I'm sure it's something I did, but on page 44 you mention modifying the Web.config file in the websites folder where DNN was unzipped. I see a 03.01.00.config file but no Web.config file. Any idea where I might look for it? Thanks,

Roger Erickson

Hi Roger,

A change was made it DotNetNuke 3.1 (after the book was published) to not include the web.config called "web.config".

The reason was the web.config contains a hash key for encrypting passwords that developers are encouraged to change, when a new release came out, the web.config would be overwritten and there hash key lost forever. So they would be unable to login.

To help prevent this happening, we provide 2 other files, developers can rename to web.config. These are development.config and release.config, both are optimised for either scenario. So take a copy of either and rename it to web.config for a clean install.

The 03.01.00 config file is a file comparison on what has changed between the release so developers can merge in any changes (if new config sections have appeared, etc)

Just for clarification... this "feature" (the keys in the web.config) is by design in the MemberRole component provided by Microsoft. We're continuing to look for ways to handle this situation better, but we packaged this way in the interests of safety for our users (as Scott explained).

Unlike some other applications, which install with the same set of keys for EVERY install (which is a fairly significant security risk), DotNetNuke generates a random security key for you if you don't already have one. This ensures that you don't use the same security key as every other installation of DotNetNuke out there.

That is why the old key needs to be set in the new web.config.

Cheers,
Scott

It is only with the heart that one can see rightly... what is essential is invisible to the eye.
~ Antoine de Saint-Exupéry

Note to authors: This topic would make a good errata item. I ran into the same problem with the 3.1 download.