Setting up a local environment to test styles on ADFS login - adfs

I am wondering if anyone can point me in the right direction of how to setup a local environment to test the CSS of the A~DFS login. Everywhere sends me to the CSS but no HTML.
There is a huge security process that I have to go through to be able to upload a file to the live ADFS system so I wanted to test locally that the CSS changes I was making were correct.
Cheers

You needs an instance of Windows Server and run up a VM in Azure.
You need access to a DC and you need admin rights to the server.
These steps are a good guide.

Related

Test Flex/Facebook Application localy

I´m new in Flex.
I'm trying to develop a Web Application integrated with Facebook.
I´m using Flash Builder 4.5 and the Adobe Facebook SDK.
The problem is that to test the application I need to upload the files to my webserver to avoid the facebook error.
I guess this is because Facebook only allows to run the application inside the domain that informed at my app page on Facebook.
Someone knows how can I test the application locally?
Best, Flávio
One way to test your application is to create a copy of your app on Facebook (i.e. register a new application), but set it up to point to localhost (i.e. your local development server). This will let Facebook send all the login redirects back to your local webserver rather than your current 'live' website.
It would help if you install a localhost webserver on your machine so you can run code locally. This will allow you to test your files on your own machine rather than having to upload them every time.
Set up a local web server (I like Apache, but IIS will work). with a virtual server and give it the same domain name as your production server. Use a hosts file to point the domain back to your own server.
You can also use Charles to record the web traffic, then build mock services that will provide that information.

Best way to create a sandbox area on my asp .net host

I would like to create a sandbox area on my hosting provider that only the client can see. For example the production website would be at www.domain.com. However, would it be possible to create a sandbox version of the website at www.domain.com/sandbox and only provide access to the client?
If so, what is the best method? Do I manually have to create a login page etc in the sandbox folder? Or, can I publish the test website in the sandbox area and restrict access through my hosting provider?
Generally a sandbox/staging/test version of your production site would be a complete duplicate of your production deployment, not just the login page.
You'd have a separate copy of the application and the database, and then serve it via another hostname/IP address or on an entirely different machine.
For instance, you could have www.domain.com and test.domain.com, each with the own isolated version of the software. This way your client can play as much as they want in the sandbox without fear of damaging the production environment.
To restrict access you could use access control lists in IIS to restrict the sandbox to a specific ip address (or range), or enable basic support on it with a username/password required security.

FTP Error 530 User cannot login

I am trying to FTP to a new FTP site I setup with IIS 7.0 for the Windows Server Web (64-bit) edition. But I get the above error when I try to login to this site. But I can login to my other FTP sites.
Also, when I select this website from IIS Manager, the FTP section does not display in the middle section although it does display in Action panel. And I cannot successfully login to this FTP site either.
I have checked and I have Log on locally selected. I do not have allow only anonymous connections. I have Access this computer from the network selected.
I restarted my IIS and FTP services also.
The one different thing I noticed about this website in IIS different from the other site that has FTP working is that this one there are 3 virtual directories beneath the site. And that when I click on any one of these 3, then the FTP strip does appear in the center pane. Make sense?
How can I debug cause of this error? Any SW tools I can use?
Have you tried logging in from the FTP server? If you do this, and have "Show detailed messages from local requests" enabled under FTP Messages, then you'll get a clearer idea as to why the login if failing. In my case I got the following message (I am using IIS Manager Users, and Passthrough authentication)
530-User cannot log in.
Win32 error: Access is denied.
Error details: Filename: \\?\C:\Windows\system32\inetsrv\config\redirection.config
Error: Cannot read configuration file due to insufficient permissions
To solve this I gave the NETWORK SERVICES user read only access to the config directory specified in the error message. I'm not 100% sure this is the right thing to do, but it certainly fixed this issue for me.
in my situation, I was missing Role Service FTP extensibility, which is actually allows IIS Manager Auth.
This is pretty tricky, as you could allow IIS Manager auth, but still it would not work until you have not installed FTP Extensibility
In my case I forgot to enable the Basic authentication
There seem to be many different possible causes. In my case, I was unable to login with the plain "username" with the same error as mentioned.
It was solved when I logged in with ".\username" instead.
For some reason the FTP client was trying to login with a domain account, while I just wanted to login with a local computer account.
Hope this helps someone.
Try submitting your credentials in this format:
UserName: Domain|Username
Password: secretSquirrel
I had the same problem, I removed the FTP site and followed this:
http://www.iis.net/learn/publish/using-the-ftp-service/configure-ftp-with-iis-manager-authentication-in-iis-7
Prerequisites - I set the permissions on the folders using the 4 command samples but this did not alone fix the issue, so I cannot in good faith say this step is needed, but it is what I did and it now works.
CONFIGURE THE IIS MANAGEMENT SERVICE AND ADD AN IIS 7 MANAGER -
Just do step 4, removing the existing user first and then re-adding them.
Creating a New FTP Site and Configuring an IIS 7 Manager Account -
All the steps here
CONFIGURE THE FTP SITE TO USE IIS 7 MANAGER AUTHENTICATION
All 12 steps here, including the "administrator" setting in step 5.
Then it started working for me, I am guessing when I did this without a guide I skipped something simple.
In My case I have made that user a member of IIS_IUSERS.
Using IIS Users.
Do not isolate users -> User name directory was working fine. Users started in the right folder.
When I was switching to Isolate Users -> User name Directory I had the following error:
Response: 530 User cannot log in, home directory inaccessible.
Win32 error: The system cannot find the path specified.
For some reason, you need to add the LocalUser virtual directory that points to your root.
It has to be that exact name and it's case sensitive.
That worked for me.
Per this knowledgebase article, you would need the log on locally privilege enabled.
http://support.microsoft.com/kb/200475
I had the exact same error. In my case, I was using a local user defined on the server running FTP. The username was very short (3 characters). I could "run as" this user on the server, confirming that Windows was Ok with it, and allowed it to authenticate. But when testing FTP, it would return User cannot log in.
Solution? I renamed the user to be longer (4 characters). Of course, updated its name under Authorization as well. Then FTP worked. Hope it helps someone!
For me, I've configured the IIS as per usual procedure properly. The anonymous authentication was working but specific user are not.
because, the user accounts were created in IIS. Actually it was also supposed to be created Windows local accounts.
Then it worked.
Please Check the security of folder which is use that ftp .
see if the user or group you select for that ftp is associate with security of that folder .
In my case I had to remove domain from user.
So, your user should be like username, not like domain\username.
Hope it helps to somebody.
For some reason my user was "locked". So I could "unlock" it at local user manager (computer management). Now it works fine. I hope it helps.
I would recommend checking FTP logs first. The status code will give you more information about the issue. Here is the explanation of the status codes: The FTP status codes in IIS 7.0 and later versions
I had this issue because my IIS didn't support passive mode. After entering data in FTP Firewall Support module, the issue was solved.
More scenarios from this post 530 User cannot log in, home directory inaccessible
Authorization rules. Make sure to have an Authorization rule that allows the user or anonymous access. Check “IIS > FTP site > FTP Authorization Rules” page to allow or deny access for certain or all users.
NTFS permissions. The FTP users (local or domain users) should have permissions on the physical folder. Right click the folder and go to Properties. In the Security tab, make sure the user has required permissions. You can ignore Shared tab. It is not used for FTP access.
Locked account. If you local or domain account is locked or expired, you may end up seeing “User cannot log in” error. Check local user properties or Active Directory user settings to make sure the user account is active.
Other permission issues. The user account may not have “Log on locally” or “Allow only anonymous connections security” rights.
I spent long time looking for a solution, I've tried every shared answer on the internet and nothing could solve the issue. It is an issue I was ignoring for years and I never could fix.
Ok, I've Plesk installed and I'm not sure if it has some effect on IIS FTP to do the following behavior ...
Using Process Monitor tool, and making ftp login request and watching the tool and doing your investigation using this tool, you can get a hint about the REAL reason of the problem.
For me, I found out that IIS FTP was trying to access the ftp folder from a path DIFFERENT than the actual ftp path I've set, I do not know why, but maybe Plesk has some effect on this.
The actual ftp path is
C:\inetpub\vhosts\zidapp
The path that IIS FTP was trying to access DURING the login process is
C:\inetpub\vhosts\Servers\7\localuser\zid_app_ftp_user
I fixed the issue by creating a folder link from 'actual' folder path to the path IIS was trying to access - using the tool mklink tool
CMD command
mklink /d C:\inetpub\vhosts\Servers\7\localuser\zid_app_ftp_user "C:\inetpub\vhosts\zidapp"
I've fixed the issue that way, so wen FTP is trying to access the folder from the wrong path, it is now goes to the correct one.
Please note doing folder shortcut wont work for this, you need a link like linux, not a shortcut ...
I hope it will help you :)
You can check the reference account you are using to log in.
Mine happened to be locked out causing the 530 error.

Access network share using Windows authentication

I constantly trip on this when writing apps for our intranet.
Let's say we have a network share called "\\server1\myfolder", and I'm writing an app that needs to read a text file from there. Access to the share is very limited, which is fine. If someone doesn't have access to the folder, the app catches the error and tells the user they don't have access.
This works fine when I run it locally, but when I publish the app to the test server, it never has access to the folder, no matter who is running the app. Ideally the app would impersonate the user and use their credentials, but I never seem to be able to set it up correctly.
My web.config is set up like this:
<authentication mode="Windows"/>
<identity impersonate="true"/>
I've also tried impersonate="false", but it doesn't make a difference. Can someone explain what is going on here, to someone with a very limited knowledge of IIS (this is running on IIS 6 by the way)? Any idea how this should be set up, or is it impossible?
This previous post is similar and contains a valid answer:
Access files from network share in c# web app
as does this one
Asp.net Access To Network Share
Check your IIS directory security settings. You need to have anonymous authentication turned off and Windows authentication turned on.

SharePoint 2007 Remote File Access Denied CAS

I have code running in an ascx within PageLayout within SharePoint 2007 that accesses files on a remote server i.e. File.Create("\servername\sharename\folder\file.txt"). The code runs within a SharePoint web application that has CAS trust set to Full in the web.config. The File.Create throws the following exception:-
System.UnauthorizedAccessException
Access to the path '\\servername\sharename\folder\file.txt' is denied.
The share is shared to Everyone with Full Control and the NTFS permissions are set to Everyone with Full Control. The web application app pool is running under a domain account also with explicit permissions to access that resource (not that this should be needed).
I ran Process Monitor on the remote machine and no hits were being recorded on the server. This leads me to believe that it is an issue with the SharePoint Code Access Security settings. Like I've said above, the trust in the web.config is set to Full.
Is it possible that CAS is still blocking the remote access? Can anyone think of any other area to review?
Update
A bit more information...
I've tried making the app pool acct domain admin and the problem still occurs. When using the same method to access a drive on the local machine it works fine. Running the same code in SnippetCompiler outside of sharepoint using the app pool account works fine.
Hope this helps, let me know if you can think of any more avenues of investigation or tests I can try.
Update
Im not sure if this would affect the issue but the local server is running Windows Server 2003 and the remote server is running Windows 2000.
Update
I've just tried running the code through a web part and it works fine. The file structure I use in the project that is failing is as follows:-
wss
- VirtualDirectories
- SharePointWebApp
- ...sp web app files
- .
- .
- PageLayoutControls
- control.ascx
- .
- .
Then in IIS I have the following structure:-
IIS
- Websites
- SharePointWebApp (pointing to \wss\VirtualDirectories\SharePointWebApp)
- PageLayoutControls (virtual directory pointing to \wss\VirtualDirectories\PageLayoutControls)
Then within the PageLayouts I reference the controls using the following:-
<%# Register TagPrefix="TEST" TagName="MyControl" Src="~/PageLayoutControls/control.ascx" %>
<asp:Content ContentPlaceholderID="PlaceHolderMain" runat="server">
<TEST:MyControl id="myControl" runat="server"/>
</asp:Content>Let me know if you need more info.
Update
The mystery deepens...
When I access the sharepoint site from Internet Explorer (6 or 7) on the SharePoint web front end server I do NOT get the exception.
When I access the sharepoint site from Mozilla Firefox from the SP web front end server I DO get the exception.
When I access the sharepoint site remotely from ANY browser I get the exception.
Also, it makes no difference what user I use to log on to the site, as long as they have permissions to access the sharepoint site.
Any thoughts?
Update
Hmm, I've now found that if I access the sharepoint site remotely and the sharepoint site tries to do a File.Create() locally (i.e. File.Create("C:\temp\abc.txt")) then it works. If I access the sharepoint site from the sharepoint box and do a File.Create() remotely (i.e. File.Create("\ServerName\ShareName\FolderName\file.txt")) then it works.
It only fails when I access the sharepoint site remotely and have the sharepoint site try to do a File.Create() remotely as well. Kind of a double hop problem. This makes me think it may be an NTLM / Kerberos issue.
Currently, we are running using NTLM authentication.
Has anyone else experienced this sort of issue?
Update
Yep, I'm pretty sure this is an NTLM issue not allowing a double hop. I just changed the authentication on the sharepoint site to use Basic Authentication and its worked. Changed it back to Integrated Authentication and it failed.
Now to decide whether to move the farm to use Kerberos or find another way around the issue. :-/
Update
Just giving SPSecurity.RunWithElevatedPrivileges a shot now. One thing though, is RunWithElevatedPrivileges meant to be used in this context? Previously, I've only used it to get access to lists and libraries within SharePoint rather than accessing a file access the network.
Any thoughts?
Update
Yep, SPSecurity.RunWithElevatedPrivileges resolves the issue. :-)
I wonder if this is the double-hop issue and that your code is trying to access the resource as the impersonated user, but that fails because NTLM will not impersonate to another server (Kerberos would).
Have you tried SPSecurity.RunWithElevatedPrivileges? That would remove the impersonation (RevertToSelf) and then maybe the application pool owner can just act as himself (herself?) whereas maybe it couldn't before.
Just a thought and should be pretty easy to try out.

Resources