Robert McMurray's Blog [MSFT] : IIS Topics

IIS Videos on Dr. Dobb's Web Site

robert_mcmurray — Sun, 27 Dec 2009 06:43:00 GMT

Like many people I know, I get a lot of email from various industry-related publications; some of the emails are spam, and the others are from computer magazines that I subscribe to. (And there are several of those. ;-] )

Anyway, I received an email the other day from the folks at Dr. Dobb’s, and it contained a link for a video on IIS Bitrate Throttling. It always piques my interest to see what others have to say about IIS, so I followed the link and discovered that the following page has several IIS-related videos listed:

http://www.ddj.com/ddjtvmsondemand.jhtml

Within the list of videos I found videos for FTP and WebDAV, so I couldn't resist watching those:

IIS FTP Publishing Service
http://ddj.com/ddjtvmsondemand.jhtml?bcpid=10177845001&bclid=9347349001&bctid=40439588001
IIS WebDAV
http://ddj.com/ddjtvmsondemand.jhtml?bcpid=10177845001&bclid=9347349001&bctid=40444327001

As I was watching those videos, the thought occurred to me that those videos were really familiar - but not in a déjà vu kind of way. As it turns out, those are the same videos that are on the IIS.NET web site:

IIS FTP Publishing Service
http://www.iis.net/expand/ftp
IIS WebDAV
http://www.iis.net/expand/WebDAV

Oh well - I was hoping for something new. But the fact remains that the folks at Dr. Dobb’s have collected a good number of IIS and Windows-related videos and put them all in one place, so it's a nice reference to have around.

IP Address Lookups for Addresses that were Blocked by FTP Dynamic IP Restrictions

robert_mcmurray — Mon, 30 Nov 2009 00:51:00 GMT

A few months ago I wrote a blog post that was titled "Merging FTP Extensibility Walkthroughs - Part 2", where I described how to merge my FTP Dynamic IP Restrictions Authentication Provider walkthrough with my FTP Provider that Sends an Email when Files are Uploaded walkthrough. The result of this code combination was a custom FTP authentication provider that provides support for dynamic IP restrictions that sends me an email every time a new IP address is blocked. I deployed this custom FTP authentication provider on one of my public-facing FTP sites when I wrote the blog post, and in the three months that I have been using that provider it has blocked 88 IP addresses.

Recently it seems that every day I receive a new email that another IP address has been blocked. If you've seen my LogParser and other log-related blog posts you'll realize that I'm kind of a log analysis geek, so I thought that it might be interesting to at least show something of a breakdown for the information that I've been seeing. For privacy reasons I can't distribute the list of IP addresses, so I'll just show a list of countries that I've seen in my dynamic IP restriction provider's SQL database since I deployed my provider.

The method that I employed for obtaining the location information was to write a couple of small scripts that dumped the list of IP addresses from my dynamic IP restriction provider's SQL database to a text file and then perform an IP address lookup to count the various countries from where the various hacking attempts have been originating. This gave me the following country-by-country information:

Country Total

UNITED STATES 23

CHINA 20

[unknown] 15

GERMANY 5

REPUBLIC OF KOREA 4

FRANCE 3

CZECH REPUBLIC 3

SPAIN 3

POLAND 2

BRAZIL 1

CYPRUS 1

SAUDI ARABIA 1

ARGENTINA 1

NETHERLANDS 1

JAPAN 1

THAILAND 1

SWITZERLAND 1

UKRAINE 1

INDIA 1

Total 88

Country	Total
UNITED STATES	23
CHINA	20
[unknown]	15
GERMANY	5
REPUBLIC OF KOREA	4
FRANCE	3
CZECH REPUBLIC	3
SPAIN	3
POLAND	2
BRAZIL	1
CYPRUS	1
SAUDI ARABIA	1
ARGENTINA	1
NETHERLANDS	1
JAPAN	1
THAILAND	1
SWITZERLAND	1
UKRAINE	1
INDIA	1
Total	88

I can't give out the name of the site that I used for the IP lookups, but there are several IP locator, geotargeting, or IP mapping sites available; a simple Internet search should provide you with a list of those sites. Once I choose one of those sites, writing a script to pull the IP addresses from my dynamic IP restriction provider's SQL database and perform the lookup was simple. The code that I wrote for the IP lookups was in VBScript, which I have included below. To use this script, you would need to populate a file named "IP_Addresses.txt" with the IP addresses to query, change the value of IP_LOOKUP_STUB in the example below to one of the available IP lookup URLs, then run the script, which will create a file named "IP_Addresses.log" with the resulting IP lookup information:

' ****************************************
Option Explicit

' ****************************************
Const MAX_ATTEMPTS   = 10    ' the number of times to keep retrying to get a file
Const FAILURE_SLEEP  = 1000  ' the number of milliseconds to sleep between retries
Const SUCCESS_SLEEP  = 1000  ' the number of milliseconds to sleep between successes
Const IP_LOOKUP_STUB = "http://www.example.com/page?ip="

' ****************************************
Dim objFSO
Dim objFile
Dim strLookupURL

' ****************************************
Set objFSO = WScript.CreateObject("Scripting.FileSystemObject")
Set objFile = objFSO.OpenTextFile("IP_Addresses.txt")
Do While Not objFile.AtEndOfStream
  strLookupURL = IP_LOOKUP_STUB & Trim(objFile.ReadLine)
  Call IpLookup(strLookupURL)
Loop
objFile.Close
WScript.Quit

' ****************************************
Function IpLookup(tmpURL)
  On Error Resume Next
  Dim intTempAttempt
  Dim blnTempStatus
  Dim objTempFSO
  Dim objTempFile
  Set objTempFSO = CreateObject("Scripting.FileSystemObject")
  blnTempStatus = False
  Dim objHTTP
  Set objHTTP = CreateObject("MSXML2.ServerXMLHTTP")
  For intTempAttempt = 1 To MAX_ATTEMPTS
    objHTTP.Open "GET", tmpURL, False
    objHTTP.Send
    If (objHTTP.Status = 200) Then
      If Err.Number = 0 Then
        blnTempStatus = True
        Set objTempFile = objTempFSO.OpenTextFile("IP_Addresses.log",8,True)
        objTempFile.WriteLine String(80,"=")
        objTempFile.WriteLine tmpURL
        objTempFile.WriteLine objHTTP.responseText
        objTempFile.Close
        Exit For
      End If
    End If
    WScript.Sleep FAILURE_SLEEP * intTempAttempt
  Next
  Set objHTTP = Nothing
  IpLookup = blnTempStatus
End Function

If you would rather use managed-code, a great example that you could use as a starting point is the KBSoft IP Locator example by Alexandr Golovanov, which also includes the URLs for a couple of IP locator services. Sometime in the future I think that I might write an ASP.NET application that replaces the VBScript code with a web-based interface, or I might add the IP locator logic to my dynamic IP restriction provider through an asynchronous function so that I have the information readily available whenever I want, but for the moment I'm content with my low-tech solution. ;-]

Using URL Rewrite with Web Site Testing

robert_mcmurray — Tue, 13 Oct 2009 22:49:00 GMT

Recently I ran into an interesting situation when I was rolling out a new web-based application. I had tested it on my development server, and because it was a rather complex application I wanted to test it on my production server before making it live. I had already set up a placeholder web site with a home page that announced the new site as "Coming Soon," and I had some of the supporting infrastructure configured for the placeholder site: database connections, permissions, FTP bindings, etc.

In order to test the new site, I could have set up a temporary web site by duplicating the placeholder web site, running my tests, and then deleting the temporary site after I was comfortable that everything was working in production. Or I could simply remove the placeholder web site and replace it with the temporary web site once the testing phase was over. I didn't like either of those ideas, so I came up with much easier solution using URL Rewrite. Here are the details:

First, I added an additional host header binding to the placeholder web site with a temporary name that only I knew about. Since I use a wildcard A record for my DNS, I can add any additional prefixes to my domain name without registering those as CNAME records in DNS. (This makes the temporary name more difficult to discover.) For example, if I created an A record for "*.example.com," then I could use "temp.example.com" without any changes to DNS.

Second, I added a URL Rewrite rule that checked all inbound requests by using the following logic:

If the request was for "temp.example.com", then URL Rewrite would allow regular access the web site.
If the request was for any other domain name and any web page other than "ComingSoon.htm", then URL Rewrite would redirect those requests to "/ComingSoon.htm".

Here's what the URL Rewrite rule looked like in my web.config file:

<system.webServer>
  <rewrite>
    <rules>
      <clear />
      <rule name="Temporary Redirect"
          patternSyntax="Wildcard"
          stopProcessing="true">
        <match url="ComingSoon.htm"
          negate="true" />
        <conditions>
          <add input="{HTTP_HOST}"
            negate="true"
            pattern="temp.example.com" />
        </conditions>
        <action type="Redirect"
          url="/ComingSoon.htm"
          appendQueryString="false"
          redirectType="Found" />
      </rule>
    </rules>
  </rewrite>
</system.webServer>

This allowed me to test the web site on my production server by using a temporary domain name that no one else knew about, and sending every other HTTP request to the "Coming Soon" announcement page. After a few days of putting the web site through some test passes, all that I needed to do was to remove the URL Rewrite rule and the site was officially live.

Creating a Microsoft Access Provider for IIS Database Manager

robert_mcmurray — Sat, 26 Sep 2009 01:22:00 GMT

Following up on my last blog post about the API set for the IIS Database Manager, I have something of a secret to let you in on - you can use the code samples in several of those API documents to create a fully functional provider for Microsoft Access databases. I would never use an Access database in a production environment, but having an Access provider has had some great benefits for me from a test perspective. I often use Access databases for test projects, and using the IIS Database Manager to manage the Access databases on my test systems means that I don't need to install Microsoft Access on any of my test servers.

That being said, as I was writing the API documentation I needed to create something of value to test my code samples. Since the Database Manager feature team was already creating database providers for SQL Server and MySQL, it seemed to me like Microsoft Access was the only other readily-accessible database that I could use for my samples. I mentioned in my last post that Saad Ladki was the Program Manager for Database Manager; Saad had started work on an Access provider at one point, but he abandoned the provider as his schedule grew tighter, so I took over that project so I could use it for the API samples.

With that in mind, here's what you need to do to create a Microsoft Access provider for the IIS Database Manager:

Create a new class project named "AccessDatabase" in Visual Studio
Add project references for:
- System.Configuration
- Microsoft.Web.Management.DatabaseManager
  Note: This may require adding a reference path for your project, such as "C:\Windows\assembly\GAC_MSIL\Microsoft.Web.Management.DatabaseManager\1.0.1.0__31bf3856ad364e35", where "C:" is your operating system drive.

Open the class in the editor, remove the existing code, and insert the following empty class:

using System;
using System.Collections;
using System.Collections.Generic;
using System.Configuration.Provider;
using System.Data;
using System.Data.Common;
using System.Diagnostics;
using System.IO;
using System.Linq;
using System.Text;
using System.Reflection;
using System.Data.OleDb;
using Microsoft.Web.Management.DatabaseManager;

namespace AccessDatabase
{
    public class AccessProvider :
        DatabaseProvider,
        IDbTableManager,
        IDbTableDataManager,
        IDbViewManager,
        IDbBackupManager,
        IDbRestoreManager
    {

    }
}

Copy the code samples from the following MSDN topics into the class; note that some of the utility methods in the code samples will be duplicated so you'll have to remove the duplicate methods:
- DatabaseProvider
- IDbTableManager
- IDbTableDataManager
- IDbViewManager
- IDbBackupManager
  - CreateBackup Method
- IDbRestoreManager
  - RestoreBackup Method
Save, compile, sign, and GAC the provider. For more information about using the Gacutil.exe tool, see the following topic on Microsoft the MSDN Web site:
Global Assembly Cache Tool (Gacutil.exe)

Follow the instructions in the Microsoft.Web.Management.DatabaseManager Namespace topic to add the following entry to your administration.config file, which will register the provider for IIS Manager:

<provider name="Access Provider"
   providerName="System.Data.OleDb"
   type="AccessDatabase.AccessProvider,AccessDatabase,Version=1.0.0.0,Culture=neutral,PublicKeyToken=426f62526f636b73" >
   <databaseBackup
      backupEnabled="true"
      restoreEnabled="true"
      backupPath="C:\backups" />
</provider>

Note: You will need to update the PublicKeyToken with the public key token from your assembly.

Add an OLEDB connection string for your Access database; the following web.config sample shows what that might look like:

<configuration>
  <connectionStrings>
    <add name="Northwind"
      providerName="System.Data.OleDb"
      connectionString="Provider=Microsoft.Jet.OLEDB.4.0;Data Source=C:\inetpub\wwwroot\App_Data\Northwind.mdb;" />
  </connectionStrings>
</configuration>

Note: Since the code samples were all written using OLEDB, not ODBC, you will need to make sure that you use an OLEDB connection string like my example.

Open the IIS Manager and open the Database Manager for the site where you added the connection string. You should now be able to manage the tables and views for your Access database, as well as backing up and restoring your database.

Additional Notes

Creating Database Backups

Even though I wrote my provider to implement backing up and restoring databases, this functionality is purely optional - you could easily remove the IDbBackupManager and IDbRestoreManager implementations from the class and remove the <databaseBackup> element from administration.config.

OLEDB Errors When Saving JOIN/ORDER BY Views (Queries)

Unfortunately, there is one unexpected OLEDB problem with Microsoft Access databases that I ran into that I could not work around. When you attempt to save a view (query) that contains both JOIN statements and ORDER BY statements, you will receive an error that states "Only simple SELECT queries are allowed in VIEWS."

As long as the SQL code is syntactically correct you can execute the query, but you cannot save it. If a query that contains both JOIN statements and ORDER BY statements has already been created in Microsoft Access, you can open it and make changes, but you will not be able to save those changes back to the database.

For example, the following SQL code will cause the error to occur:

SELECT Categories.CategoryName, Products.ProductName
FROM Products INNER JOIN Categories ON Products.CategoryID = Categories.CategoryID
ORDER BY Categories.CategoryName, Products.ProductName;

While the following code will not cause the error:

SELECT Categories.CategoryName, Products.ProductName
FROM Products INNER JOIN Categories ON Products.CategoryID = Categories.CategoryID;

Even though the SQL code is syntactically correct and will execute without any problems, the error occurs at the OLEDB layer when the provider executes the CREATE VIEW statement to save the view to the database. This appears to be an unfortunate and irresolvable OLEDB limitation when you are using an Access database. When you are faced with such a situation, you will need to open the database in Microsoft Access to save the query.

Database Manager API Topics on MSDN

robert_mcmurray — Thu, 24 Sep 2009 21:16:00 GMT

Today Microsoft released version 1.0 of the IIS Database Manager, which enables you to manage local and remote SQL Server or MySQL databases through the IIS Manager. I cannot stress enough how this module has rapidly become one of my favorite extensions for IIS Manager. There are many times when I need to access the data in one of my databases where opening the database management tool would be inconvenient or impossible. (For example, when I am working remotely, or when I don't have the database management tools installed.) In these situations, the Database Manager has been worth its weight in gold.

Another great feature of the IIS Database Manager is that it is extensible, like every other part of IIS these days, meaning that you can create your own database providers. Following up on that thought, in addition to all of the walkthroughs and blog posts that I've been writing about FTP and WebDAV over the past several months, I've also been working on documenting the API set for the IIS Database Manager, and all of those topics have been published on the MSDN Web site under the following URL:

Microsoft.Web.Management.DatabaseManager Namespace

I would be remiss if I didn't give credit where it's due, so my special thanks go to:

The Database Manager Feature Team - the entire team did some great work:
- Saad, Brian, Bob, Tim, Andrew, Nitasha, Richard, Carlos, Madhur, Nazim, Ivan, Crystal, Faith, Diana, Pete, Rich, Raul
- That being said, there are two people that I'd like to call our for their additional assistance:
  - Saad Ladki - Saad was the Program Manager for the Database Manager. I have to give credit where it's due and say that my job would have been a lot harder if Saad hadn't done the initial research for some of my code samples.
  - Brian Delahunty - Brian was my principal contact on the feature team whenever I needed help or backed myself into a corner. Brian was very accommodating when I suggested changes, and he always had great explanations when something needed clarification.
Microsoft Press - I know that it seems like a gratuitous plug, but I spent dozens of hours going through my "Microsoft® OLE DB 2.0 Programmer's Reference and Data Access SDK" book looking up the various parts of the OLEDB schema. That book was simply indispensable while I was writing my API samples.

eWeek Reviews for IIS 7.5 and FTP 7.5

robert_mcmurray — Thu, 24 Sep 2009 01:45:00 GMT

One of my coworkers, Vijay Sen, just forwarded the following eWeek review of IIS 7.5 to me:

http://www.eweek.com/c/a/Windows/REVIEW-Microsoft-IIS-75-Improves-Management-Deployment-Options-822018/

The review was written by Jim Rapoza, and he said some great things about IIS 7.5, which ships with both Windows Server 2008 R2 and Windows 7 client. But what really made my day was the following things that he said about FTP 7.5:

Another welcome change in IIS 7.5 is the elevation of FTP as a full-fledged part of the server. In previous versions, setup and management of an FTP server in IIS were done pretty much separately from Web server management. In IIS 7.5, FTP administration is fully integrated into the IIS Management Console.

I found this to be a very good implementation of FTP, making it possible to quickly set up secure FTP servers and tie them to my Websites. Especially nice was the ability to easily use virtual host names for the FTP sites. All in all, the FTP implementation in IIS 7.5 is one of the best I’ve seen, even when compared with dedicated FTP server products.

It’s great to see all of our hard work being recognized!

My thanks once again to everyone on the FTP and IIS feature teams that helped make this version of the FTP service: Jaroslav, Emily, Daniel, Umer, Suditi, Ciprian, Jeong, Dave, Andrew, Carlos, Brian, Wade, Ulad, Nazim, Reagan, Claudia, Rick, Tim, Tobin, Kern, Jenny, Nitasha, Venkat, Vijay. (I hope that I didn't leave anyone out!)

FTP 7.5 Extensibility and Visual Studio Express Editions

robert_mcmurray — Thu, 17 Sep 2009 21:19:00 GMT

In earlier blog posts I have mentioned that I written the several walkthroughs to help developers get started writing providers for the FTP 7.5 service, all of which available on Microsoft's learn.iis.net Web site under the "Developing for FTP 7.5" section. In each of these walkthroughs I wrote the steps as if you were using Visual Studio 2008.

Following up on that, I received a great question yesterday from a customer, Paul Dowdle, who wondered if it was possible to write an extensibility provider for the FTP 7.5 service using one of the Visual Studio Express Editions. By way of coincidence, I used to install Visual C# Express Edition on my laptop when I was traveling around the world to speak at events like TechEd. I usually did this because the Express Edition took up less hard drive space than a full installation of Visual Studio, and I was only writing code in C# on my laptop.

To answer Paul's question, the short answer is - yes, you can use Visual Studio Express Editions to develop custom providers for the FTP 7.5 service, with perhaps a few small changes from my walkthroughs.

For example, if you look at my "How to Use Managed Code (C#) to Create a Simple FTP Authentication Provider" walkthrough, in the section that is titled "Step 1: Set up the Project Environment", there is an optional step 6 for adding a custom build event to register the DLL automatically in the Global Assembly Cache (GAC) on your development computer.

When I installed Microsoft Visual C# 2008 Express Edition on a new computer, I didn't have the "%VS90COMNTOOLS%" environment variable or the "vsvars32.bat" file, so I had to update the custom build event to the following:

net stop ftpsvc
"%ProgramFiles%\Microsoft SDKs\Windows\v6.0A\bin\gacutil.exe" /if "$(TargetPath)"
net start ftpsvc

Once I made that change, the rest of the walkthrough worked as written.

So, to reiterate my earlier statement - you can use Visual Studio Express Editions to develop custom providers for the FTP 7.5 service. My thanks to Paul for the great question!

Hiding your FTP Server Type and Preventing Unauthorized Access

robert_mcmurray — Thu, 10 Sep 2009 23:05:00 GMT

As evidenced by my How to Use Managed Code (C#) to Create an FTP Authentication Provider with Dynamic IP Restrictions walkthrough and my other FTP authentication extensibility walkthroughs, I spend a lot of time trying to find ways to prevent unauthorized access to my FTP server while still allowing valid users to have easy access to their site content. Today's blog discusses several of the ideas that I like to use on my FTP servers.

Preventing Unauthorized Access

To start things off, I globally disable FTP Basic Authentication on my server and I only use custom authentication providers. Since my FTP users do not have actual accounts on my server or my domain, that helps prevent access to my physical server. It was for this reason that I wrote the authentication provider that I discuss in my How to Use Managed Code (C#) to Create an FTP Authentication Provider using an XML Database walkthrough; I can hand out accounts with FTP access for sites that are hosted on my servers, but those accounts are stored in an XML file and not in the security accounts database on my server or my domain.

But there are other ways to help secure your FTP server. For example, I wrote an earlier blog post about Creating a Global Listener FTP Site. On my servers I like to create a global listener site and disable all of the built-in authentication methods.

Once that has been completed I add the custom authentication provider from my How to Use Managed Code (C#) to Create an FTP Authentication Provider with Dynamic IP Restrictions walkthrough, but I don't create any accounts in the database - I just want to log and block the IP addresses of would-be attackers that are attempting to brute force their way into my server. Configuring the authentication options is accomplished through the FTP Authentication feature in IIS Manager.

Ever since I wrote and deployed my dynamic IP address restriction authentication provider, it has faithfully blocked dozens of would-be attackers.

Hiding your FTP Server Type

The next approach that I take is "Security through Obscurity", where I hide the easily recognizable signatures that identify my FTP server. The first step is to suppress the default banner and add a custom FTP banner. This is accomplished through the FTP Messages feature in IIS Manager.

Next, switch your directory listing style to Unix format. All FTP clients that I have tested understand this format, but it hides the fact that your server can do MS-DOS listings. Configuring your directory listing style is accomplished through the FTP Directory Browsing feature in IIS Manager.

After implementing these changes, it might now resemble the following example FTP session when you log in with FTP:

CMD>ftp localhost

Connected to DESKTOP.domain.local.
220 Welcome to my server!
User (DESKTOP.domain.local:(none)): foobar
331 Password required for foobar.
Password:
230 User logged in.
ftp> dir
200 EPRT command successful.
125 Data connection already open; Transfer starting.
drwxrwxrwx   1 owner    group               0 Jan 22 11:45 App_Code
drwxrwxrwx   1 owner    group               0 Sep 10 10:32 App_Data
drwxrwxrwx   1 owner    group               0 Aug 17 13:35 bin
-rwxrwxrwx   1 owner    group             689 May  8  2008 iisstart.htm
-rwxrwxrwx   1 owner    group            2714 Jan 22 11:54 web.config
-rwxrwxrwx   1 owner    group          184946 May  8  2008 welcome.png
226 Transfer complete.
ftp: 418 bytes received in 0.02Seconds 83.00Kbytes/sec.
ftp> bye
221 Goodbye.

CMD>

The last step that I take is to block the FTP infrastructure commands SYST and FEAT on the global listener FTP site. These commands respectively display your operating system and list of FTP features. Blocking these commands helps to further obfuscate your server type from attackers.

Note: It is important that you block these two commands only on your global listener FTP site and not on your other FTP sites, because some FTP clients may depend on these commands in order to interact properly with your other FTP sites. That said, if you are working with a small set of FTP clients and none of them seem to have a problem with suppressing the SYST command, you could probably suppress that globally. Most clients that I have tested seem to have no problem with that, especially if you are using Unix directory listings.

In any event, you block the SYST and FEAT commands through the FTP Request Filtering feature in IIS Manager.

Now when you log in with FTP and attempt to use the SYST and FEAT commands, it should look like the following example FTP session:

CMD>ftp localhost

Connected to DESKTOP.domain.local.
220 Welcome to my server!
User (DESKTOP.domain.local:(none)): foobar
331 Password required for foobar.
Password:
230 User logged in.
ftp> quote SYST
500 'SYST': command not allowed.
ftp> quote FEAT
500 'FEAT': command not allowed.
ftp> bye
221 Goodbye.

CMD>

Summary

The steps in this blog are certainly not all-inclusive, and I keep coming up with other ideas as time goes on, but following these steps should help to prevent unauthorized access to your FTP service. All of the normal warnings about using strong passwords, changing your passwords often, using SSL whenever you can, and keeping your hotfixes up-to-date will always apply.

But that being said, one of the ways that I keep finding new things to block is by simply watching my FTP log files to see what attackers are trying to do. By using some of the techniques that I discuss in my Using LogParser with FTP 7.x Sessions blog, you can monitor your FTP log files in order to analyze what would-be attackers are trying to do.

The End of Metabase Corruption (R.I.P.)

robert_mcmurray — Sat, 22 Aug 2009 10:28:00 GMT

Even though IIS 7 with its new XML-based configuration settings has been around for a while, I was going through some old directories on one of my computers the other day and I stumbled across an image that I had labeled "Metabase Corruption." I have kept that image around for the past decade or so because it's one of the few actual examples of metabase corruption that I have actually verified, although there have definitely been more cases than just the ones that I have seen. But I thought that it might make for a good blog entry to explain the origins of the term "Metabase Corruption" and what that means to you if you're using a version of IIS that is earlier than IIS 7.

A brief history of the IIS metabase and metabase editors

Many years ago I was working in the Microsoft Product Support Services (PSS) group, where I provided support for enterprise-level customers that were using IIS versions 1.0 through 6.0. The early versions of IIS, (versions 1.0 through 3.0), stored all of their settings in the registry. This was fine for that period of time, but it didn't scale well and for several other reasons it was cumbersome to deal with. Just to bring back some nightmares, here's an image of the IIS 3.0 manager:

When IIS 4.0 was released, it introduced the "metabase," which was a proprietary database that stored all of the metadata for IIS, and all of that information was physically stored in a file that was named metabase.bin. The metabase scaled considerably better than the registry, but it introduced several other problems. The biggest problem was that the metabase was something of a "black box" for end users - all of your settings were stored in the metabase, and the only way to get to those settings was through the IIS Manager or by using unsupported command-line tools. The next big problem was that the metabase wasn't portable - you couldn't copy the metabase from one computer to another. (If you tried you would quickly realize that you just killed IIS.) When the IIS 4.0 Resource Kit was released it introduced MetaEdit 1.0, which was an editor for the metabase that looked like RegEdit, but it crashed so often that it really wasn't useful.

During the Windows 2000 timeframe I took over the MetaEdit code base and I created MetaEdit 2.0, which was released with the Windows 2000 Resource Kit. I fixed all of the stability problems from MetaEdit 1.0 and I added export/import functionality so that users could copy sections of the metabase between servers. Actually, I wrote MetaEdit before Microsoft stopped adding Easter Eggs to software, so there's a small Easter Egg in the Help::About for MetaEdit that you can find by holding down Shift-Ctrl-Alt and double-clicking the icon - you first see a photo of Bill Gates and then you see a photo of me from the days when I had longer hair...

I released a couple of patches to MetaEdit over the years, and the last version that I released is version 2.2, which you can download through the following URL:

How To Install MetaEdit 2.2 on Windows NT 4.0 or Windows 2000

When Windows Server 2003 was in development, XML had risen within the development community as a great way to store your data, so the IIS team decided to switch from the metabase.bin format to metabase.xml. This allowed for editing the metabase using any XML editor, even Windows Notepad, and IIS added native export and import functionality, so you could migrate settings from one computer to another by using IIS Manager.

It was sometime during the Windows 2003 timeframe that I was working on MetaEdit 3.0 when I heard that someone else was working on Metabase Explorer, and the early versions of Metabase Explorer that I was able to test were really cool, so I ceased work on MetaEdit in favor of Metabase Explorer, which was eventually released with the IIS 6.0 Resource Kit Tools. You can download the IIS 6.0 Resource Kit Tools through the following URL:

Internet Information Services (IIS) 6.0 Resource Kit Tools

Note: MetaEdit should only be used on Windows NT 4.0 with IIS 4.0 or Windows 2000 with IIS 5.0. For IIS 6.0 you should only use Metabase Explorer. (And yes - you can blame me for the totally useless dialog that you get when you try to use MetaEdit with IIS 6.0. Sorry about that. )

What's all this about metabase corruption?

It was shortly after the release of IIS 4.0 that I first heard the term "Metabase Corruption" being used. People were using the term "Metabase Corruption" as a catch-all phrase for "I don't what's broken but reinstalling IIS fixed the problem so it must have been a problem with the metabase." Everyone's general opinion seemed to be that if you couldn't find the problem and you can't look at the metabase, then it must be corruption in the metabase if you can't resolve the issue without reinstalling IIS. To me, this seemed like a cop-out for good troubleshooting, and since I was a technical lead in PSS around the time that IIS 5.0 was being released I would generally refuse to accept anyone's claim when they said that they had a customer with "Metabase Corruption." Instead, I would require them to troubleshoot the problem further, and in nearly 100% of those situations the problem was not caused by the metabase but by some other problem that could be rectified without reinstalling IIS.

Here's a case in point - several years ago I worked on an issue that some of the folks that supported SharePoint Portal Server 2001 on IIS 5.0 were seeing. They first described the problem to me as "IIS was losing settings." What they were actually seeing was that they would make changes in IIS Manager and apply them, but when they would close and reopen IIS Manager they saw that all their settings were gone. They claimed that this was "Metabase Corruption," and because of this they would often make the customer reinstall IIS completely. Needless to say I made them quite angry by stating that "Metabase Corruption" is almost never actual corruption, and that they were wasting the customer's time by making them reinstall IIS. Even though reinstalling IIS made the problem go away, it didn't actually fix the problem and it only hid the actual cause at the customer's expense.

Since I knew a little more than they did about how the metabase worked, I could theorize reasons why that behavior might occur and I asked them to contact me when they had a customer with this problem again. The next time they saw this problem I asked them to follow these steps:

Stop IIS by using "iisreset /stop" from a command-line
Start just the IISADMIN service by using "net start IISADMIN" from a command-line
Open the IIS Manager, make their changes, then close the IIS Manager
Restart IIS by using "iisreset /restart" from a command-line
Open IIS Manager and verify their settings

In 100% of the cases this enabled them to work around the issue, but that was only part of the solution. I theorized that something was causing IIS to crash before the metabase changes were flushed to disk, but the Windows service recovery settings were instructing the server to restart IIS whenever it crashed so it seemed to the customer like nothing had crashed at all. With this in mind, I had them check the Windows System Log in the Event Viewer, and it listed several errors indicating that the IISADMIN service had terminated unexpectedly, which confirmed my suspicions. After some additional troubleshooting I discovered that SharePoint Portal Server 2001 was setting several illegal values in the metabase, and sooner or later that would cause IIS 5.0 to crash. (SharePoint has long since fixed that problem.)

Does metabase corruption actually happen? If so, what can I do about it?

Sadly - yes it does. It doesn't happen as often as some people seem to think that it does, but it is certainly possible. The metabase is simply a file, and file corruption can occur for any number of reasons. In the early days of IIS 5.0 on the Windows 2000 beta I discovered (quite by accident) how I could overwrite one specific value in the metabase and crash IIS so badly that IIS couldn't even be uninstalled. (Don't worry - that problem has long since been fixed.) I have also seen metabase corruption due to hardware failures, like a drive controller that is going bad and the problem is manifesting itself slowly over time.

That being said, there are several methods to check if you actually have metabase corruption:

The first and easiest thing to check is - does IIS start and all of your web sites seem to work?
Can you open up the IIS Manager and see all of your sites?
Can you enumerate the metabase without errors using MetaEdit, Metabase Explorer, or "adsutil.vbs enum_all w3svc" from a command line?

If the answer to any or all of these questions is yes - then chances are good that you do not have metabase corruption, and whatever problem you have is due to misconfiguration or some other issue.

The best way that I can think of to prevent metabase corruption is to avoid using a variety of tools to constantly read and write to the metabase outside of normal IIS operations. I have written scripts that perform literally thousands of metabase operations under a nominal load in a lab environment for testing purposes and never had a problem, but a server under heavy load with thousands of read/write operations per minute could theoretically run into problems if left to run like that for an indefinite length of time. But theoretically the same may be true for any file under heavy read/write load for an indefinite length of time.

Protecting against metabase corruption

The best thing that you can do to prevent against metabase corruption is backup the metabase regularly!!! I cannot count the number of times where having a good backup of the metabase saved me from a myriad of issues. Fortunately, there are several KB articles that describe backing up the metabase:

The last KB article in the above list is based on a script that I wrote for one of my IIS 5.0 on Windows 2000 servers many years ago that I continue to use on any servers that run IIS 6.0 on Windows Server 2003.

Does IIS 7 have metabase corruption?

The quick answer to this is "no", but that answer is a little misleading since IIS 7 doesn't have a metabase!

In IIS 7 we rolled out a brand new XML-based configuration store, and the bulk of your IIS settings are stored in a file named applicationHost.config, which greatly resembles the web.config configuration paradigm that was established with the .NET framework. That being said, applicationHost.config is just another file, and even though its syntax is much easier to understand and manually edit, any file can theoretically become corrupted, so you should always make sure that you backup your applicationHost.config file as well.

With this in mind I wrote the following blog post some time ago where I discuss creating a script to automate backing up your IIS 7 configuration settings:

Automating IIS 7 Backups

(Note: I also wrote another blog post recently about how the script in that blog post saved my day when something did get corrupted on one of my servers.)

Parting thoughts

I started out this blog post by describing an image that I found on one of my computers where actual metabase corruption had occurred, so I thought that a nice way to close out this blog post would be to show you the actual image:

It's been almost ten years now, so I don't remember the root cause anymore, but I remember what it looked like. I had a mixture of sites that were working and others that were not, and when I opened the metabase in MetaEdit I noticed that scattered throughout the metabase were hundreds of values that shouldn't be there or values that did not make sense. MetaEdit was trying its best to show all of the data, but you'll notice in the highlighted areas of the image that several of the values had bad data in them.

A Little Scripting Saved My Day (;-])

robert_mcmurray — Mon, 27 Jul 2009 21:55:00 GMT

I have mentioned in previous blog posts that I tend to write many of my blog posts and walkthroughs for IIS.NET based on code that I’ve written for myself, and today’s blog post is the story of how one of my samples saved my rear over this past weekend.

One of the servers that I manage is used to host web sites for several friends of mine. (It’s their hobby to have a web site and it’s my hobby to host it for them.) Anyway, sometime on Sunday someone let me know that one of my sites didn’t seem to be behaving correctly, so I browsed it with Internet Explorer and saw that I was getting an HTTP 503 error. I’ve seen this error when an application pool goes offline for some reason, so I didn’t panic – yet – because I knew that the web site was in a separate application pool. With that in mind, I browsed to a web site that is in a different application pool. Same thing – HTTP 503 error. This was beginning to concern me.

I logged into the web server and ran iisreset from a command-line – this threw the following error - and now I was really starting to become agitated:

CMD>iisreset Attempting stop... Internet services successfully stopped Attempting start... Restart attempt failed. The IIS Admin Service or the World Wide Web Publishing Service, or a service dependent on them failed to start. The service, or dependent services, may had an error during its startup or may be disabled. CMD>

I knew that the cause of the error should be in the Windows Event Viewer, so I opened the System log in Event Viewer and saw the following error:

Log Name: System

Source: Microsoft-Windows-WAS

Date: 7/26/2009 10:59:52 AM

Event ID: 5172

Task Category: None

Level: Error

Keywords: Classic

User: N/A

Computer: MYSERVER

Description: The Windows Process Activation Service encountered an error trying to read configuration data from file '\\?\C:\Windows\system32\inetsrv\config\applicationHost.config', line number '308'. The error message is: 'Configuration file is not well-formed XML'. The data field contains the error number.

Event Xml:

<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event"> <System> <Provider Name="Microsoft-Windows-WAS" Guid="{4E616D65-6F6E-6D65-6973-526F62657274}" EventSourceName="WAS" /> <EventID Qualifiers="49152">5172</EventID> <Version>0</Version> <Level>2</Level> <Task>0</Task> <Opcode>0</Opcode> <Keywords>0x80000000000000</Keywords> <TimeCreated SystemTime="2009-07-26T17:59:52.000Z" /> <EventRecordID>32807</EventRecordID> <Correlation /> <Execution ProcessID="0" ThreadID="0" /> <Channel>System</Channel> <Computer>MYSERVER</Computer> <Security /> </System> <EventData> <Data Name="File">\\?\C:\Windows\system32\inetsrv\config\applicationHost.config</Data> <Data Name="LineNumber">308</Data> <Data Name="Error">Configuration file is not well-formed XML</Data> <Binary>0D000780</Binary> </EventData> </Event>

Log Name:	System
Source:	Microsoft-Windows-WAS
Date:	7/26/2009 10:59:52 AM
Event ID:	5172
Task Category:	None
Level:	Error
Keywords:	Classic
User:	N/A
Computer:	MYSERVER
Description:	The Windows Process Activation Service encountered an error trying to read configuration data from file '\\?\C:\Windows\system32\inetsrv\config\applicationHost.config', line number '308'. The error message is: 'Configuration file is not well-formed XML'. The data field contains the error number.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event"> <System> <Provider Name="Microsoft-Windows-WAS" Guid="{4E616D65-6F6E-6D65-6973-526F62657274}" EventSourceName="WAS" /> <EventID Qualifiers="49152">5172</EventID> <Version>0</Version> <Level>2</Level> <Task>0</Task> <Opcode>0</Opcode> <Keywords>0x80000000000000</Keywords> <TimeCreated SystemTime="2009-07-26T17:59:52.000Z" /> <EventRecordID>32807</EventRecordID> <Correlation /> <Execution ProcessID="0" ThreadID="0" /> <Channel>System</Channel> <Computer>MYSERVER</Computer> <Security /> </System> <EventData> <Data Name="File">\\?\C:\Windows\system32\inetsrv\config\applicationHost.config</Data> <Data Name="LineNumber">308</Data> <Data Name="Error">Configuration file is not well-formed XML</Data> <Binary>0D000780</Binary> </EventData> </Event>

Now that I was armed with the file name and line number of the failure in my configuration settings, I was able to go straight to the source of the problem. (I love IIS 7's descriptive error messages - don't you?) Once I opened the file and jumped to the correct location, I saw several lines of unintelligible garbage. For reasons that are still unknown to me – my applicationHost.config file had become corrupted and IIS was dead in the water until I fixed the problem. I looked through the file and removed most of the garbage and saved the edited file to IIS – this got the web sites working, but only partially. Some necessary settings had obviously been removed while I was clearing all of out the unintelligible garbage, and it might take me a long time to discover what those settings were.

The next thing that I did was to take a look in my two readily-accessible backup drives; I have two external hard drives that keep a backup of the web server - one hard drive is directly plugged into the web server via a USB cable, and the other hard drive is plugged into a physically separate server that rotates drives with off-site storage on a monthly basis. The problem is, my weekly backups had just run, so the copy in each backup location had been overwritten with the corrupted version. (I’m going to have to rethink my backup strategy after this – but that’s another story.) The backup copy in my off-site storage location should be intact, but that copy would be a few weeks old so I would be missing some settings, and I would have to drive an hour or so round-trip in order to pick up the drive. This wasn’t an ideal solution – but it was definitely a feasible strategy.

It was at this point that I remembered that I had written following blog post some time ago:

Automating IIS 7 Backups
http://blogs.msdn.com/robert_mcmurray/archive/2008/03/08/automating-iis-7-backups.aspx

I wrote the script in that blog post for the server that I was currently managing, and because of this preventative measure I had dozens of backups going back several weeks to choose from. So I was able to quickly find a copy with no corruption and I restored that copy to my IIS config directory. At this point all of my web sites came online with all of their functionality. Having fixed the major issues, I used WinDiff to verify any settings that might have been changed between the restored copy and the corrupted copy.

So in conclusion, this story had a happy ending, and it left me with a few lessons learned:

You can never have too many backups
I need to rethink how I roll out my backup strategy with regard to using external hard drives
Writing cool scripts to automate your backups can save your rear end

That sums it up for today’s post. ;-]

Using Apple's WebDavFS for Mac OS X with WebDAV on IIS 7

robert_mcmurray — Thu, 02 Jul 2009 05:19:00 GMT

Today's blog post needs to have a disclaimer right up front - I freely admit I'm not a Mac OS X expert, so I may not have everything 100% correct in this post. But I've seen a lot of questions on forums.iis.net that discuss using IIS WebDAV with Mac OS X, so I thought that I'd share a few of the things that I've noticed. Just the same, if I were writing a formal walkthrough I would have said something like, "Microsoft is not responsible for the behavior of Apple's Mac family of products. The information that is provided in this topic is provided to assist Mac OS X users that are connecting to IIS using WebDAV."

All that being said, here are the prerequisites for getting your environment together:

Your server needs to be running Windows Vista, Windows Server 2008, or Windows 7.
Your server needs to have Internet Information Services 7 and the WebDAV module installed. (Note: See the Installing and Configuring WebDAV on IIS 7.0 topic for more information.)
For best results, your Mac client needs to be running OS X version 10.4 or later.

Connecting to a WebDAV server using Mac OS X

In Mac OS X, open Finder.
Choose Go, then Connect To Server.
Enter the URL of the WebDAV server in Server Address. For example:
http://www.example.com/path/
Click Connect.

For more information, please see the following help topics that are available on Apple's Web site:

Troubleshooting WebDAV connections using Mac OS X

These are some of the issues that I've seen:

WebDavFS connections are read-only if WebDAV LOCKs are disabled on the server. Because of this:
- If you are using WebDAV 7.0 on IIS 7 you will not be able write files to the server; this is because WebDAV locks were not available in this release.
- If you are using WebDAV 7.5 on IIS 7 you will need to enable locks before you can write files to the server; this is because WebDAV locks are disabled by default. (Note: See the How to Use WebDAV Locks topic for more information.)
WebDavFS connections attempt to create files that may be blocked by IIS:
- "Desktop Services Store" (.DS_Store) files. (See http://en.wikipedia.org/wiki/.DS_Store for a description.)
- "Resource Fork" (e.g. "._filename.ext") files. (See http://en.wikipedia.org/wiki/Resource_fork for a description.)
Allowing unknown MIME types for WebDAV requests should allow these file types, and that setting is located under Web Settings action for the WebDAV Authoring Rules feature of IIS Manager.

For more information, see the following topics that are available on Apple's Web site:
- Mac OS X 10.4: How to prevent .DS_Store file creation over network connections
- Mac OS X 10.4: Windows Server 2003 IIS Web Server fails GET call on .DS_Store and ._ files

In Closing...

I have to reiterate that I'm not a Mac OS X expert, so this list is probably not all-inclusive, but it's helped to resolve some of the issues that I've seen.

FTP Clients - Part 6: Core FTP LE

robert_mcmurray — Sat, 02 May 2009 02:10:00 GMT

For this installment in my series about FTP Clients, I'd like to take a look at the Core FTP client. For this blog post I used Core FTP Lite Edition (LE) version 1.3c (build 1447) and version 2.1 (build 1603), although all of my screen shots are from version 2.1. Core FTP is available from the following URL:

http://www.coreftp.com/

At the time of this blog post, Core FTP provides the LE for free and charges a small fee for a professional version.

Like most graphical FTP clients, the Core FTP LE user interface is pretty easy to use and rather straight-forward - you have separate windows for your local and remote files/folders, as well as a logging window that lists the FTP commands that are sent and the FTP server's responses:

Core FTP LE has a great Site Manager feature, which allows you to store commonly-used connections to FTP sites:

Clicking on the Advanced button gives you a great deal of additional configuration settings, and I'll say more about that later:

Command-Line Support

This is one of my favorite Core FTP LE features: command-line support. Yes - I'm a geek - and I like being able to script things and run batch jobs to automate whatever I can, so command-line support is always a plus for me. That said, the interface for the Core FTP LE command-line client is not an interactive experience like you get with the built-in Windows FTP.EXE or MOVEit Freely command-line clients. The Core FTP LE command-line client is provided as via the Corecmd.exe file that is installed in the main the Core FTP LE application directory, and is used for a single FTP operation like GET or PUT - although you can pass the name of a script file to execute several commands before/after logging in or before/after a file transfer.

So my final judgment is that the Core FTP LE client doesn't have great command-line support, but it's still really nice to have.

Using FTP over SSL (FTPS)

The Core FTP LE client supports both Implicit and Explicit FTPS, so the choice is up to you which method to use. When creating a connection to a server, Core FTP LE has three FTP options that you can use with FTP7:

AUTH SSL
AUTH TLS
FTPS (SSL DIRECT)

It's important to choose this option correctly, otherwise you will run into problems when trying access a site using FTPS. If you'll recall from my "FTP Clients - Part 2: Explicit FTPS versus Implicit FTPS" and my other FTP client blog posts, Explicit FTPS allows the client to initiate SSL/TLS whenever it wants, but for most FTP clients that will be when logging in to your FTP site, and in that regard it may almost seem like Implicit FTPS, but behind the scenes the FTP client and server are communicating differently.

In the case of FTP7, the following rules apply:

If you enable FTPS in FTP7 and you assign the FTP site to port 990, you are using Implicit FTPS - Core FTP LE refers to this as FTPS (SSL DIRECT). (Note: make sure that you configure your FTP client to connect on port 990.)
If you enable FTPS in FTP7 and you assign the FTP site to any port other than port 990, you are using Explicit FTPS - Core FTP LE allows you to configure your connection to use AUTH SSL or AUTH TLS for the explicit connection.

The type of FTPS is specified on the Connection drop-down menu:

Once you have chosen an FTPS connection, the Core FTP LE client offers you additional options where you can customize which parts of the session will be encrypted:

You can combine the Core FTP SSL options with the advanced SSL policies for your FTP7 sites to customize your security level:

Using FTP Virtual Hosts

Because Core FTP LE's site manager allows you to specify the virtual host name as part of the user credentials, Core FTP LE works great with FTP7's virtual host names. All that you need to do is use the "ftp.example.com|username" syntax when specifying your username, and when you connect to the FTP7 server it will route your requests to the correct FTP virtual host site.

Using True FTP Hosts

A really great feature of Core FTP LE is the ability to send pre-login commands, and since this feature allows you to enter custom commands you can specify the actual FTP HOST command as part of your login:

This is a tremendous feature if you're hosting multiple FTP sites on the same IP address, and gives Core FTP LE some of the best support for true FTP HOSTs.

Scorecard for Core FTP LE

That wraps it up for our quick round-trip for some of Core FTP LE's features, and here's the scorecard results:

Client Name	Directory Browsing	Explicit FTPS	Implicit FTPS	Virtual Hosts	True HOSTs
Core FTP LE 1.3	Rich	Y	Y	Y	Y ¹
Core FTP LE 2.1	Rich	Y	Y	Y	Y ¹
¹ As noted earlier, true FTP HOSTs are available in Site Manager using pre-login commands.

Note: Keeping with my standard disclaimer, there are a great number of additional features that Core FTP LE provides - and I just focused on the topic areas that apply to FTP7.

BLOG - FTP 7.5 Service Extensibility References

robert_mcmurray — Fri, 24 Apr 2009 03:23:00 GMT

As I pointed out in my recent blog post that was titled "FTP 7.5 and WebDAV 7.5 have been released", one of the great new features of the FTP 7.5 service is extensibility. In that blog post I mentioned that I wrote the following walkthroughs to help developers get started writing providers for the FTP 7.5 service, and these walkthroughs are all available on Microsoft's learn.iis.net Web site:

We have also recently published the FTP Service Extensibility Reference on Microsoft's MSDN Web site, and here is a list of all the reference topics that we have written for FTP 7.5 service extensibility:

I hope this helps!

Creating a Read-Only Membership Provider for phpBB 2.0 Users

robert_mcmurray — Tue, 21 Apr 2009 02:16:00 GMT

I recently posted a blog that was titled Creating a Read-Only Snitz Membership Provider, where I re-used the code from my How to use the Sample Read-Only XML Membership and Role Providers with IIS 7.0 walkthrough on the learn.iis.net web site to write a membership provider for web sites that use the Snitz Forums application. After I finished writing that blog post, I started thinking about the web sites where I use the phpBB 2.0 application, which leads us to today's blog post.

Following in the footsteps of my Snitz blog and XML walkthrough, today's blog post will show how to set up a simple, read-only provider for phpBB 2.0, although for this blog I tested a web site that was specifically using the phpBB 2.0.22 version. (Before anyone sends me email about it - I know that phpBB 3.0 is has been released and it's way cooler, but I still have web sites that are running the 2.0 phpBB forums.)

As I did with the Snitz provider, I chose to create a single namespace ("ReadOnlyPhpBBProvider") that contained two classes: one for the membership provider ("PhpBBMembershipProvider") and the other for the role provider ("PhpBBRoleProvider"); and once again I added an additional class ("PhpBBUtils") with a couple of helper methods.

Here are some of the additional implementation details:

Unlike the Snitz forums, the phpBB forums have groups, so I used those for my roles implementation.
My SQL queries are hard-coded to use the default "phpbb_" prefix; this could easily be modified.
I use the "user_regdate" and "user_session_time" fields in the "phpp_users" table to populate the membership CreationDate, LastLoginDate, and LastActivityDate values. It would be possible to retrieve the last post for a user from the phpbb_posts table and compute the LastActivityDate, but I'm not really using that value so I chose to avoid the hassle.

Step 1: Creating the Project

In this section you will create a project in Visual Studio for the membership/role provider.

Open Microsoft Visual Studio 2008.
Click the File menu, then New, then Project.
In the New Project dialog:
- Choose Visual C# as the project type.
- Choose Class Library as the template.
- Type ReadOnlyPhpBBProvider as the name of the project.
- Uncheck the Create directory for solution box.
- Click OK.
Add a reference path to the System.Configuration library:
- In the solution explorer, right-click the ReadOnlyPhpBBProvider project, then Add Reference...
- Click the .NET tab.
- Select "System.Configuration" in the list of assemblies.
- Click OK.
Add a reference path to the System.Web library:
- In the solution explorer, right-click the ReadOnlyPhpBBProvider project, then Add Reference...
- Click the .NET tab.
- Select "System.Web" in the list of assemblies.
- Click OK.
Add a strong name key to the project:
- In the solution explorer, right-click the ReadOnlyPhpBBProvider project, then Properties.
- Click the Signing tab.
- Check the Sign the assembly check box.
- Choose <New...> from the strong key name drop-down box.
- Enter ReadOnlyPhpBBProviderKey for the key file name.
- If desired, enter a password for the key file; otherwise, uncheck the Protect my key file with a password box.
- Click OK.
(Optional) Add a custom build event to automatically register the DLL in the GAC:
- In the solution explorer, right-click the ReadOnlyPhpBBProvider project, then Properties.
- Click the Build Events tab.
- Enter the following in the Post-build event command line box:
  call "%VS90COMNTOOLS%\vsvars32.bat">null gacutil.exe /if "$(TargetPath)"
Save the solution.

Step 2: Add the provider classes for the project

In this second step you will create the classes for the membership and role providers. Once again, the code for these classes is largely based on the Membership Providers and Role Providers topics on MSDN.

Open the Class1.cs file if it is not already open.
Remove all of the existing code from the class.

Paste the following sample code into the editor:

/* ======================================== */
//
// ReadOnlyPhpBBProvider
//
// A read-only membership and role provider for phpBB forums.
//
/* ======================================== */

using System;
using System.Collections;
using System.Collections.Generic;
using System.Collections.Specialized;
using System.Configuration;
using System.Configuration.Provider;
using System.Data.Odbc;
using System.Linq;
using System.Security.Cryptography;
using System.Text;
using System.Web.Security;

namespace ReadOnlyPhpBBProvider
{
  /* ======================================== */
  //
  // PhpBBMembershipProvider
  //
  /* ======================================== */

  public class PhpBBMembershipProvider : MembershipProvider
  {
    private Dictionary<string, MembershipUser> _Users;
    private string _connectionStringName;
    private string _connectionString;
    private PhpBBUtils _phpbbUtils;

    /* ---------------------------------------- */
    // MembershipProvider Properties
    /* ---------------------------------------- */

    public override string ApplicationName
    {
      get { throw new NotSupportedException(); }
      set { throw new NotSupportedException(); }
    }

    /* ---------------------------------------- */

    public override bool EnablePasswordRetrieval
    {
      get { return false; }
    }

    /* ---------------------------------------- */

    public override bool EnablePasswordReset
    {
      get { return false; }
    }

    /* ---------------------------------------- */

    public override int MaxInvalidPasswordAttempts
    {
      get { throw new NotSupportedException(); }
    }

    /* ---------------------------------------- */

    public override int MinRequiredNonAlphanumericCharacters
    {
      get { throw new NotSupportedException(); }
    }

    /* ---------------------------------------- */

    public override int MinRequiredPasswordLength
    {
      get { throw new NotSupportedException(); }
    }

    /* ---------------------------------------- */

    public override int PasswordAttemptWindow
    {
      get { throw new NotSupportedException(); }
    }

    /* ---------------------------------------- */

    public override MembershipPasswordFormat PasswordFormat
    {
      get { throw new NotSupportedException(); }
    }

    /* ---------------------------------------- */

    public override string PasswordStrengthRegularExpression
    {
      get { throw new NotSupportedException(); }
    }

    /* ---------------------------------------- */

    public override bool RequiresQuestionAndAnswer
    {
      get { throw new NotSupportedException(); }
    }

    /* ---------------------------------------- */

    public override bool RequiresUniqueEmail
    {
      get { throw new NotSupportedException(); }
    }

    /* ---------------------------------------- */
    // MembershipProvider Methods
    /* ---------------------------------------- */

    public override void Initialize(
      string name, NameValueCollection config)
    {
      if (config == null)
        throw new ArgumentNullException("config");
      if (String.IsNullOrEmpty(name))
        name = "ReadOnlyPhpBBMembershipProvider";
      if (string.IsNullOrEmpty(config["description"]))
      {
        config.Remove("description");
        config.Add("description", "Read-only phpBB membership provider");
      }
      base.Initialize(name, config);
      _connectionStringName = config["connectionStringName"];
      if (String.IsNullOrEmpty(_connectionStringName))
      {
        throw new ProviderException("No connection string was specified.\n");
      }
      _connectionString = ConfigurationManager.ConnectionStrings[
        _connectionStringName].ConnectionString;
      _phpbbUtils = new PhpBBUtils();
    }

    /* ---------------------------------------- */

    public override bool ValidateUser(
      string username, string password)
    {
      if (String.IsNullOrEmpty(username) ||
        String.IsNullOrEmpty(password))
        return false;
      try
      {
        ReadMembershipDataStore();
        MembershipUser user;
        if (_Users.TryGetValue(username, out user))
        {
          if ((user.Comment == _phpbbUtils.PasswordHash(password))
            && (user.IsLockedOut == false)
            && (user.IsApproved == true))
          {
            return true;
          }
        }
        return false;
      }
      catch (Exception)
      {
        return false;
      }
    }

    /* ---------------------------------------- */

    public override MembershipUser GetUser(
      string username, bool userIsOnline)
    {
      if (String.IsNullOrEmpty(username)) return null;
      ReadMembershipDataStore();
      try
      {
        MembershipUser user;
        if (_Users.TryGetValue(username, out user)) return user;
      }
      catch (Exception ex)
      {
        throw new ProviderException("Error: " + ex.Message);
      }
      return null;
    }

    /* ---------------------------------------- */

    public override MembershipUserCollection GetAllUsers(
      int pageIndex, int pageSize, out int totalRecords)
    {
      ReadMembershipDataStore();
      MembershipUserCollection users = new MembershipUserCollection();
      if ((pageIndex >= 0) && (pageSize >= 1))
      {
        try
        {
          foreach (KeyValuePair<string, MembershipUser> pair
            in _Users.Skip(pageIndex * pageSize).Take(pageSize))
          {
            users.Add(pair.Value);
          }
        }
        catch (Exception ex)
        {
          throw new ProviderException("Error: " + ex.Message);
        }
      }
      totalRecords = _Users.Count;
      return users;
    }

    /* ---------------------------------------- */

    public override int GetNumberOfUsersOnline()
    {
      throw new NotSupportedException();
    }

    /* ---------------------------------------- */

    public override bool ChangePassword(
      string username, string oldPassword, string newPassword)
    {
      throw new NotSupportedException();
    }

    /* ---------------------------------------- */

    public override bool ChangePasswordQuestionAndAnswer(
      string username, string password,
      string newPasswordQuestion, string newPasswordAnswer)
    {
      throw new NotSupportedException();
    }

    /* ---------------------------------------- */

    public override MembershipUser CreateUser(
      string username, string password, string email,
      string passwordQuestion, string passwordAnswer,
      bool isApproved, object providerUserKey,
      out MembershipCreateStatus status)
    {
      throw new NotSupportedException();
    }

    /* ---------------------------------------- */

    public override bool DeleteUser(
      string username, bool deleteAllRelatedData)
    {
      throw new NotSupportedException();
    }

    /* ---------------------------------------- */

    public override MembershipUserCollection FindUsersByEmail(
      string emailToMatch, int pageIndex,
      int pageSize, out int totalRecords)
    {
      throw new NotSupportedException();
    }

    /* ---------------------------------------- */
    public override MembershipUserCollection FindUsersByName(
      string usernameToMatch, int pageIndex,
      int pageSize, out int totalRecords)
    {
      throw new NotSupportedException();
    }

    /* ---------------------------------------- */

    public override string GetPassword(
      string username, string answer)
    {
      throw new NotSupportedException();
    }

    /* ---------------------------------------- */

    public override MembershipUser GetUser(
      object providerUserKey, bool userIsOnline)
    {
      throw new NotSupportedException();
    }

    /* ---------------------------------------- */

    public override string GetUserNameByEmail(string email)
    {
      throw new NotSupportedException();
    }

    /* ---------------------------------------- */

    public override string ResetPassword(
      string username, string answer)
    {
      throw new NotSupportedException();
    }

    /* ---------------------------------------- */

    public override bool UnlockUser(string userName)
    {
      throw new NotSupportedException();
    }

    /* ---------------------------------------- */

    public override void UpdateUser(MembershipUser user)
    {
      throw new NotSupportedException();
    }

    /* ---------------------------------------- */
    // MembershipProvider helper method
    /* ---------------------------------------- */

    public void ReadMembershipDataStore()
    {
      lock (this)
      {
        if (_Users == null)
        {
          try
          {
            _Users = new Dictionary<string, MembershipUser>(
              16, StringComparer.InvariantCultureIgnoreCase);
            string queryString = "SELECT * FROM phpbb_users WHERE [user_id]>0";
            using (OdbcConnection connection =
              new OdbcConnection(_connectionString))
            {
              OdbcCommand command =
                new OdbcCommand(queryString, connection);
              connection.Open();
              OdbcDataReader reader =
                command.ExecuteReader();
              while (reader.Read())
              {
                string sUserName = reader["username"].ToString();
                string sEmail = reader["user_email"].ToString();
                string sPassword = reader["user_password"].ToString();
                DateTime dCreationDate =
                  _phpbbUtils.ConvertDate(reader["user_regdate"].ToString());
                DateTime dLastLoginDate =
                  _phpbbUtils.ConvertDate(reader["user_session_time"].ToString());
                if (dLastLoginDate == new DateTime(1970, 1, 1))
                {
                  dLastLoginDate = dCreationDate;
                }
                DateTime dLastActivityDate =
                  _phpbbUtils.ConvertDate(reader["user_session_time"].ToString());
                if (dLastActivityDate == new DateTime(1970, 1, 1))
                {
                  dLastActivityDate = dLastLoginDate;
                }
                Int32 status = Convert.ToInt32(reader["user_active"].ToString());
                bool approved = (status == 0) ? false : true;
                bool locked = (status == 0) ? true : false;
                MembershipUser user = new MembershipUser(
                  Name,              // Provider name
                  sUserName,         // UserName
                  null,              // ProviderUserKey
                  sEmail,            // Email
                  String.Empty,      // PasswordQuestion
                  sPassword,         // Comment
                  approved,          // IsApproved
                  locked,            // IsLockedOut
                  dCreationDate,     // CreationDate
                  dLastLoginDate,    // LastLoginDate
                  dLastActivityDate, // LastActivityDate
                  dCreationDate,     // LastPasswordChangedDate
                  dCreationDate      // LastLockoutDate
                 );
                _Users.Add(user.UserName, user);
              }
              reader.Close();
            }
          }
          catch (Exception ex)
          {
            throw new ProviderException("Error: " + ex.Message);
          }
        }
      }
    }
  }

  /* ======================================== */
  //
  // PhpBBRoleProvider
  //
  /* ======================================== */

  public class PhpBBRoleProvider : RoleProvider
  {
    private string _connectionStringName;
    private string _connectionString;
    private PhpBBUtils _phpbbUtils;
    private Dictionary<string, string[]> _UsersAndRoles =
      new Dictionary<string, string[]>(
        16, StringComparer.InvariantCultureIgnoreCase);
    private Dictionary<string, string[]> _RolesAndUsers =
      new Dictionary<string, string[]>(
        16, StringComparer.InvariantCultureIgnoreCase);

    /* ---------------------------------------- */
    // RoleProvider properties
    /* ---------------------------------------- */

    public override string ApplicationName
    {
      get { throw new NotSupportedException(); }
      set { throw new NotSupportedException(); }
    }

    /* ---------------------------------------- */
    // RoleProvider methods
    /* ---------------------------------------- */

    public override void Initialize(
      string name, NameValueCollection config)
    {
      if (config == null)
        throw new ArgumentNullException("config");
      if (String.IsNullOrEmpty(name))
        name = "ReadOnlyPhpBBRoleProvider";
      if (String.IsNullOrEmpty(config["description"]))
      {
        config.Remove("description");
        config.Add("description", "Read-only phpBB role provider");
      }
      base.Initialize(name, config);
      _connectionStringName = config["connectionStringName"];
      if (String.IsNullOrEmpty(_connectionStringName))
      {
        throw new ProviderException(
          "No connection string was specified.\n");
      }
      _connectionString = ConfigurationManager.ConnectionStrings
        [_connectionStringName].ConnectionString;
      _phpbbUtils = new PhpBBUtils();
      ReadRoleDataStore();
    }

    /* ---------------------------------------- */

    public override bool IsUserInRole(
      string username, string roleName)
    {
      if (username == null || roleName == null)
        throw new ArgumentNullException();
      if (username == String.Empty || roleName == String.Empty)
        throw new ArgumentException();
      if (!_UsersAndRoles.ContainsKey(username))
        throw new ProviderException("Invalid user name");
      if (!_RolesAndUsers.ContainsKey(roleName))
        throw new ProviderException("Invalid role name");
      string[] roles = _UsersAndRoles[username];
      foreach (string role in roles)
      {
        if (String.Compare(role, roleName, true) == 0)
          return true;
      }
      return false;
    }

    /* ---------------------------------------- */

    public override string[] GetRolesForUser(string username)
    {
      if (username == null)
        throw new ArgumentNullException();
      if (username == String.Empty)
        throw new ArgumentException();
      string[] roles;
      if (!_UsersAndRoles.TryGetValue(username, out roles))
        throw new ProviderException("Invalid user name");
      return roles;
    }

    /* ---------------------------------------- */

    public override string[] GetUsersInRole(string roleName)
    {
      if (roleName == null)
        throw new ArgumentNullException();
      if (roleName == string.Empty)
        throw new ArgumentException();
      string[] users;
      if (!_RolesAndUsers.TryGetValue(roleName, out users))
        throw new ProviderException("Invalid role name");
      return users;
    }

    /* ---------------------------------------- */

    public override string[] GetAllRoles()
    {
      int i = 0;
      string[] roles = new string[_RolesAndUsers.Count];
      foreach (KeyValuePair<string, string[]> pair in _RolesAndUsers)
        roles[i++] = pair.Key;
      return roles;
    }

    /* ---------------------------------------- */

    public override bool RoleExists(string roleName)
    {
      if (roleName == null)
        throw new ArgumentNullException();
      if (roleName == String.Empty)
        throw new ArgumentException();
      return _RolesAndUsers.ContainsKey(roleName);
    }

    /* ---------------------------------------- */

    public override void CreateRole(string roleName)
    {
      throw new NotSupportedException();
    }

    /* ---------------------------------------- */

    public override bool DeleteRole(
      string roleName, bool throwOnPopulatedRole)
    {
      throw new NotSupportedException();
    }

    /* ---------------------------------------- */

    public override void AddUsersToRoles(
      string[] usernames, string[] roleNames)
    {
      throw new NotSupportedException();
    }

    /* ---------------------------------------- */

    public override string[] FindUsersInRole(
      string roleName, string usernameToMatch)
    {
      throw new NotSupportedException();
    }

    /* ---------------------------------------- */

    public override void RemoveUsersFromRoles(
      string[] usernames, string[] roleNames)
    {
      throw new NotSupportedException();
    }

    /* ---------------------------------------- */
    // RoleProvider helper method
    /* ---------------------------------------- */

    private void ReadRoleDataStore()
    {
      lock (this)
      {
        try
        {
          string userQueryString = "SELECT * FROM phpbb_users WHERE [user_id]>0";
          using (OdbcConnection connection =
            new OdbcConnection(_connectionString))
          {
            connection.Open();
            OdbcCommand userCommand =
              new OdbcCommand(userQueryString, connection);            
            OdbcDataReader userReader =
              userCommand.ExecuteReader();
            while (userReader.Read())
            {
              string user =
                userReader["username"].ToString();
              string userid =
                userReader["user_id"].ToString();

              string groupQueryString =
                "SELECT phpbb_groups.group_name " +
                " FROM phpbb_user_group INNER JOIN phpbb_groups " +
                " ON phpbb_user_group.group_id = phpbb_groups.group_id " +
                " WHERE (((phpbb_user_group.user_pending)=0) " +
                " AND ((phpbb_user_group.user_id)=" + userid + ") " +
                " AND ((phpbb_groups.group_single_user)=0));";

              OdbcCommand groupCommand =
                new OdbcCommand(groupQueryString, connection);
              OdbcDataReader groupReader =
                groupCommand.ExecuteReader();

              if (groupReader.HasRows == false)
              {
                _UsersAndRoles.Add(user, new string[0]);
              }
              else
              {
                ArrayList roleList = new ArrayList();
                while (groupReader.Read())
                {
                  roleList.Add(groupReader["group_name"].ToString());
                }
                string[] roles =
                  (string[])roleList.ToArray(typeof(string));
                _UsersAndRoles.Add(user, roles);
                foreach (string role in roles)
                {
                  string[] users1;
                  if (_RolesAndUsers.TryGetValue(role, out users1))
                  {
                    string[] users2 = new string[users1.Length + 1];
                    users1.CopyTo(users2, 0);
                    users2[users1.Length] = user;
                    _RolesAndUsers.Remove(role);
                    _RolesAndUsers.Add(role, users2);
                  }
                  else
                    _RolesAndUsers.Add(role, new string[] { user });
                }
              }
              groupReader.Close();
            }
            userReader.Close();
          }
        }
        catch (Exception ex)
        {
          throw new ProviderException("Error: " + ex.Message);
        }
      }
    }
  }

  /* ======================================== */
  //
  // PhpBBUtils
  //
  /* ======================================== */

  internal class PhpBBUtils
  {
    /* ---------------------------------------- */

    internal string PasswordHash(string password)
    {
      try
      {
        MD5 md5 = MD5.Create();
        byte[] byteArray =
          md5.ComputeHash(Encoding.ASCII.GetBytes(password));
        StringBuilder stringBuilder =
          new StringBuilder(byteArray.Length * 2);
        foreach (byte byteMember in byteArray)
        {
          stringBuilder.AppendFormat("{0:x2}", byteMember);
        }
        return stringBuilder.ToString();
      }
      catch (Exception ex)
      {
        throw new ProviderException("Error: " + ex.Message);
      }
    }

    /* ---------------------------------------- */

    internal DateTime ConvertDate(string offset)
    {
      DateTime dateTime = new DateTime(1970, 1, 1);
      if (!(String.IsNullOrEmpty(offset)))
      {
        try
        {
          dateTime = dateTime.AddSeconds(Convert.ToDouble(offset));
        }
        catch (Exception ex)
        {
          throw new ProviderException("Error: " + ex.Message);
        }
      }
      return dateTime;
    }
  }
}

Save and compile the project.

Step 3: Add the provider to IIS

In this third step you will determine the assembly information for the membership and role provider, and then add that information to the list of trusted providers for IIS.

Determine the assembly information for the provider:
- In Windows Explorer, open your "%WinDir%\assembly" path.
- Right-click the ReadOnlyPhpBBProvider assembly and click Properties.
- Copy the Culture value; for example: Neutral.
- Copy the Version number; for example: 1.0.0.0.
- Copy the Public Key Token value; for example: f0e1d2c3b4a59687.
- Click Cancel.
Add the provider to the list of trusted providers for IIS:
- Open the Administration.config file for editing. (Note: This file is located in your "%WinDir%\System32\Inetsrv\Config" folder.)
- Add the providers with the assembly properties from the previous steps to the <trustedProviders> section using the following syntax:
  <add type="ReadOnlyPhpBBProvider.PhpBBMembershipProvider, ReadOnlyPhpBBProvider, Version=1.0.0.0, Culture=neutral, PublicKeyToken=f0e1d2c3b4a59687" /> <add type="ReadOnlyPhpBBProvider.PhpBBRoleProvider, ReadOnlyPhpBBProvider, Version=1.0.0.0, Culture=neutral, PublicKeyToken=f0e1d2c3b4a59687" />
- Save and close the the Administration.config file.

Step 4: Configure your site for Forms Authentication using the phpBB provider

In this fourth step you will configure your Web site to use forms authentication with the membership and role providers by manually creating a Web.config file for your Web site that sets the requisite properties for forms authentication/authorization, and adding a Login.aspx page to the Web site that will process forms authentication requests.

Note: This example will authorize phpBB accounts that are members of the user-created "Members" group.

Create a Login.aspx file for your Web site:

Paste the following code into a text editor:

<%@ Page Language="C#" %>
<%@ Import Namespace="System.ComponentModel" %>
<html>
<head runat="server">
<title>Login Page</title>
</head>
<body>
   <form id="form1" runat="server">
      <asp:Login id="Login1" runat="server"
            BorderStyle="Solid"
            BackColor="#ffffcc"
            BorderWidth="1px"
            BorderColor="#cccc99"
            Font-Size="10pt"
            Font-Names="Verdana">
         <TitleTextStyle Font-Bold="True"
            ForeColor="#ffffff"
            BackColor="#666666"/>
      </asp:Login>
   </form>
</body>
</html>

Save the code as "Login.aspx" in the root of your Web site.

Create a Web.config file for your Web site:

Paste the following code into a text editor:

<configuration>
  <!-- Add the connection string for the providers. -->
  <connectionStrings>
    <add name="PhpBBForums"
      connectionString="DRIVER={Microsoft Access Driver (*.mdb)};DBQ=C:\Inetpub\wwwdata\phpbb.mdb" />
  </connectionStrings>
  <system.web>
    <!-- Add the read-only membership provider and set it as the default. -->
    <membership defaultProvider="ReadOnlyPhpBBMembershipProvider">
      <providers>
        <add name="ReadOnlyPhpBBMembershipProvider"
          type="ReadOnlyPhpBBProvider.PhpBBMembershipProvider, ReadOnlyPhpBBProvider, Version=1.0.0.0, Culture=neutral, PublicKeyToken=f0e1d2c3b4a59687"
          description="Read-only PhpBB membership provider"
          connectionStringName="PhpBBForums" />
      </providers>
    </membership>
    <!-- Add the read-only role provider and set it as the default. -->
    <roleManager defaultProvider="ReadOnlyPhpBBRoleProvider" enabled="true">
      <providers>
        <add name="ReadOnlyPhpBBRoleProvider"
          type="ReadOnlyPhpBBProvider.PhpBBRoleProvider, ReadOnlyPhpBBProvider, Version=1.0.0.0, Culture=neutral, PublicKeyToken=f0e1d2c3b4a59687"
          description="Read-only PhpBB role provider"
          connectionStringName="PhpBBForums" />
      </providers>
    </roleManager>
    <!-- Set the authentication mode to forms authentication. -->
    <authentication mode="Forms" />
  </system.web>
  <system.webServer>
    <modules>
      <!-- Set authentication for the application. -->
      <remove name="FormsAuthentication" />
      <add name="FormsAuthentication"
        type="System.Web.Security.FormsAuthenticationModule"
        preCondition="" />
      <remove name="DefaultAuthentication" />
      <add name="DefaultAuthentication"
        type="System.Web.Security.DefaultAuthenticationModule"
        preCondition="" />
      <remove name="RoleManager" />
      <add name="RoleManager"
        type="System.Web.Security.RoleManagerModule"
        preCondition="" />
    </modules>
    <security>
      <!-- Set authorization for the application. -->
      <authorization>
        <remove users="*" roles="" verbs="" />
        <add accessType="Allow" roles="Members" />
      </authorization>
    </security>
  </system.webServer>
</configuration>

Note: Make sure that the PublicKeyToken value contains the correct public key token from the assembly properties that you copied in previous steps, and the connectionString value contains the correct information for your phpBB database.
Save the code as "Web.config" in the root of your Web site.

Additional notes for using the read-only phpBB provider

As mentioned before, all of the user account management features are built-in to the phpBB forums, so I did not add them to my provider. The being said, there are still several features that integrate nicely with IIS. The following screenshot shows the list of users for a phpBB forum in Internet Explorer:

You'll notice that several pieces of information are listed for each user: username, date joined, number of posts, etc. If you open the .NET Users feature for your site, you'll notice that some of the account information is mirrored there, as shown in the following illustration:

Likewise, if you open the .NET Roles feature for your site, you'll notice that the three roles are enumerated and the number of users per role is listed:

As with my Read-Only Snitz Provider, all of the above information in the .NET Users and .NET Roles features is read-only, so any attempt to modify user or role information will return an error that the specified method is not supported:

But unlike my Snitz provider, which is limited to three built-in roles, you can add as many groups as you want to your phpBB forums and use those groups as membership roles.

Summary and parting thoughts

So now you have a simple read-only membership and role provider for the phpBB 2.0 forums. As previously mentioned - this is not a full-featured provider because I only needed it to fulfill a specific need for forms authentication. If you want to be a little adventurous, you could easily expand this provider to:

Work with the phpBB 3.0 application.
Perform some of the additional provider tasks like adding and removing users or assigning users to roles.

Have fun. ;-]

Advertising IIS Around the World

robert_mcmurray — Fri, 10 Apr 2009 19:43:00 GMT

In case you haven't already surmised from some of my other blog posts, I've been around IIS for a long time, so it should go without saying that I'm a big fan of IIS.

I remember when we first released IIS 1.0 for Windows NT 3.51 and we were handing out IIS CD-ROMs at trade shows way back in early 1996; everyone kept asking, "What is this for?" (Obviously the Internet was still a new concept to a lot of people back then.) Out of nostalgia, I kept a shrink-wrapped copy of IIS 1.0 for myself, and I think that I have one of the few boxes left. It usually sits in my office next to my IIS 4.0 Limited Edition CD-ROM...

Anyway, over the years the IIS team has printed up an assortment of IIS shirts, and I have been wearing several of these various IIS shirts as I have travelled around the world. Because I have been doing so for some time, I've found myself advertising IIS in some unexpected places. For example, my wife and I were visiting our daughter in Peru this past March, and we took the following photograph of my daughter and me (wearing one of my IIS shirts) at Machu Picchu:

So - you may ask, "What does IIS have to do with one of the newest wonders of the world?" My answer is, "Um... nothing, really." I happened to be wearing my IIS shirt that day, and it made a pretty good photo. (Obviously, it was a bad hair day for me... so I'm blaming the mountain winds. ;-] )

As another example, my son and I took a road trip down the California coast this past summer to visit my brother in San Francisco, and we posed for the following photo before boarding the boat to Alcatraz:

There are other times where I have taken advantage of a situation to deliberately and shamelessly pose for IIS. For example, I was scuba diving in Hawaii a couple of years ago, and I borrowed someone's dive slate to write the following message:

Actually, I tend to wear IIS shirts when I go scuba diving as a matter of habit - it's kind of a good luck charm for me - and this behavior of mine has led to some interesting experiences.

For example, my wife and I were going scuba diving in the Bahamas several years ago, and once again I was wearing one of my IIS t-shirts that day. The dive company had sent a van to our hotel to pick up several divers, and as I climbed aboard one of the other passengers saw my shirt and remarked, "Oh, we have an IIS person today. I'm more of an Apache Girl myself." I quickly replied, "That's okay, everybody needs a hobby." I really only expected her to get the joke, but apparently we had a tech-savvy group that day because everyone else on the bus chimed in with, "Ooooooh - you're in trouble." I didn't realize what everyone meant until we got to the dive boat where Apache Girl came walking up to me holding an air tank and said, "I'm your dive guide today, and I picked this air tank especially for you." We both had a good laugh, and I survived the dive so she can thankfully take a joke.

All that being said, I really like to show off IIS. It's a lot of fun to demonstrate the many features of IIS to customers at trade shows, and it's a lot of fun to unofficially advertise IIS when I'm traveling on vacation in various places around the world. So if you see me when I'm on vacation somewhere, the chances are good that you'll be able to find me in a crowd - because I'll be the geek wearing the IIS shirt.