<rakkimk runat="server" />

IIS - Sample ISAPI Filter doing Redirection to another website

I know I'm in a very old world of writing ISAPI Filters to do the redirection instead of just creating an IHttpModule and plug it directly in the IIS7 request pipeline. But, one of my customer wanted this ISAPI filter and I made a fairly simple ISAPI Filter to do the redirection.

Below sample doesn't do any checks, or maintains any lists of mapped URLs, but just a simple redirection of all the requests to http://www.live.com. Feel free to modify it accommodating your need.

#include <stdio.h> 
#include <stdlib.h> 
#include <afx.h>
#include <afxisapi.h>

BOOL WINAPI __stdcall GetFilterVersion(HTTP_FILTER_VERSION *pVer) 
{ 
  pVer->dwFlags = (SF_NOTIFY_PREPROC_HEADERS ); 
  CFile myFile("C:\\ISAPILOG\\URLs.html", CFile::modeCreate);
  myFile.Close();
  pVer->dwFilterVersion = HTTP_FILTER_REVISION; 
  strcpy(pVer->lpszFilterDesc, "Sample Redirection ISAPI"); 
  return TRUE; 
} 

DWORD WINAPI __stdcall HttpFilterProc(HTTP_FILTER_CONTEXT *pfc, DWORD NotificationType, VOID *pvData) 
{ 
   char buffer[256];
   DWORD buffSize = sizeof(buffer);
   HTTP_FILTER_PREPROC_HEADERS *p;
   CHttpFilterContext *chc;
   chc = (CHttpFilterContext *)pfc;
   char *newUrl;
   CFile myFile("C:\\ISAPILOG\\URLs.html", CFile::modeWrite);

   switch (NotificationType)  { 

   case SF_NOTIFY_PREPROC_HEADERS :

   p = (HTTP_FILTER_PREPROC_HEADERS *)pvData;

   char newUrl[50];
   wsprintf(newUrl, "http://www.live.com/");

   char szTemp[50];
   wsprintf(szTemp, "Location: %s\r\n\r\n",newUrl);

   pfc->ServerSupportFunction (pfc,
                            SF_REQ_SEND_RESPONSE_HEADER,
                            (PVOID) "302 Redirect",
                            (DWORD) szTemp,0); 

   myFile.SeekToEnd();
   myFile.Write("<BR><B> Orignial URL : </B>",strlen("<BR><B> Orignial URL : </B>"));
   BOOL bHeader = p->GetHeader(pfc,"url",buffer,&buffSize); 
   CString myURL(buffer);
   myURL.MakeLower(); 
   myFile.Write(buffer,buffSize);

   myFile.Write(" <B>New URL : </B> ",strlen(" <B>New URL : </B> "));
   myFile.Write(newUrl,strlen(newUrl));
   myFile.Close();

   return SF_STATUS_REQ_HANDLED_NOTIFICATION; 
   }

  return SF_STATUS_REQ_NEXT_NOTIFICATION; 
 }

Above is my sample, You might want to check my earlier ISAPI blog post to get the .def file and steps to create the DLL.

How to configure IIS 7.0 for ODBC logging?

If you select Log File format as “Custom” in the IIS manager, it doesn’t give you options to configure ODBC logging in the UI. Instead, it just gives you an alert saying it cannot be configured through IIS manager which you already know.

But, in the previous versions of IIS, you would see the below:

So, in this post I will explain how to configure IIS7.0 site for ODBC logging. You still want to check out this KB for the database, table related information which needs to be created prior to this IIS configuration change.

Changing LogFile Format and the customLogPluginClsid

To configure ODBC, you might need to know the log plugin ID for the ODBC logging. In IIS 6.0, it was LogModuleId, and if you do a search for “ODBC logging” in your Metabase.XML file, you might find this property with value “{FF16065B-DE82-11CF-BC0A-00AA006111E0}”. We are going to use the same in IIS 7.0, but in the ApplicationHost.config file as customLogPluginClsid.

You need to find the <logFile> node in ApplicationHost.config, and that should look like below:

<logFile customLogPluginClsid="{FF16065B-DE82-11CF-BC0A-00AA006111E0}" logFormat="Custom" />

Below are the AppCmds to do this:

appcmd set site /site.name:"Default Web Site" /logFile.customLogPluginClsid:"{FF16065B-DE82-11CF-BC0A-00AA006111E0}"
appcmd site set /site.name:"Default Web Site" /logFile.logFormat:"Custom"

Now, we have just configured IIS to use ODBC logging for our default website. We still need to configure the required DSN name, table-name, username and password to do the ODBC logging.

Configuring ODBC logging parameters in ApplicationHost.config

After you’ve followed this KB article to create database, table, and DSN, you need to make sure you configure ApplicationHost.config to contain the information. You need to configure those settings in <odbcLogging> node under <system.webServer>. Below is my sample configuration:

<location path="Default Web Site">
  <system.webServer>
    <odbcLogging dataSource="ODBCLogging" tableName="HTTPLog" userName="Username" password="mypassword” />"
      </system.webServer>
</location>

Below are the AppCmds to configure the above attributes for the site:

appcmd set config "Default Web Site" /section:odbcLogging /dataSource:"ODBCLogging" /commit:appHost
appcmd set config "Default Web Site" /section:odbcLogging /tableName:"ODBCLogTable" /commit:appHost
appcmd set config "Default Web Site" /section:odbcLogging /userName:"Username" /commit:appHost
appcmd set config "Default Web Site" /section:odbcLogging /password: "mypassword" /commit:appHost

Also, we do not support configuring ODBC logging feature in IIS using the SQL Native Client ODBC driver. You must use the SQL Server ODBC driver. You might want to take a look at this KB article on this.

Hope this helps! Do post a comment if you have any questions on this.

ASP.NET - Using the same encryption method used by ActiveDirectoryMembershipProvider to encrypt secret password answer and store it in AD

Okay, this is an interesting stuff. MembershipProvider automatically encrypts most of the sensitive information such as password, secret-question-password. What if you want to use the same encryption method yourself to encrypt data?

Before continuing reading, You need to understand and keep in mind that your <machinekey> section is the one which would be used for the encryption / decryption by the MembershipProvider. If you change it after encryption, your decryption may fail. So, please be careful while modifying anything on <machinekey> section in your web.config.

I've just created a class inheriting from MembershipProvider. I've implemented all the methods of it (just a dummy implementation - VS would be more than happy to do that for you - if you find difficulty in this, write to me; I'll help you). I've also created another new method called EncryptMe which takes a string and returns me a string which is in fact the encrypted string. This method just gets the string in bytes with RNGCryptoServiceProvider and just call the function EncryptPassword of the MembershipProvider class to do the encryption.

In fact, the EncryptPassword method is a protected method of the MembershipProvider class, and by using it, we have just achieved the same encryption which is used by the MembershipProvider class (which our ActiveDirectoryMembershipProvider also uses to encrypt your secret-password-answer). Since it is protected, you can't access it anywhere outside, but inside a derived class.

    public string EncryptMe(string s)
    {
        byte[] bytes = System.Text.Encoding.Unicode.GetBytes(s);
        byte[] data = new byte[0x10];
        new System.Security.Cryptography.RNGCryptoServiceProvider().GetBytes(data);
        byte[] dst = new byte[data.Length + bytes.Length];
        Buffer.BlockCopy(data, 0, dst, 0, data.Length);
        Buffer.BlockCopy(bytes, 0, dst, data.Length, bytes.Length);
        byte[] b = EncryptPassword(dst);
        return Convert.ToBase64String(b);
    }

Now, you can just store the encrypted string to the active directory property which you've mapped to the Secret-question-password. Check this knowledge base article which explains how to modify an attribute of an user in active directory. It just talks about the properties needed by the FTP user isolation, just modify the code to use your own attribute.

Again, please make sure you do not alter your <machinekey> section which has all the information needed to encrypt and decrypt data.

Hope this helps!

Enabling PasswordReset functionality when using ActiveDirectoryMembershipProvider

If you want to use ActiveDirectoryMembershipProvider on your website to manage users specially the password reset functionality, you will also need to create few attributes in the active directory schema for the "USER" object. You can check this MSDN article to know more about this, but again, it doesn't list how to create the needed attributes, but it tells you what are all the attributes needed if you are considering "Password Reset" functionality.

Firstly, ActiveDirectoryMembershipProvider does not support retrieving the password, but you can reset the password by providing secret-question, and secret-answer. You may also need to create few more attributes in the active directory schema associated with this. Below are those attributes:

1. Password Question - Unicode String
2. Password Answer - Unicode String
3. Failed Answer count - Integer
4. Last time at which the user supplied an invalid answer - Large Integer/Interval
5. Account locked out time - Large Integer/Interval

These are the 5 new attributes which you need to add in the active directory schema for the "USER" object. I will explain how to add new attributes and associate them to an existing object.

1. You need to first install the schema snap-in by registering schmmgmt.dll (regsvr32 schmmgmt.dll)
2. Now, open an MMC, and add "Active Directory Schema" snap-in
3. Expand the Active Directory Schema, and right click on Attribute, and select "Create Attribute"
4. Enter the common name, LDAP name, other fields for the attribute you are creating. For example, "PasswordQuestion" - this would be having its type as Unicode String. See the above list of attributes and its types appropriately. If Integer, enter minimum/maximum values too.
5. For the OID, you need to check this MSDN article.

Now follow the above steps to create all the 5 attributes which are needed. After creating these attributes, we need to attach them to the "USER" object.

1. In the same MMC, Expand "CLASSES" and select user object.
2. Right click on user and select properties
3. Go to its attributes tab, and click Add
4. Select the attributes that you've created one by one and click on OK

That's it. Now, your user object would have all those attributes, and you can store values using any method you like. If you create an user using CreateUser wizard control, it would populate and store the values of the secret-question, answer automatically. ActiveDirectoryMembershipProvider would take care of storing, retrieving values of these attributes itself, you no need to program anything for them.

But, there would be some situation the users have been already created, but you need to attach these attributes to them. Follow the above methods to add attributes to the user object. And, now open the particular user's properties in ADSIEDIT.msc, and add values to them.

After following all the above steps, follow the other steps mentioned in this article to configure your web.config sections to map the attributes you've created in AD.

NOTE: Password-answer is the only one attribute out of these 5 which would be stored in an encrypted format. <machinekey> section would be used for the encryption of this, if you create an user using the CreateUser wizard. But, if you have already created the user in the AD, and you want to just store the secret-question and password, you may want to check my next blog where I'll explain how to use the same encryption method used by the MembershipProvider to store the secret-password in the active directory for the user.

IIS7 - Configure Throttling for your documents (any MIME type) and save Bandwidth costs

Do you have a high traffic site where you have a lot of WMV/AVI/FLV/PDF documents (or any other MIME type) where your maximum bandwidth of the site is utilized? Do you ever think where majority of the bandwidth would go? Most of the users do not completely watch the video or listen to audio, or do not read the complete PDF file (or any progressive download document). Assume that they just watch for 5 minutes of your 1 hour long Flash Video (.flv). How much of your bandwidth (for download) would be used for this? You should try answering this question yourself.

But, you will see a significant reduction in your bandwidth cost, if you start using this Bitrate Throttling Module. It would be configured for any video/audio file types, and in fact for any MIME types such as .PDF, .DOC, etc.

I would explain here how to configure throttling setting specifically for PDF files.

In the IIS Manager, select your web site, and select "Bit Rate Throttling" under Media Services. First of all, make sure that the bandwidth throttling is enabled in the site. 

Now, Right click on the pane and select "Add Throttle Setting..." or select the same from the "Actions Pane". Type "application/pdf" as the MIME type, and enter "Fast Start" and "Throttle rate" values.

You should see bitrate throttling already added to major media files like .asf, .avi, .flv, .mov, .wmv, etc.,. I'm sure this feature in IIS7 would help you saving bandwidth costs for hosting media files, or any large documents.

Here are the download links:

Here are some learn.iis.net documents on this module:

• Bit Rate Throttling Setup Walkthrough

• Bit Rate Throttling Configuration Walkthrough

• Bit Rate Throttling Extensibility Walkthrough

IIS7 - Administration Pack - technical preview released

Here are the links to download the new IIS7 admin pack - technical preview version:

IIS7 - Running ASP.NET 1.1 applications

There a lot of other articles available in iis.net which explains how to run an ASP.NET application on IIS7. Here are those steps:

1. Download .NET Fx 1.1 from http://www.microsoft.com/downloads/details.aspx?familyid=A8F5654F-088E-40B2-BBDB-A83353618B38&displaylang=en
2. Download .NET Fx 1.1 SP1 from http://www.microsoft.com/downloads/details.aspx?familyid=A8F5654F-088E-40B2-BBDB-A83353618B38&displaylang=en
3. Install both of them
4. Allow ASP.NET 1.1 in the ISAPI/CGI Restrictions
5. Make sure you run your application pool in a 32-bit mode + v1.1 + classic mode

Your application pool's configuration in applicationHost.config should look like below:

    <add name="ASP.NET 1.1" enable32BitAppOnWin64="true" managedRuntimeVersion="v1.1" managedPipelineMode="Classic" autoStart="true" />

Below are the commands using appcmd.exe tool which would do this.

    appcmd apppool set /apppool.name:"ASP.NET 1.1" /enable32BitAppOnWin64:true
    appcmd apppool set /apppool.name:"ASP.NET 1.1" /managedRuntimeVersion="v1.1"
    appcmd apppool set /apppool.name:"ASP.NET 1.1" /managedPipelineMode:"Classic"
    appcmd apppool set /apppool.name:"ASP.NET 1.1" /autoStart:true  (optional)

Now, comes an interesting UI module. You can write a UI module to do whatever you want. I felt like writing one today, and thought of writing one for the above. Below is how it looks:

Here is the link for the DLL:

To add this module in your IIS 7 manager follow the below steps:

1. Download the IIS7Fx11Advisor.dll
2. From inetsrv folder Drag and Drop the IIS7BackupRestore.dll into the Global Assembly Cache (C:\Windows\assembly) or use GacUtil -i IIS7Fx11Advisor.dll to install it to the GAC.
3. Under File Menu, browse for the file %WinDir%\System32\InetSrv\config\Administration.config.
4. Search for the <moduleProviders> section and add the following

   <add name="IIS7Fx11Advisor" type="IIS7Fx11Advisor.MyModuleProvider, IIS7BackupRestoreUI, Version=1.0.0.0, Culture=neutral, PublicKeyToken=db9daa3d2ea5f6fd" />

5. Search for the <modules> section and add the following

   <add name="IIS7Fx11Advisor" />

6. Open Inetmgr and You will see the module listed in your IIS 7 Manager if you would’ve followed the above steps properly.

Let me know if this helps you!

AJAX - Calling PageMethods defined on a UserControl

I recently worked with one of my customer, asking for help to migrate his application to AJAX.NET. He had some UserControls which had few methods which needs to be called (ScriptMethods).

If you have a [ScriptMethod] defined in your user control, you cannot call that from your .aspx page using PageMethods.functionname(). Only ScriptMethods defined in the same .aspx page can be called.

A simple workaround would be to have another page method inside the page which in-turn would call the ScriptMethod on the UserControl. Remember all the methods should be public static to be used as a PageMethod.

Below is an example:

UserControl's ScriptMethod:

   1: [WebMethod]

   2: [ScriptMethod(UseHttpGet = true)]

   3: public static string MyUserControlPageMethod()

   4: {

   5:     return "Hello from MyUserControlPageMethod";

   6: }

ASPX page:

   1: <asp:ScriptManager ID="ScriptManager1" runat="server" EnablePageMethods="true" ScriptMode="Auto">

   2: </asp:ScriptManager>

   3: <uc1:WebUserControl ID="WebUserControl1" runat="server" />

   4:  

   5: <script type="text/javascript" language="javascript">
   1:         
   2:    
   3:      function callbackFunction(result) {
   4:         $get("WebUserControl1_Label1").innerText = result;
   5:      }
   6:      
   7:      function CallUserControlPageMethod()
   8:      {
   9:         PageMethods.ForwardingToUserControlPageMethod(callbackFunction);           
  10:      }
  11:     
</script>

In ASPX .cs file:

   1: [WebMethod]

   2: [ScriptMethod]

   3: public static string ForwardingToUserControlMethod(string ddlValue)

   4: {

   5:     return WebUserControl.MyUserControlMethod(ddlValue);

   6: }

Hope this helps!

IIS 6.0 - Disabling ASP.NET on all virtual directories, but one?

One of my customer running IIS 6.0 had this special scenario where he would like to run ASP.NET 2.0 applications only on a single virtual directory on the entire server. He would like to isolate his Virtual Directory alone to have the ScriptMaps of ASP.NET, but not any other website or virtual directory or a folder.

The ScriptMaps for a virtual directory would generally come from the master level properties. To get this in IIS manager, click on the "Web Sites" folder and get its properties, under home directory -> configuration, you will find the script maps configuration. Remove everything regarding ASP.NET.

Now, none of your web sites, virtual directories would have ASP.NET script maps (unless you've specifically added them there).

So, now what? How to add the script maps for a specific virtual directory alone? Run aspnet_regiis with below options:

aspnet_regiis -s "<PATH">

e.g: aspnet_regiis -s "W3SVC/1/Root/MyVDir"

By the above command, the ASP.NET script maps would only be registered to MyVdir virtual directory under the web site with identifier 1.

Hope this helps!

IIS7 - Making IIS7 Manager UI Extension development easier - a little VS trick

When I started developing IIS7 Manager UI Extension modules, it took a little longer time for me to create the entire form manually. Robert's post helped me to some extent. But, still it took a little bit of more time till I figured out this little trick which I'm going to explain.

IIS7 UI modules uses nothing but System.Windows.Forms namespace. The UI stuff would come from your class which should be derived from Microsoft.Web.Management.Client.Win32.ModulePage defined in the DLL. So, how to make your Visual Studio to give you the designer view for your ModulePage class development which would have all your UI elements, their position, their event handlers (button click for example), et al.

This is how your class would define your class deriving from ModulePage, and having all declarations of all your UI elements.

Now, if you right click on the file (MyPage.cs in my example) in the solution explorer, you would have an option to get to the designer - "View Designer". Click on that option. Or you can just double click on the MyPage.cs in the solution explorer to directly taking you to the designer view. Now, you would see the below:

This tells you why it can't display it. Now, comes the interesting part how to make it shown in the designer view. Now, go back to the designer view and change your class (MyPage in my example) to be derived from System.Windows.Forms.Form like below:

Now you should be able to see the designer view for your Module UI if you go to the Designer view in your Visual Studio.

Now, VS thinks that it is a Windows Form and it displays all your UI elements in the designer view.

Cool isn't it? Now, I'm sure your development time would be very less. You can just develop your IIS7 UI modules just as you develop any Windows Application using Visual Studio. You can drag and drop any control you need. For example : Drag a button, just double click on a button to get its button click event handler created.

But, you need to make sure that before your build your project, change your class to be derived from Microsoft.Web.Management.Client.Win32.ModulePage. If you just build the class deriving from Form, then you might end up in getting errors while opening IIS manager to view that module you have written.

Useful Links:

Creating a Simple UI Module

Creating a Module Page for IIS7 Administration Tool

Adding Configuration Functionality to IIS7 Admin Tool Extensions

http://blogs.msdn.com/carlosag/archive/2006/08/12/ExtendingTreeView.aspx

Hope this helps!

IIS7 - Kernel Mode Authentication

One of my customer was running into a kerberos issue on IIS 7.0. While working on this issue, I remembered this kernel-mode windows authentication which would make your kerberos life easier if you are using domain user to run your AppPool as. I was trying to look out to enable kernel mode windows authentication (which is in fact would be enabled by default if the feature is available). But I was not able to find it.

"By default, IIS enables kernel-mode authentication, which may improve authentication performance and prevent authentication problems with application pools configured to use a custom identity. As a best practice, do not disable this setting if Kerberos authentication is used in your environment and the application pool is configured to use a custom identity"

If you are looking to make Windows Authentication to happen on Kernel mode on IIS7 Vista (pre SP1), you may not be able to do it. In fact, it has been introduced only in Vista SP1 and in the WS2008 on IIS7. You can confirm this by opening the IIS_Schema.xml file which would be in %windir%\system32\inetsrv\config\schema folder; you will not see “useKernelMode” attribute for system.webServer/security/authentication/windowsAuthentication if you are on Vista (without SP1).

So, if you want to make your kerberos life easier, make sure you have SP1 for Vista which also comes with a lot of other features on IIS7 (Logging UI, et al) or buy WS2008.

You can check this post by Bill Staples (response 3) if you are looking out for an official confirmation on this. You might also want to Mike Volodarsky's blog where he discussed discussed about what a kernel mode windows authentication might do to your applications here (point # 5).

Hope this helps! 

IIS7 - Interesting Fact - most wanted feature of Windows Server 2008

Mike Volodarsky, Program Manager of the IIS team has a nice link to share - a survey by InformationWeek - claiming IIS7 as the feature most of them are interested in Windows Server 2008.

This isn't surprising me because of the powerful features IIS7 offers to the administrators (Delegated configurations, configurable Over-riding configuration store, Request Filtering, Easy Remote Management, Shared Configuration, etc) and also being the best friend to the developers (Can extend the IIS manager, plug and play modules into the integrated pipeline, use all major ASP.NET functionalities in the pipeline enabling all the file types, can set the default document of the website themselves in web.config). Also by giving a lot of in-built troubleshooting tools and data such as FREB, RSCA and a powerful command line APPCMD to manage the whole server.

Overall, there would be a lot of great stories to talk about IIS7 and its functionalities in its coming days just like this - "Hosting a POSIX executable on IIS 7.0" where I helped a customer to host a POSIX compiled CGI application on IIS 7.0 (with help of Sub-system for Unix - SFU) which sounds as a true interoperability to me. What do you think?

IIS7 - RequestFiltering maxQueryString and maxUrl

If you are new to IIS7 and reading about the new RequestFiltering module, you might have some questions about the length of the URL and the length of the querystring which would be used while denying/allowing a request. I thought I would put these simple information on this blog post. Here we go:

 
404.14 - URL too long

<requestLimits maxUrl=“10” />

The length of the URL would constitute just the length of the URL (/iisstart.htm) - including 1 for the / and not the length of the query strings. So, if you browse to https://www.contoso.com/vdir/myfile.aspx, then the length of this URL would be 17.

404.15 - QueryString too long

<requestLimits maxQueryString=“10” />

The length of the query string here would constitute the length of the query strings, their values and also the delimiters (& and =). ? in the front is not counted for this.

 
Hope this helps someone reading my blog, somewhere in this world.

Happy Learning!

Microsoft Web Deployment Tool - Technical Preview 1 available for download

Do you remember Scott Guthrie talking about a web deployment framework? Last November he gave a hint about this tool and its here now. Technical Preview 1 of its tool has been released now and the team is open for feedback. Check out the team's blog here.

You can download the x86 version or the x64 version of this Technical Preview 1 version of Microsoft Web Deployment Tool. You can check the walkthroughs too.

I tried just playing around this tool, and believe me, it was fairly simple tool to learn, play and deploy! And, for some reason, this tool looks fairly similar to the appcmd.exe command on its syntax and its ability to output in XML format. And, the one big thing impressed me most is the manifest file input. That's awesome! Check the walkthroughs to learn about this.

Happy Deployments!

IIS7 - UI Module for setting FTP Active Directory user isolation properties

Okay, here is one more IIS7 UI module which would be used while using FTP server with Active Directory user Isolation.

In IIS6.0, you had IisFTP.vbs file which you would use to set msIIS-FTPRoot and msIIS-FTPDir property for the user in Active directory.

Below is how it looks:

Here is the link for the DLL:

To add this module in your IIS 7 manager follow the below steps:

1. Download the IIS7ADFTPUI.dll.
2. From inetsrv folder Drag and Drop the IIS7ADFTPUI.dll into the Global Assembly Cache (C:\Windows\assembly) or use GacUtil -i IIS7ADFTPUI.dll to install it to the GAC.
3. Under File Menu, browse for the file %WinDir%\System32\InetSrv\config\Administration.config.
4. Search for the <moduleProviders> section and add the following

   <add name="IIS7ADFTPUI" type="IIS7ADFTPUI.MyModuleProvider, IIS7ADFTPUI, Version=1.0.0.0, Culture=neutral, PublicKeyToken=db9daa3d2ea5f6fd" />

5. Search for the <modules> section and add the following

   <add name="IIS7ADFTPUI" />

6. Open Inetmgr and You will see the module listed in your IIS 7 Manager if you would’ve followed the above steps properly.

Let me know if this helps you!