Question

I am running a ServiceStack app on IIS 7.5, with a custom CredentialsAuthProvider serving at /auth/credentials.

It works fine from Visual Studio, but when I install it on the production server (also IIS 7.5), it responds 404 to all requests to /auth/credentials. It doesn’t have any trouble serving REST endpoints, and authentication works if I change the provider’s superclass to BasicAuthProvider, but I would like to use forms instead of basic auth. How can I get it to serve the auth endpoint correctly?

This is what my Web.config looks like:

<?xml version="1.0" encoding="UTF-8"?>

<configuration>
  <location path="auth">
    <system.web>
      <customErrors mode="Off"/>
      <httpHandlers>
        <add path="*" type="ServiceStack.WebHost.Endpoints.ServiceStackHttpHandlerFactory, ServiceStack" verb="*"/>
      </httpHandlers>
    </system.web>
  </location>
  <location path="rest">
    <system.web>
      <httpHandlers>
        <add path="*" type="ServiceStack.WebHost.Endpoints.ServiceStackHttpHandlerFactory, ServiceStack" verb="*" />
      </httpHandlers>
    </system.web>

    <!-- Required for IIS 7.0 -->
    <system.webServer>
      <modules runAllManagedModulesForAllRequests="true" />
      <validation validateIntegratedModeConfiguration="false" />
      <handlers>
        <add path="*" name="ServiceStack.Factory" type="ServiceStack.WebHost.Endpoints.ServiceStackHttpHandlerFactory, ServiceStack" verb="*" preCondition="integratedMode" resourceType="Unspecified" allowPathInfo="true" />
      </handlers>
    </system.webServer>
  </location>

  <!-- Required for MONO -->
  <system.web>
    <httpHandlers>
      <add path="rest*" type="ServiceStack.WebHost.Endpoints.ServiceStackHttpHandlerFactory, ServiceStack" verb="*"/>
      <add path="auth*" type="ServiceStack.WebHost.Endpoints.ServiceStackHttpHandlerFactory, ServiceStack" verb="*"/>
    </httpHandlers>
  </system.web>
  <system.webServer>
    <validation validateIntegratedModeConfiguration="false" />
        <httpErrors errorMode="DetailedLocalOnly">
            <remove statusCode="403" subStatusCode="-1" />
            <error statusCode="403" prefixLanguageFilePath="" path="https://nearme.solarcity.com" responseMode="Redirect" />
        </httpErrors>
    <!--<modules runAllManagedModulesForAllRequests="true">
      <remove name="WebDAVModule" />
    </modules>-->
    <!--uncomment this to stop IIS 7.5 from blocking PUT and DELETE-->
  </system.webServer>
</configuration>

Answer 1

You’re making the wrong assumptions in your configuration.

You can only host ServiceStack at one single path which is either at the root path * or at a custom path which is generally by convention either /api or /servicestack but can be any name of your choice. The HelloWorld tutorial shows an example configuration for both supported options.

Authentication is enforced by decorating either the Request DTO or Service with an [Authenticate] attribute. If you wish you can also add the attribute to a custom base class, e.g. AuthenticatedServiceBase which will ensure all sub classes require authentication as well.