Web.config - allow authentication mode to be altered for each deployment - asp.net

Question

Assuming web software is deployed to multiple customers, there may be a requirement to have a different authentication mode set for each customer.
Let's say 1 customer wants to use forms authentication, and the other wants to use Windows authentication - this can be managed by setting the authentication mode accordingly in the Web.config file.
However, when a software update is deployed to them, how can I get a new Web.config file to them without overwriting their authentication mode?
Would an include file do the job (so that the settings are held outside of Web.config), or is there a better way to handle this?

Answer 1

Two options
Set the authentication mode programmatically
You could customize your code so that the authentication mode is set programmatically, perhaps based on a business rule setting in the client's database instance.
For example, this sets windows authentication mode:
String applicationPath = String.Format("{0}/{1}", _server.Sites["Default Web Site"].Name, "AppName");
Configuration config = _server.GetApplicationHostConfiguration();
ConfigurationSection anonymousAuthenticationSection = config.GetSection("system.webServer/security/authentication/anonymousAuthentication", applicationPath);
anonymousAuthenticationSection["enabled"] = false;
ConfigurationSection windowsAuthenticationSection = config.GetSection("system.webServer/security/authentication/windowsAuthentication", applicationPath);
windowsAuthenticationSection["enabled"] = true;
_server.CommitChanges();
Use a separate config file
Or, you could "outsource" the configuration to a separate config file that is distributed per client, , e.g. see this answer.
<authentication configSource="ConfigFiles\authentication.config" />
Do both
You could code your site so that it picks the config source for the authentication settings programmatically, perhaps based on the host header in the incoming http request.
authenticationSection.ConfigSource = String.Format("d:\Configurations\{0}.config", HttpContext.Current.Request.Host);
Then you distribute the secondary config file per client.
FirstCustomer.com.config
SomeOtherCustomer.com.config
YetAnother.net.config
See this article.