From df1fd0483796261c0a8539487fb89ccaff90881c Mon Sep 17 00:00:00 2001
From: Rob Reynolds <ferventcoder@gmail.com>
Date: Thu, 11 Jan 2018 17:11:27 -0600
Subject: [PATCH] (GH-21) Provide auth instructions

Update the instructions to give all steps required to turn on basic
auth using the HttpAuth module. With the simplifications it could be a
matter of two touchpoints in the config file to be protected.
---
 src/SimpleChocolateyServer/Web.config             | 6 ++++++
 src/SimpleChocolateyServer/Web.config.install.xdt | 6 ++++++
 2 files changed, 12 insertions(+)

diff --git a/src/SimpleChocolateyServer/Web.config b/src/SimpleChocolateyServer/Web.config
index c322bbd..98bca17 100644
--- a/src/SimpleChocolateyServer/Web.config
+++ b/src/SimpleChocolateyServer/Web.config
@@ -13,6 +13,12 @@
       <section name="errorFilter" requirePermission="false" type="Elmah.ErrorFilterSectionHandler, Elmah" />
     </sectionGroup>
   </configSections>
+  <!-- To turn on basic auth with the HttpAuth Module, perform the following:
+       - Set up your users in the credentials section below.
+       - In system.web/authorization (section after httpAuth), find the allow 
+         without verbs and change the word "allow" to "deny". Leave the allow 
+         with 'verbs="PUT,POST"' alone or you won't be able to push packages.
+	  -->
   <httpAuth mode="Basic" realm="Chocolatey Simple Server">
     <!-- The above values have been tested to work. Possible values you can 
          set (with no guarantees or support):
diff --git a/src/SimpleChocolateyServer/Web.config.install.xdt b/src/SimpleChocolateyServer/Web.config.install.xdt
index e8ad75d..1dbe8b6 100644
--- a/src/SimpleChocolateyServer/Web.config.install.xdt
+++ b/src/SimpleChocolateyServer/Web.config.install.xdt
@@ -4,6 +4,12 @@
     <section name="httpAuth" type="HttpAuth.Configuration.HttpAuthSection,HttpAuthenticationModule" xdt:Locator="Match(name)" xdt:Transform="InsertIfMissing" />
   </configSections>
   <httpAuth mode="Basic" realm="Chocolatey Simple Server" xdt:Transform="InsertIfMissing">
+    <!-- To turn on basic auth with the HttpAuth Module, perform the following:
+       - Set up your users in the credentials section below.
+       - In system.web/authorization (section after httpAuth), find the allow 
+         without verbs and change the word "allow" to "deny". Leave the allow 
+         with 'verbs="PUT,POST"' alone or you won't be able to push packages.
+	  -->
 	<!-- The above values have been tested to work. Possible values you can 
          set (with no guarantees or support):
          - Mode - {None|Basic|Digest}