Management Authorization Rules <authorizationRules>

Overview

The <authorizationRules> element of the <authorization> element specifies which IIS Manager users and Windows users are authorized to connect to a site or an application by using IIS Manager when the default authorization provider, ConfigurationAuthorizationProvider, is enabled in Internet Information Services (IIS) 7.

Note

The ConfigurationAuthorizationProvider uses the IIS Administration.config file to store IIS Manager authorization settings for IIS Manager; however, other authorization providers may use alternate storage locations.

Compatibility

Version	Notes
IIS 10.0	The <authorizationRules> element was not modified in IIS 10.0.
IIS 8.5	The <authorizationRules> element was not modified in IIS 8.5.
IIS 8.0	The <authorizationRules> element was not modified in IIS 8.0.
IIS 7.5	The <authorizationRules> element was not modified in IIS 7.5.
IIS 7.0	The <authorizationRules> element of the <authorization> element was introduced in IIS 7.0.
IIS 6.0	N/A

Setup

The default installation of IIS 7 and later does not include the Management Service role service. To install this role service, use the following steps.

Windows Server 2012 or Windows Server 2012 R2

1. On the taskbar, click Server Manager.
2. In Server Manager, click the Manage menu, and then click Add Roles and Features.
3. In the Add Roles and Features wizard, click Next. Select the installation type and click Next. Select the destination server and click Next.
4. On the Server Roles page, expand Web Server (IIS), expand Management Tools, and then select Management Service. Click Next.
   .
5. On the Select features page, click Next.
6. On the Confirm installation selections page, click Install.
7. On the Results page, click Close.

Windows 8 or Windows 8.1

1. On the Start screen, move the pointer all the way to the lower left corner, right-click the Start button, and then click Control Panel.
2. In Control Panel, click Programs and Features, and then click Turn Windows features on or off.
3. Expand Internet Information Services, expand Web Management Tools, and then select IIS Management Service.
   
4. Click OK.
5. Click Close.

Windows Server 2008 or Windows Server 2008 R2

1. On the taskbar, click Start, point to Administrative Tools, and then click Server Manager.
2. In the Server Manager hierarchy pane, expand Roles, and then click Web Server (IIS).
3. In the Web Server (IIS) pane, scroll to the Role Services section, and then click Add Role Services.
4. On the Select Role Services page of the Add Role Services Wizard, select Management Service, and then click Next.
   
5. On the Confirm Installation Selections page, click Install.
6. On the Results page, click Close.

Windows Vista or Windows 7

1. On the taskbar, click Start, and then click Control Panel.
2. In Control Panel, click Programs and Features, and then click Turn Windows Features on or off.
3. Expand Internet Information Services, then Web Management Tool.
4. Select IIS Management Service, and then click OK.
   

How To

How to authorize an IIS Manager user for a site or application

1. Open Internet Information Services (IIS) Manager:

   • If you are using Windows Server 2012 or Windows Server 2012 R2:

     • On the taskbar, click Server Manager, click Tools, and then click Internet Information Services (IIS) Manager.

   • If you are using Windows 8 or Windows 8.1:

     • Hold down the Windows key, press the letter X, and then click Control Panel.
     • Click Administrative Tools, and then double-click Internet Information Services (IIS) Manager.

   • If you are using Windows Server 2008 or Windows Server 2008 R2:

     • On the taskbar, click Start, point to Administrative Tools, and then click Internet Information Services (IIS) Manager.

   • If you are using Windows Vista or Windows 7:

     • On the taskbar, click Start, and then click Control Panel.
     • Double-click Administrative Tools, and then double-click Internet Information Services (IIS) Manager.

2. In the Connections pane, go to the connection, site, application, or directory for which you want to authorize an IIS Manager user.

3. In the Home pane, double-click IIS Manager Permissions.
   

4. On the IIS Manager Permissions page, click Allow User... in the Actions pane.
   

5. In the Allow User dialog box, choose IIS Manager, then click Select...
   

6. In the Users dialog box, highlight the user account that you want to allow, and then click OK.
   

7. In the Allow User dialog box, click OK.
   

Configuration

Attributes

None.

Child Elements

Element	Description
scope	Optional element. Configures the virtual path of the site or application to which IIS Manager users and Windows users are authorized to connect by using IIS Manager.

Configuration Sample

The following configuration sample shows how to authorize an IIS Manager user named Contoso, a Windows group named Test Group, and a Windows user named Contoso2 to connect to the Default Web Site by using IIS Manager.

<authorizationRules>
   <scope path="/Default Web Site">
      <add name="Contoso" />
      <add name="COMPUTER01\Test Group" isRole="true" />
      <add name="COMPUTER01\Contoso2" />
   </scope>
</authorizationRules>

Sample Code

The following code samples check to see if a <scope> element has already been added to the <authorizationRules> element for the Default Web Site; if not, a <scope> element is added the <authorizationRules> element. Next, an <add> element is added to the <scope> element that authorizes a user account named ContosoUser.

AppCmd.exe

Note

You cannot configure <system.webServer/management/authorization> settings using AppCmd.exe.

C#

using System;
using System.Text;
using Microsoft.Web.Administration;

internal static class Sample
{
   private static void Main()
   {
      using (ServerManager serverManager = new ServerManager())
      {
         Configuration config = serverManager.GetAdministrationConfiguration();
         ConfigurationSection authorizationSection = config.GetSection("system.webServer/management/authorization");
         ConfigurationElementCollection authorizationRulesCollection = authorizationSection.GetCollection("authorizationRules");

         ConfigurationElement scopeElement = FindElement(authorizationRulesCollection, "scope", "path", @"/Default Web Site");
         if (scopeElement == null)
         {
            scopeElement = authorizationRulesCollection.CreateElement("scope");
            scopeElement["path"] = @"/Default Web Site";
            authorizationRulesCollection.Add(scopeElement);
         }

         ConfigurationElementCollection scopeCollection = scopeElement.GetCollection();
         ConfigurationElement addElement = scopeCollection.CreateElement("add");
         addElement["name"] = @"ContosoUser";
         scopeCollection.Add(addElement);

         serverManager.CommitChanges();
      }
   }

   private static ConfigurationElement FindElement(ConfigurationElementCollection collection, string elementTagName, params string[] keyValues)
   {
      foreach (ConfigurationElement element in collection)
      {
         if (String.Equals(element.ElementTagName, elementTagName, StringComparison.OrdinalIgnoreCase))
         {
            bool matches = true;
            for (int i = 0; i < keyValues.Length; i += 2)
            {
               object o = element.GetAttributeValue(keyValues[i]);
               string value = null;
               if (o != null)
               {
                  value = o.ToString();
               }
               if (!String.Equals(value, keyValues[i + 1], StringComparison.OrdinalIgnoreCase))
               {
                  matches = false;
                  break;
               }
            }
            if (matches)
            {
               return element;
            }
         }
      }
      return null;
   }
}

VB.NET

Imports System
Imports System.Text
Imports Microsoft.Web.Administration

Module Sample
   Sub Main()
      Dim serverManager As ServerManager = New ServerManager
      Dim config As Configuration = serverManager.GetAdministrationConfiguration
      Dim authorizationSection As ConfigurationSection = config.GetSection("system.webServer/management/authorization")
      Dim authorizationRulesCollection As ConfigurationElementCollection = authorizationSection.GetCollection("authorizationRules")

      Dim scopeElement As ConfigurationElement = FindElement(authorizationRulesCollection, "scope", "path", "/Default Web Site")
      If (scopeElement Is Nothing) Then
         scopeElement = authorizationRulesCollection.CreateElement("scope")
         scopeElement("path") = "/Default Web Site"
         authorizationRulesCollection.Add(scopeElement)
      End If

      Dim scopeCollection As ConfigurationElementCollection = scopeElement.GetCollection
      Dim addElement As ConfigurationElement = scopeCollection.CreateElement("add")
      addElement("name") = "ContosoUser"
      scopeCollection.Add(addElement)

      serverManager.CommitChanges()
   End Sub

   Private Function FindElement(ByVal collection As ConfigurationElementCollection, ByVal elementTagName As String, ByVal ParamArray keyValues() As String) As ConfigurationElement
      For Each element As ConfigurationElement In collection
         If String.Equals(element.ElementTagName, elementTagName, StringComparison.OrdinalIgnoreCase) Then
            Dim matches As Boolean = True
            Dim i As Integer
            For i = 0 To keyValues.Length - 1 Step 2
               Dim o As Object = element.GetAttributeValue(keyValues(i))
               Dim value As String = Nothing
               If (Not (o) Is Nothing) Then
                  value = o.ToString
               End If
               If Not String.Equals(value, keyValues((i + 1)), StringComparison.OrdinalIgnoreCase) Then
                  matches = False
                  Exit For
               End If
            Next
            If matches Then
               Return element
            End If
         End If
      Next
      Return Nothing
   End Function


End Module

JavaScript

var adminManager = new ActiveXObject("Microsoft.ApplicationHost.WritableAdminManager"); 
adminManager.CommitPath = "MACHINE/WEBROOT"; 
adminManager.SetMetadata("pathMapper", "AdministrationConfig");

var authorizationSection = adminManager.GetAdminSection("system.webServer/management/authorization", "MACHINE/WEBROOT"); 
var authorizationRulesCollection = authorizationSection.ChildElements.Item("authorizationRules").Collection;

var scopeElementPos = FindElement(authorizationRulesCollection, "scope", ["path", "/Default Web Site"]);
if (scopeElementPos == -1)
{
   var scopeElement = authorizationRulesCollection.CreateNewElement("scope");
   scopeElement.Properties.Item("path").Value = "/Default Web Site";
   authorizationRulesCollection.AddElement(scopeElement);
}
else
{
   var scopeElement = authorizationRulesCollection.Item(scopeElementPos);
}

var scopeCollection = scopeElement.Collection;
var addElement = scopeCollection.CreateNewElement("add");
addElement.Properties.Item("name").Value = "ContosoUser";
scopeCollection.AddElement(addElement);

adminManager.CommitChanges();

function FindElement(collection, elementTagName, valuesToMatch) {
   for (var i = 0; i < collection.Count; i++) {
      var element = collection.Item(i);
      if (element.Name == elementTagName) {
         var matches = true;
         for (var iVal = 0; iVal < valuesToMatch.length; iVal += 2) {
            var property = element.GetPropertyByName(valuesToMatch[iVal]);
            var value = property.Value;
            if (value != null) {
               value = value.toString();
            }
            if (value != valuesToMatch[iVal + 1]) {
               matches = false;
               break;
            }
         }
         if (matches) {
            return i;
         }
      }
   }
   return -1;
}

VBScript

Set adminManager = WScript.CreateObject("Microsoft.ApplicationHost.WritableAdminManager")
adminManager.CommitPath = "MACHINE/WEBROOT"
adminManager.SetMetadata "pathMapper", "AdministrationConfig"

Set authorizationSection = adminManager.GetAdminSection("system.webServer/management/authorization", "MACHINE/WEBROOT")
Set authorizationRulesCollection = authorizationSection.ChildElements.Item("authorizationRules").Collection

scopeElementPos = FindElement(authorizationRulesCollection, "scope", Array("path", "/Default Web Site"))
If scopeElementPos = -1 Then
   Set scopeElement = authorizationRulesCollection.CreateNewElement("scope")
   scopeElement.Properties.Item("path").Value = "/Default Web Site"
   authorizationRulesCollection.AddElement(scopeElement)
Else
   Set scopeElement = authorizationRulesCollection.Item(scopeElementPos)
End If

Set scopeCollection = scopeElement.Collection
Set addElement = scopeCollection.CreateNewElement("add")
addElement.Properties.Item("name").Value = "ContosoUser"
scopeCollection.AddElement(addElement)

adminManager.CommitChanges()

Function FindElement(collection, elementTagName, valuesToMatch)
   For i = 0 To CInt(collection.Count) - 1
      Set element = collection.Item(i)
      If element.Name = elementTagName Then
         matches = True
         For iVal = 0 To UBound(valuesToMatch) Step 2
            Set property = element.GetPropertyByName(valuesToMatch(iVal))
            value = property.Value
            If Not IsNull(value) Then
               value = CStr(value)
            End If
            If Not value = CStr(valuesToMatch(iVal + 1)) Then
               matches = False
               Exit For
            End If
         Next
         If matches Then
            Exit For
         End If
      End If
   Next
   If matches Then
      FindElement = i
   Else
      FindElement = -1
   End If
End Function