Care, Share and Grow! : Code Sample

Automate client certificate one-to-one mapping in IIS 6.0 using C#

Saurabh Singh — Sat, 11 Apr 2009 03:04:00 GMT

In PSS, we occasionally get requests from our customers wherein they want to automatically add entries for client certificate mapping in IIS or Active Directory (AD). That is either a 1-to-1, Many-to-1 or AD mapping for the client certificate authentication for the web site. I recommend going with AD mapping because that eases the management but it finally depends upon one's need.

I am not sure but I feel there is a security breach plus annoyance when an administrator has to laboriously enter the mappings for all the accounts/certificates (I am being specific to 1-to-1/Many-to-1 here).

The concern I feel when dealing with the administrator doing it for 1-to-1 and Many-to-1 are:

a. If there are hundreds of users you need to do this manually for everyone of those accounts and it's a pain.

b. Yes, the above can be automated using a script but then the second concern that arises is that whoever is running the script has to know the passwords for all these accounts to be mapped. I think this doesn't sound good.

I have written a sample application using which users can enter the mappings themselves in the IIS's Client certificate setting, i.e. entries having the client certificate mapped to a windows account (either a local IIS or AD account) and the corresponding password.

So this is how it works:

User accesses this web page from their workstation which already has the client certificate installed.
They are authenticated over Basic with SSL.
Browser sends across the client certificate as part of the HTTP web request.
This application gathers the user account, password plus the client certificate from the incoming HTTP web request and does the mapping in IIS.

I am adding the code here in case someone may want to extract the section for automated scripting instead of using it as a web app.

This code is also attached to this post as well.

using System;using System.Data;using System.Configuration;using System.Web;using System.Web.Security;using System.Security.Cryptography.X509Certificates;using System.Web.UI;using System.Web.UI.WebControls;using System.Web.UI.WebControls.WebParts;using System.Web.UI.HtmlControls;using System.DirectoryServices; /* This sample application is to automate One-to-One Client certificate mapping in IIS 6.0. * User should be able to access this site from the browser and select the client certificate * in their machine which will be mapped to their account on the IIS server for 1-to-1 mapping.  * You need to deploy this application on the IIS server which is hosting the website(s) which  * needs client certificate mapping, preferably under its own virtual directory. * * Important: * - Have the authentication for this web application configured to use Basic along with SSL. * - Have the "Accept client certificates" or "Require client certificates" selected under  *   <Website> -> Properties -> Directory Security -> Secure communications -> Edit -> Client certificates * - Ensure the website that we want the mapping for is mentioned in the web.config file associated with *   this application under <appSettings> * - In the Web.config file we are impersonating an Administrator account for this application.  *   <identity impersonate="true" userName="Administrator" password="myadminpassword"/> *   This is done because non-admin users cannot modify the IIS metabase. If you do not want users to map *   entries themselves through web page you can change this to <identity impersonate="true" />. *   In such a case only admins can add the mappings for their user accounts. Non-admins won't be able to  *   add the client mapping entries. *   This is valid for both domain or local Windows NT accounts. * - This app is written using .Net 2.0, ASP.Net 2.0 and above in mind. You should be able to make it work *   with ASP.Net 1.1 as well. * - You may prefer to run this application under its own dedicated application pool to ensure stability and security. *  * DISCLAIMER: The code is not tested for production scenarios so use it at your own risk.  *             In case one wants to use batch scripting etc or some kind of console app instead  *             of web app you can extract the code section from this page which should work fine for the job. */ public partial class _Default : System.Web.UI.Page {    protected void Page_Load(object sender, EventArgs e)      {        Response.Write("<B>Client Certificate One-to-One Mapping Application:</B><BR><HR>");        Response.Write("Serial number: " + Request.ClientCertificate.SerialNumber + "</BR><HR>");        Response.Write("Issuer: " + Request.ClientCertificate.Issuer + "</BR><HR>");        Response.Write("Subject Name: " + Request.ClientCertificate.Subject + "</BR><HR>");        if (Request.ClientCertificate.IsPresent)        {            Response.Write("Validity<BR>");            Response.Write("&nbsp;&nbsp;&nbsp;&nbsp;Not before: " + Request.ClientCertificate.ValidFrom + "</BR>");            Response.Write("&nbsp;&nbsp;&nbsp;&nbsp;Not after: " + Request.ClientCertificate.ValidUntil + "</BR><HR>");        }        else            Response.Write("<B>There is no client certificate sent along with the request!</B><HR>");         Response.Write("Authenticated User: " + Request.ServerVariables["AUTH_USER"] + "</BR><HR>");        Response.Write("Authentication Type: " + Request.ServerVariables["AUTH_TYPE"] + "</BR><HR>");    }    protected void Button1_Click(object sender, EventArgs e)    {        string user = Request.ServerVariables["AUTH_USER"];        string password = Request.ServerVariables["AUTH_PASSWORD"];        string clientCertMappingName = "Mapping for " + user;  // <--- Our One-to-One Mapping name for the entry        HttpClientCertificate cert = Request.ClientCertificate;        /*          If you want to map a client certificate located on the disk instead of the one as part of the           HTTP Web request try the code below.                    X509Certificate certificate = X509Certificate2.CreateFromCertFile(@"c:\cert.cer");          X509Certificate certificate = cert.Certificate;          byte[] certHash = certificate.GetRawCertData();        */        byte[] certHash = Request.ClientCertificate.Certificate;        try        {        //Get the name of the Web site for which mapping has to be done from the App settings in the web.config file.        string friendlyWebsiteName = ConfigurationManager.AppSettings["websitename"].ToString();         //Get the Site Identifier based on the friendly name of the Web Site.        string siteId = getsiteid(friendlyWebsiteName);         if (siteId != null)            {            string sitePath = "IIS://localhost/W3SVC/" + siteId + "/IIsCertMapper";            using (DirectoryEntry de = new DirectoryEntry(sitePath))            {                de.Invoke("CreateMapping", new object[] { certHash, user, password, clientCertMappingName, true });            }            Response.Write("Account Mapped: <B>" + Request.ServerVariables["AUTH_USER"] + "</B></BR>");            Response.Write("Mapping Name: <B>" + "Mapping for " + Request.ServerVariables["AUTH_USER"] + "</B></BR>");            Response.Write("Web Site: <B>" + friendlyWebsiteName + "</B></BR>");            }        else            {            Response.Write("<B>Web Site does not have a valid Site ID. Ensure we have the correct site name in the config file for this app.</B>");            }        }                catch (System.Runtime.InteropServices.COMException)        {            Response.Write("A COM exception occurred while setting up the mapping.");        }        catch (SystemException)        {            Response.Write("An error occurred while setting up the mapping.");        }        catch (Exception)        {            Response.Write("An error occurred while setting up the mapping.");        }           }     public string getsiteid(string websitename)    {        DirectoryEntry root = new DirectoryEntry("IIS://localhost/W3SVC");        try        {            string siteid = null;            foreach (DirectoryEntry de in root.Children)            {                if (de.SchemaClassName == "IIsWebServer")                {                    if (websitename.ToUpper() == de.Properties["ServerComment"].Value.ToString().ToUpper())                        siteid = de.Name;                }            }            if (siteid == null) return null;            return siteid;        }        catch        {            return null;        }        finally        {            root.Close();        }    }}

Ciao

Nice weekend!

Programmatically managing Virtual Server using C#

Saurabh Singh — Sat, 25 Oct 2008 04:10:00 GMT

Virtual Server 2005 (VS2005) is a well-known tool to manage Virtual Machines (VMs) on a host server. It is a great feature to manage virtualization for hardware/software. Most often one would use the VS2005 Web Admin interface to manage VMs. But at times (like the way it recently happened for a customer of mine) one may want to programmatically control the VMs. This would most often sound a necessity if you would like to provide end users access to manage basic VM activities like turn on/off, save state etc. etc. without giving them access to everything as in through the VS2005 Web Admin site.

Here are some code snippets/sample web application/links in case you would like to try your hands on something like this.

Let me show you a typical screen-shot of how VS2005 Web Admin interface looks like.

To programmatically manage the Virtual machines on a host server, you need to add a reference to a COM object for your .Net application which exposes various properties/methods.

Visual Studio will add a COM Interop layer for this. You should see the following in your Visual Studio project:

Ensure we add a namespace as "using Microsoft.VirtualServer.Interop;" in the web/form page.

Here are code snippets (in C#) to:

a. Turn On/Restore from a saved state for a Virtual machine on a local host machine.

VMVirtualServerClass vs = new VMVirtualServerClass();

VMVirtualMachine vm = vs.FindVirtualMachine(VM_name);

if (vm.State == VMVMState.vmVMState_TurnedOff || vm.State == VMVMState.vmVMState_Saved)
                {
                        VMTask vt = vm.Startup();
                        if (vt != null)
                            vt.WaitForCompletion(-1);
                }

b. Turn Off a Virtual machine on a local host machine.

VMVirtualServerClass vs = new VMVirtualServerClass();

VMVirtualMachine vm = vs.FindVirtualMachine(VM_name);

if (vm.State == VMVMState.vmVMState_Running || vm.State == VMVMState.vmVMState_Paused)
                {
                        // Turn the power off on the Guest VM
                        Label1.Text = "Forcefully shutting down VM...";
                        VMTask vt = vm.TurnOff();
                        if (vt != null)
                            vt.WaitForCompletion(-1);
                        else
                            Label1.Text = "Not ready for a turn off. Please wait and try again after a few seconds...";
                 }

c. Save state of a Virtual machine on a local host machine.

VMVirtualServerClass vs = new VMVirtualServerClass();

VMVirtualMachine vm = vs.FindVirtualMachine(VM_name);

if (vm.State == VMVMState.vmVMState_TurnedOff || vm.State == VMVMState.vmVMState_Saved)
                {
                        VMTask vt = vm.Startup();
                        if (vt != null)
                            vt.WaitForCompletion(-1);
                }

d. Pause a Virtual machine on a local host machine.

VMVirtualServerClass vs = new VMVirtualServerClass();

VMVirtualMachine vm = vs.FindVirtualMachine(VM_name);

if (vm.State == VMVMState.vmVMState_TurnedOff || vm.State == VMVMState.vmVMState_Saved)
                {
                        VMTask vt = vm.Startup();
                        if (vt != null)
                            vt.WaitForCompletion(-1);
                }

e. Resume a Virtual machine on a local host machine.

VMVirtualServerClass vs = new VMVirtualServerClass();

VMVirtualMachine vm = vs.FindVirtualMachine(VM_name);

if (vm.State == VMVMState.vmVMState_TurnedOff || vm.State == VMVMState.vmVMState_Saved)
                {
                        VMTask vt = vm.Startup();
                        if (vt != null)
                            vt.WaitForCompletion(-1);
                }

f. Reset a Virtual machine on a local host machine.

VMVirtualServerClass vs = new VMVirtualServerClass();

VMVirtualMachine vm = vs.FindVirtualMachine(VM_name);

if (vm.State == VMVMState.vmVMState_TurnedOff || vm.State == VMVMState.vmVMState_Saved)
                {
                        VMTask vt = vm.Startup();
                        if (vt != null)
                            vt.WaitForCompletion(-1);
                }

g. Shut down a virtual machine on a local host machine.

VMVirtualServerClass vs = new VMVirtualServerClass();

VMVirtualMachine vm = vs.FindVirtualMachine(VM_name);

if (vm.State == VMVMState.vmVMState_TurnedOff || vm.State == VMVMState.vmVMState_Saved)
                {
                        VMTask vt = vm.Startup();
                        if (vt != null)
                            vt.WaitForCompletion(-1);
                }

h. Enumerate all the Virtual machines running on the local host machine.

VMVirtualServerClass vs = new VMVirtualServerClass();

VMVirtualMachine vm = vs.FindVirtualMachine(VM_name);

if (vm.State == VMVMState.vmVMState_TurnedOff || vm.State == VMVMState.vmVMState_Saved)
                {
                        VMTask vt = vm.Startup();
                        if (vt != null)
                            vt.WaitForCompletion(-1);
                }

i. Check various properties exposed through the COM API.

VMVirtualServerClass vs = new VMVirtualServerClass();

VMVirtualMachine vm = vs.FindVirtualMachine(VM_name);

                string _VMName = vm.Name;
                string _guestOS = String.Empty;
                if (vm.State == VMVMState.vmVMState_Running)
                    _guestOS = vm.GuestOS.OSName;
                else
                    _guestOS = "OS: n/a"; 
                string _memory = vm.Memory.ToString();
                .......

j. At times if you want to manage VMs hosted on a remote machine and not on the local machine, here is what you need to do besides all the steps already mentioned above.

private VMVirtualServerClass connectToRemoteHost(string remoteHost)
    {
        VMVirtualServerClass virtualServerCOM = null;
        Type VMVirtualServerClassType = typeof(VMVirtualServerClass);
        try
        {
            // create remote type from class identifier
            Type DCOMType = Type.GetTypeFromCLSID(VMVirtualServerClassType.GUID, remoteHost, true);
            object DCOMObject = Activator.CreateInstance(DCOMType);
            // create local object from remote object
            virtualServerCOM = (VMVirtualServerClass)Marshal.CreateWrapperOfType(DCOMObject, VMVirtualServerClassType);
            TextBox1.Text = String.Empty;
            return virtualServerCOM;
        }
        catch
        {
            TextBox1.Text ="There was an error while connecting to the remote host. Make sure that we have the necessary permissions/settings to access the remote host";
            return null;
        }
    }

(Courtesy this MSDN magazine)

I have not included error handling in the code snippets above. Please do so when you build the actual application. Also there are many other activities that can be performed besides the ones discussed above like setting up a VM from the beginning with various components like differencing, memory, network adapter etc., changing the disk configuration of an existing machine etc. etc.

The more you explore the more you get to control through the code using the API mentioned above.

Here are some useful links related to the topic.

http://msdn.microsoft.com/en-us/magazine/cc163935.aspx

http://dotnet.sys-con.com/node/47338

http://blogs.msdn.com/david.wang/archive/2006/04/17/HOWTO-Perform-VHD-Maintenance-Automatically.aspx

http://blog.anildesai.net/?p=220, http://blog.anildesai.net/?p=214

Attached is a sample ASP.Net 2.0 web application to try the above commands if interested.

Till next time our paths cross.

Bye!

HTTP to HTTPS (SSL) Web Request Redirection

Saurabh Singh — Fri, 04 Jan 2008 00:47:42 GMT

We often get requests from our customers asking how they can seamlessly redirect web requests from HTTP to HTTPS, i.e. how they can redirect a non-SSL request to an SSL based request. Recently a colleague of mine got a similar issue and we decided to use some existing scripts that we had in our database. Unfortunately none could meet the requirement.

Basically the existing scripts redirected an HTTP request to another URL and that URL was not the original request user had asked for. It took us to let's say the homepage of the site and from there one again has to click on specific links to reach the desired page. So this will be a problem for users who have book-marked their desired web page.

Here are the steps you can try for your website such that all HTTP requests get translated to HTTPS requests and have the original URL intact.

Here are two sample codes which one can try. Both of them should *hopefully* work. First one uses VBScript in an ASP page and second one uses Javascript in an HTML page.

a).

redirectSSL.asp

<%@ Language=VBScript %>

<%

strQueryString = Request.QueryString

sslPort = null

PlainURL = Right(strQueryString, len(strQueryString) - 4)

FindLastCOlon = InStrRev(PlainURL, ":")

FirstPart = Mid(PlainURL, 1, FindLastColon - 1)

LastPart = Mid(PlainURL, FindLastColon)

LastPart = (Mid(LastPart, InStr(LastPart, "/")))

'If the SSL Port is not the default 443, you need to uncomment the line below, by default SSL port is 443.

'sslPort = ":449"

if (sslPort = null) then

    url= FirstPart & LastPart

else

    url = FirstPart & sslPort & LastPart

end if

strSecure = Replace(url, "http:", "https:", 1, 1)

Response.Redirect strSecure

%>

Steps:

-- Copy the above code and put in a file redirectSSL.asp under your Website root directory for which you want redirection to work.

-- Force SSL on the web site. To do that follow the steps mentioned below:
- Go to --> <Your_Web_Site> -> Properties -> Directory Security -> Edit (Secure Communications)
- Select Require secure channel (SSL).

-- Uncheck "Require secure channel (SSL)" option for the redirectSSL.asp page. To achieve that:
- Go to --> <Your_Web_Site> -> redirectSSL.asp -> Properties -> File Security -> Edit (Secure Communications)
- Uncheck Require secure channel (SSL).

So now we are forcing SSL to be used for all of the website contents except the redirectSSL.asp page which can be accessed over non-SSL (HTTP).

-- In the IIS manager -> <Your_Web_Site> -> Properties -> Custom Errors, modify the entry for 403;4 to look like this:

Now if you try to browse to some URL, let's say http://www.abc.com/asp/test/ssl/iistsart.htm, you will be redirected to https://www.abc.com/asp/test/ssl/iistsart.htm, without you requiring to modify HTTP to HTTPS.

If your SSL port is not the default port 443 then you need to un-comment a line in the code as mentioned in there and it will redirect the request to the appropriate URL with corrected SSL port embedded in it.

b).

redirectSSL.html

<html>

<head>

<script language="javascript">

var currentURL=location.href.substring(0,5)

if(currentURL.toLowerCase()!="https")

currentURL = location.href.substring(4,location.href.lastIndexOf(''))

var portStartPos = currentURL.lastIndexOf(':')

var sslPort = null

if(portStartPos!=0)

var relativeURL = currentURL.substring(portStartPos)

var postPortURL = relativeURL.substring(relativeURL.indexOf('/'))

var URL = currentURL.substring(0,portStartPos)

// If you are running your SSL site on a non default port other than 443 then uncomment the next line and add the right Port number.

//sslPort = ":447"

if(sslPort == null)

    currentURL = URL + postPortURL

else

    currentURL = URL + sslPort + postPortURL

var targetURL = "https" + currentURL

window.location = targetURL

</script>

</head>

</html>

Steps:

-- Copy the above code and put in a file redirectSSL.html under your Website root directory for which you want redirection to work.

So now we are forcing SSL to be used for all of the Website contents.

-- In the IIS manager -> <Your_Website> -> Properties -> custom Errors, modify the entry for 403;4 to look like this:

You need not follow the step below since we are using File Type for custom error page and not a URL as shown above in the picture. If you select URL as Type above then you will need to follow the step below.

"-- Uncheck "Require secure channel (SSL)" option for the redirectSSL.html page. To achieve that:
- Go to --> <Your_Web_Site> -> redirectSSL.asp -> Properties -> File Security -> Edit (Secure Communications)
- Uncheck Require secure channel (SSL)."

This is all you need and you should see your URL changing automagically from HTTP to HTTPS (SSL).

Hope this helps...

Accessing iis 7.0 features programmatically from configuration file(S) (C#)

Saurabh Singh — Sun, 25 Nov 2007 02:37:00 GMT

IIS 7.0 has great features for developers now. It is integrated with .Net. UI has completely changed from the previous versions. It has entirely a new look and feel. I feel there would be a steep learning curve for IIS users, but nothing to worry, unlike...(read more)

my first post on IIS 7.0......lot to explore yet :)

Saurabh Singh — Sat, 24 Nov 2007 01:15:00 GMT

Recently I have started exploring IIS 7.0 and one word that can express my feeling is "WOW!". IIS 7.0 is way ahead of all the previous versions of IIS. I have worked extensively with IIS 5.0/5.1/6.0 and I can say for sure, IIS 7.0 is completely in a different...(read more)

How to achieve a feature similar to single logon for multiple web applications using Basic authentication

Saurabh Singh — Fri, 10 Aug 2007 01:23:00 GMT

Here is something which I recently figured out. This may be very simple to many but thought of sharing it for a wider audience.

Let's say you have two ASP.Net web applications running on two different servers.
Now, assuming you have a constraint wherein you cannot use Windows integrated authentication (in cases where in you have some JSP application running on Websphere and another Asp.Net app on IIS server or any multi-platform scenarios), and you want to access the 2nd web app internally from the 1st web app for authenticated users. Now since you cannot use windows integrated authentication (e.g. Websphere doesn't support windows integrated authentication) the only option is to use Basic authentication which is supported across multiple platforms.

So here Windows integrated and anonymous authentication are out of picture and you are left with Basic authentication. Now if you want to access the 2nd Web app internally from the 1st web app and since both are configured for Basic authentication what will you do. IIS prompts for basic authentication and since you are trying to access it internally from the 1st web app you may get into issues wherein IIS will throw 401 Unauthorized error.

1st Web app ---> 2nd Web app
(Basic Authentication) (Basic Authentication)

Had Windows integrated authentication been supported we could have gone ahead with Kerberos but now that is out of picture.

This is what I figured out. If a user is authenticated using basic authentication, an Authorization header is passed (after user enters the credentials and is authenticated) to the server as part of the request header. Now this header will remain the same for a combination of username and password. Web server recognizes the future requests for the same user using the same header.

Now if you try to call the 2nd web app URL through the 1st web app using httpwebrequest you will get 401 unauthorized. This is because the web request from the 1st web app does not send the Basic authentication token to the destination by default. It sends a new request to the 2nd web app and since 2nd web app is configured for basic authentication only and no anonymous authentication it will fail with 401.

To avoid getting into such issues you can modify your code in the 1st web app such that it also appends the Authorization header (which it gets during the first basic authentication done by the 1st server) along with the new http request to the 2nd web app (now all this assuming the user is allowed to access both the websites on both the servers).

Here is code snippet on the 1st web app which calls the 2nd web app internally.

Default.aspx
==============

Default.aspx.cs
===============

Assuming web app2 being http://shrek:8080/default.aspx

Here is the error thrown on the browser:

Now try adding the following lines and browse to the page in web app1. You should be able to access the web app2 without any issues.

Default.aspx.cs
===============

If you notice we are resending the authorization header that we got during the 1st web app authentication process. The same authorization header when accessing the 2nd web app nullifies the requirement for a new authentication handshake between IIS and the its client request. If we did not pass the authorization header to the 2nd web request IIS has to renegotiate a new authentication process with its client in order to get the necessary credentials for allowing access to its contents. Thereby throwing error 401 in our case since we are calling the 2nd web app internally in the code. The above scenario can work for N number of websites which can easily be greater than 2.

Do remember to add resp.close() and reader.close() in the above code section at the end.

If IIS is configured for basic authentication only it will look for Basic Authorization header before serving the request.

Also remember if you use just a response.redirect from 1st web app to 2nd web app it will work just fine but you will be prompted twice for basic authentication. This is because you get prompted for credentials the first time when you access the 1st web app and then again when a new request is sent for the 2nd web app through response.redirect it doesn't have the authorization header by default (Remember response.redirect cause a new request to be sent to the server from the client's end). So IIS again prompts you for credentials.

If it doesn't find an authorization header it will send a 401 response back asking the client to resend the request with a valid authorization header. Here above we are adding an authorization header along with the request in the first place so that IIS need not send 401 response.

***Basic authentication sends credentials in clear text and is base64 encoded. So it can be easily decoded by a sniffer. So its recommended to use SSL with basic authentication.