NETSH HTTP ADD URLACL with Wildcard (or httpapi.dll) - netsh

Question

What is the right syntax for using + and * with NETSH HTTP ADD URLACL?
I am aware of the following Microsoft article, but I just can not find a way that this works for my case:
https://msdn.microsoft.com/en-us/library/aa364698(v=vs.85).aspx
What I would like to achieve is to enable only certain user (this is not problem) to be able to listen on specified URL but using this wildcards.
In general this user is used for service account. So I want to avoid executing additional netsh http add urlacl url=X://mynewUrl.net:1234/ user=MyUser (local user), when my service needs to support additional URL
What I would like to is something like is to execute something like this once that will cover my cases, of course I will use the same TCP/IP port always:
netsh http add urlacl url=https://+:1234/ user=MyUser
or with *
So when I add additional URL () that my service need to support I do not need to execute netsh each time.
I want to be able to use IP addresses as well.
I tried many different combinations, but without success. When I try to run the service I get access denied.
Just as a note, Netsh http behaves the same as API from httpapi.dll, so I guess it actually uses httpapi.dll. I'm also using PlatformInvoke to this library and having exact the same behaviour.
Another note is that I'm using Windows 10 and Windows Server 2012/2012 R2.
Any ideas how can I solve this, so I not need to add new reservations whenever I want to support additional URL for my service?

Answer 1

Using the netsh with the SDDL agrument should get you what you need:
netsh http add urlacl url=http://+:1234/ sddl=D:(A;;GA;;;<process owner sid>)
To get your user sid:
whoami /user
If you're unsure if the owner is your user for the process this oneliner will help:
Get-WmiObject -Class Win32_Process -Filter 'Name = "powershell.exe"' | % { $_.GetOwner() } | % { (New-Object System.Security.Principal.NTAccount($_.Domain + "\" + $_.User)).Translate([System.Security.Principal.SecurityIdentifier]).Value }