebsitePath = "IIS:\Sites\FTPSite"
            Filter = "system.ftpserver/security/authorization"
            CollectionName = "."
            ItemName = "add"
            ItemKeyName = "Key"
            ItemKeyValue = "1"
            ItemPropertyName = "AccessType"
            ItemPropertyValue = "Allow"
        }

        xWebConfigPropertyCollection FTPRootAuthorizationUsers
        {
            WebsitePath = "IIS:\Sites\FTPSite"
            Filter = "system.ftpserver/security/authorization"
            CollectionName = "."
            ItemName = "add"
            ItemKeyName = "Key"
            ItemKeyValue = "1"
            ItemPropertyName = "Users"
            ItemPropertyValue = "User1,User2,User3"
        }

        xWebConfigPropertyCollection FTPRootAuthorizationPermissions
        {
            WebsitePath = "IIS:\Sites\FTPSite"
            Filter = "system.ftpserver/security/authorization"
            CollectionName = "."
            ItemName = "add"
            ItemKeyName = "Key"
            ItemKeyValue = "1"
            ItemPropertyName = "Permissions"
            ItemPropertyValue = "3"
        }

        xWebConfigPropertyCollection FTPConfigAuthorization
        {
            WebsitePath = "IIS:\Sites\FTPSite\Config"
            Filter = "system.ftpserver/security/authorization"
            CollectionName = "."
            ItemName = "add"
            ItemKeyName = "*"
            ItemKeyValue = "Allow"
            ItemPropertyName = "AccessType"
            ItemPropertyValue = "Allow"
        }

        xWebConfigPropertyCollection FTPHiddenAuthorization
        {
            WebsitePath = "IIS:\Sites\FTPSite\AppData"
            Filter = "system.ftpserver/security/authorization"
            CollectionName = "."
            ItemName = "add"
            ItemKeyName = "*"
            ItemKeyValue = "Allow"
            ItemPropertyName = "AccessType"
            ItemPropertyValue = "Allow"
        }

The operating system the target node is running

This is running on a VM that gets wiped before each run of the configuration.

OsName               : Microsoft Windows 10 Enterprise LTSC
OsOperatingSystemSKU : 125
OsArchitecture       : 64-bit
WindowsVersion       : 1809
WindowsBuildLabEx    : 17763.1.amd64fre.rs5_release.180914-1434
OsLanguage           : en-US

Version and build of PowerShell the target node is running

PSVersion                      5.1.17763.1
PSEdition                      Desktop
PSCompatibleVersions           {1.0, 2.0, 3.0, 4.0...}
BuildVersion                   10.0.17763.1
CLRVersion                     4.0.30319.42000
WSManStackVersion              3.0
PSRemotingProtocolVersion      2.3
SerializationVersion           1.1.0.1

Version of the DSC module that was used ('dev' if using current dev branch)

2.8.0.0

[johlju]

@regedit32 Do you have time to look at this issue and see if you have a suggestion?

[regedit32]

Hi @pyrostew , I was able to play around with this one a bit today. I was able to get it to set permissions correctly, but Test-DscConfiguration does not return true. The xWebConfigPropertyCollection works easily for most collections that have one key and one other property, but every now and then we run into collections with multiple keys and any number of properties.

This question comes up a lot for certain IIS collections. This resource works great for most configurations, but I think there is room for improvement based on inquires we get on how to use it, which is fair. I think embedded class instances might make this resource more flexible. I'll try to find time to propose a redesign for the resource and get thoughts from the community.

[pyrostew]

Thanks for your response @regedit32, I have used xWebConfigPropertyCollection in a couple of other places and it does work nicely, just not in this one place in my config! Currently surviving using the script resource but it does make for a messy config.

I'm not very familiar with xWebAdministration but if you can suggest a redesign I would be happy to implement it.

Thanks!

[jn-bedag]

Same problem here with defining ISAPI CGI Restrictions:

<isapiCgiRestriction>   
   ...
   <add path="C:\foo\bar\isapi_redirect.dll" allowed="true" description="Jakarta" />   
</isapiCgiRestriction>

Would be great to enhance the module.

[kirzas]

Same for caching

<system.webServer>
        <caching>  
            <profiles>  
                <add extension=".json" policy="DisableCache" kernelCachePolicy="DisableCache" />  
            </profiles>  
        </caching>  
    </system.webServer>  

[ChrisAccsys]

We had some similar issues with ipSecurity, was looking for

  <system.webServer>
    <security>
      <ipSecurity>
        <add ipAddress="192.168.100.0" subnetMask="255.255.255.0" allowed="true" />
      </ipSecurity>
    </security>
  </system.webServer>

Managed to get it working with:

xWebConfigPropertyCollection IPSecurityIPAddress
        {
            WebsitePath = "IIS:\Sites\SomeSite"
            Filter = "system.webServer/security/ipSecurity"
            CollectionName = "."
            ItemName = "add"
            ItemKeyName = "ipAddress"
            ItemKeyValue = "192.168.100.0"
            ItemPropertyName = "subnetMask"
            ItemPropertyValue = "255.255.255.0"
        }
xWebConfigPropertyCollection IPSecurityIPAddress1
        {
            WebsitePath = "IIS:\Sites\SomeSite"
            Filter = "system.webServer/security/ipSecurity"
            CollectionName = "."
            ItemName = "add"
            ItemKeyName = "ipAddress"
            ItemKeyValue = "192.168.100.0"
            ItemPropertyName = "allowed"
            ItemPropertyValue = "true"
        }

Took a while to understand that ipAddress is the key name, seems obvious now...

[Clebam]

I'm stucked trying to create RewriteRules with this. Mostly for conditions
Even the example from chris up there does not work, because it recreates a new conditition each time.

I end up with conditions with input and no pattern and vice_versa pattern without inputs

We should be able to use a hash in value as already suggested

[ChristophHannappel]

Addional use case are handlers and modules

<configuration>
	<location path="" overrideMode="Allow">
		<system.webServer>
			<handlers accessPolicy="Read, Script">
				<add name="xamlx-ISAPI-4.0_64bit" path="*.xamlx" verb="GET,HEAD,POST,DEBUG" modules="IsapiModule" scriptProcessor="%windir%\Microsoft.NET\Framework64\v4.0.30319\aspnet_isapi.dll" preCondition="classicMode,runtimeVersionv4.0,bitness64" />
			</handlers>
			<modules>
				<add name="ServiceModel-4.0" type="System.ServiceModel.Activation.ServiceHttpModule, System.ServiceModel.Activation, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35" preCondition="managedHandler,runtimeVersionv4.0" />
			</modules>
		</system.webServer>
	</location>
</configuration>

[kirzas]

We had some similar issues with ipSecurity, was looking for

  <system.webServer>
    <security>
      <ipSecurity>
        <add ipAddress="192.168.100.0" subnetMask="255.255.255.0" allowed="true" />
      </ipSecurity>
    </security>
  </system.webServer>

Managed to get it working with:

xWebConfigPropertyCollection IPSecurityIPAddress
        {
            WebsitePath = "IIS:\Sites\SomeSite"
            Filter = "system.webServer/security/ipSecurity"
            CollectionName = "."
            ItemName = "add"
            ItemKeyName = "ipAddress"
            ItemKeyValue = "192.168.100.0"
            ItemPropertyName = "subnetMask"
            ItemPropertyValue = "255.255.255.0"
        }
xWebConfigPropertyCollection IPSecurityIPAddress1
        {
            WebsitePath = "IIS:\Sites\SomeSite"
            Filter = "system.webServer/security/ipSecurity"
            CollectionName = "."
            ItemName = "add"
            ItemKeyName = "ipAddress"
            ItemKeyValue = "192.168.100.0"
            ItemPropertyName = "allowed"
            ItemPropertyValue = "true"
        }

Took a while to understand that ipAddress is the key name, seems obvious now...

that fixed it for me actually

[quillypowers]

The latest version of this doesn't seem to support hsts. $WebConfiguration.Schema.CollectionSchema.GetAddElementSchema($AddElement) returns 0X80070585 or The element specified by bstrElementName cannot be found.