Visual SourceSafe 2005 Internet and IIS Setup

http://diaryproducts.net/about/operating_systems/windows/sourcesafe_2005_internet_iis

One might think that it wouldn't be so difficult to setup Visual SourceSafe 2005 on Windows Server 2003 with IIS such that users can access the SourceSafe database using the Visual SourceSafe 2005 Internet plugin. But dude, I was so wrong! I managed to get it working in the end but it took me an etire day. Anyway, this isn't a complete HowTo. I would just like to point out a few not so obvious caveats.

First, Alin Constantin's Installing and configuring Microsoft Visual SourceSafe for Internet (Remote) access is a good introduction to these matters except that he suggests using an account with administrative priviledges to access SourceSafe. That's something I wouldn't do. Instead, follow Microsoft's Securing a Database. There is also Microsoft's How to: Enable Remote Access Manually which might help in case you're running one of the new 64-bit releases of Windows.

Before attempting any of the above procedures, you should make sure that

the Default website is running. SourceSafe Internet is a ASP.Net web-application that needs to be setup properly. The SourceSafe Administrator tool can do that for you but only for the default website. The default website's default name is Default ;-). In case someone renamed the database it can also be identified by having an ID of 1. I strongly recommend using the SourceSafe Administrator to configure the web application because doing it manually is a pain in the - you know where.
if the URLScan utility is installed, the PUT verb is allowed. The last section of How to: Enable Remote Access Manually tells you how. In a nutshell, move the line PUT from section [DenyVerbs] to section [AllowVerbs] and restart IIS. Otherwise uploads won't work.
I saved the most important hint for the end of this post. After SourceSafe Administrator is finished configuring the web application, you need to enable the script mapping for the .asmx extension. I don't know why this isn't done automatically but hey, we love those little challenges, don't we.

Go to Internet Information Service (IIS) Manager, right-click the SourceSafe virtual directory and select Properties.
In the Virtual Directory tab click Configuration.
Under Application extension, find the entry for .aspx and click edit. Copy the name of the executable and click Cancel.
Back in the Application Configuration dialog, click Add.
Paste the executable name into Executable and type .asmx into Extension. Select All verbs, check Script engine and uncheck Verify that file exists.
Click OK.
Click OK.

I spent the majority of a work day to figure this out. I had to run a network sniffer because Microsoft's error messages are as informative as "The server returned 0x80004005" and a dubious "404 File Not Found" for soemthing completely unrelated.

Oh, another thing: SourceSafe Administrator puts the SourceSafe Internet web application in the default application pool. SourceSafe Internet is a ASP.Net 2.X application. If there is an ASP.Net 1.X application in the same pool, either this or the SourceSafe Internet application will stop. To resolve this, put them in separate application pools or switch the 1.X app to 2.X.