Beginner ASP.Net / SQL Server security issues - asp.net

Okay, this may be involved...
Anyway, I am trying to learn how to use ASP.Net.
The environment is like this:
Windows 7 Professional
Visual Studio 2010
SQL Server 2008 Developer Edition
I am trying to follow the article here:
Developing and Unit Testing an ASP.NET MVC 2 Application - CodeProject
So far, I have installed IIS, IIS7 Manager, SQL Server and have built the solution from the article successfully.
Then, I created a limited rights user on Windows 7 and added that user to the authorized users in the SQL Server Management Studio.
After much trial / error, I can successfully connect to the (attached) database in the solution folder from the article. This was confirmed by running cmd.exe as the test user and connecting to the SQL server.
Now, when I publish the app to the "X:\inetpub\wwwroot\~user\site" directory, the page loads and looks similar to that shown in the CodeProject article here:
Patient Maintenance Screenshot - CodeProject
Except that I do not have any records shown between the "Patient Maintenance & Search" box and the "Patient Information" box. When I enter info into the query boxes and submit, the results page only shows "no records found". Clicking the "Save" or "Reset" button does nothing in Firefox.
So, I fire up IExplorer and attempt the same. This time, the error icon indicates that there are "missing objects" or "expected objects"...
Anyway, I then go to the IIS7 Manager and change the "Anonymous Authentication"\"Anonymous user identity" to the test user.
As that does nothing for me, I then open "Authentication\Basic Settings..." and change the "Connect As..." user to the test user and successfully test the connection.
Reloading the page in the browser this time results in the Server Error: "The current identity (MachineName\UserName) does not have write access to 'X:\Windows\Microsoft.NET\Framework\v4.0.30319\Temporary ASP.NET Files'."
So, I go to change the permissions on that folder, but decide to pause because I am really frustrated. After finally getting everything installed / updated this morning / afternoon - I took a nice nap... then got up and started on it again, but not so well...
But, now I fear that I may be headed down a wormhole. I don't want to continue beating my head against this and (probably) going about this the wrong way.
So, does anyone have any good links to blogs / tutorials that deal with a step by step approach to setting up an ASP.net site?
TIA

Add the account to IIS_USRS and see if that helps. If by chance, that doesn't help, you will need to download a utility called process monitor.
Link
http://technet.microsoft.com/hi-in/sysinternals/bb896645.aspx

Related

Hosting Jabbr on AppHarbor

I've been trying to host Jabbr on AppHarbor.
The guide here is not up to date as Jabbr doesn't have a dependency on Janrain anymore.
Steps I have done:
Installed the SQL Express addon.
I've pushed the latest Jabbr code from GitHub to the AppHarbor.
Changed the connection string with the full connections string from
configuration.
Updated jabbr:encryptionKey and jabbr:verificationKey (as David Flower suggested).
The application manage to loads up, I can usethe default login screen, I can create a new user, but when the application crashes after login was successful (I think).
It is showing Server Error
500 - Internal server error.
There is a problem with the resource you are looking for, and it cannot be displayed.
When using the AppHarbor owns Errors pane, it shows nothing related.
What is the best way to debug this?
Thanks!
Ariel

How to remove visual studio's popup "Choosing to wait for a request..."

I have a project that has, amongst other things, one web application (mvc) and one WPF application. For the part that matters, the WPF app connect to a WCF service hosted on the website.
What I want to achieve is that when I press Ctrl+F5 (start WITHOUT debugging), the build process kicks in (if needed, in other words, the default VS behavior), the WPF app launched, and if the webdev server is not launched, that it get launched too, but without opening any page on my browser (I'll manage that myself).
I managed to get that working as I want (configuration below), but every time I do a Ctrl+F5, I get a popup from VS that says
Choosing to wait for a request from another process without enabling
ASP.NET debugging results in nothing to debug.
I value the information, and that seems to match pretty much what I'm trying to accomplish anyway, but now, instead of having to close a useless tab in my browser, I have to close a modal dialog. Not a big improvement from my point of view.
So, how do I prevent this popup to show up ?
Additional information:
I don't want to start in debug mode (F5). If I need debug for the website, I'll do my usual (attaching to the webdev server).
I want the webdev server to be running all the time from the first CTRL+F5.
I don't want to publish it on IIS (even the express version)
The solution startup option is set on "Multi startup project" with the WPF app on "Start" and the website on "Start without debugging" (setting it on Start doesn't change anything, except that I also get the popup when debugging with F5 directly).
The website has its start action configured on "Don't open a page. Wait for a request from an external application". The ASP.NET checkbox in the Debuggers is checked.
Internet had not been a big help so far, so all my hopes lies on you SOers !
Edit
It seems that it was flagged as a bug, but I don't see any reference in what version it's supposed to be fixed...
Also, I discovered my question is a duplicate of this one.
I actually found another way : in the start actions, you can set it to "start external program" and reference a self quitting program. I used "C:\Windows\System32\PING.EXE". Not perfect, but also less annoying than the previous solutions.

Unable to load client print control - Seperate SQL server and Web server

I have a seperate SQL(2008 R2) box and web server(IIS 7).
The IIS server is visible to the public the SQL box is not (as it should be)
On the web server there is a asp.net page with a report viewer control.
The reportview control picks up a report from Reporting Services on the SQL box and displays the report in the web page. But when I try to print I get the "Unable to load client print control" error message.
I've looked over all the many posts, and there are many, and have tried some of the "fixes" like updating with all the service packs, etc..
I can not have the end users adjust their security settings (this would number about 100,000 users)
There must be a definitive answer to this problem. I can not believe that MS would leave this so unusable.
Any suggestions or ideas?
TIA
John
New information **
I am able to log onto the web server and using IE on the Web server bring up the reportmanager on the SQL server and print successfully. I actually was able to see the print client download and I got the expected security prompts.
I tried bringing up the website in question the same way, i.e. using IE on the web server itself, the reports display but when I go to print I get the "Unable to load" error. This occurs on a machine that seconds before was able to download the activex and successfully print.
First thing I would say is you normally have to be a local admin on the machine to actually install the client print control, if they are'nt then i think they will get this error.
I did see an issue a while ago where the ActiveX killbits update broke the client print control, i have a feeling this was on 2005 but it might be worth checking?

DotNetNuke 3.0.x on SQLServer 2005/Net 2.0.Win2003 - possible?

I've promised to take a look at an old DotNetNuke installation for a client with the intention of making a few, hopefully minor, changes. The installation is rather old - I believe version 3.0.013 - and the production copy is running against SQL Server 2000, Windows 2003 and .Net 1.1.
As the production server is live and significantly used we need a development installation first. I have attempted to install a copy on my local server - Windows 2003, SQL Server 2005, .Net 2.0, and although with a few tweaks I can successfully get it to display the site, I cannot login, or even access the login module (ie just putting in blank username and password attempting to generate a 'must enter username' type error) without getting the error 'Object reference not set to an instance of an object'
I've spent some time trying to get around this error, without success, although I am hampered by not having used this package before.
So my questions are
Has anyone managed to run DotNetNuke 3.0.x with this configuration (or do I need to setup a box with SQL 2000 and .Net 1.0 to get it to run)?
Any suggestions where I should start looking for this error, or has anyone come across anything similar before?
EDIT: Eventually chickened out and installed in on an old webserver with Win2003/SQL 2000/Net 1.1 and it went in fine on an identical install. So I guess the answer is no, it doesn't work straight out of the box.
My feeling is that you shouldn't have any trouble running in the above mentioned environment. But taking a closer look at the error itself will help us to prove that.
If the error is occurring only when you navigate to the Login module, it may be an issue loading the authentication provider. The best way to find out is to look in the DNN Event Log and take a look at the full error message.
Because you can't login to access the Event Log, you should probably just take a look at the row created in the database when you receive the error. The table is called EventLog and there may be a little bit of friction in parsing the error message out, as all of the details are stored in the database in an XML format.
In general, when moving a site from one environment to another there are only a couple of things that you'd need to do:
make sure you can connect to the database
set the file system permissions
It sounds like you already have database connectivity because you can load the site.
However, you may want to double check (just re-apply) the file system permissions for the root of the website on the machine in question. Make sure the identity of the website (typically ASP.NET Machine Account or Network Service) has 'Modify' permissions on the root website directory. Perhaps the web site can't load a particular assembly due to lack of permissions.

Configuring 'Cassini' (ASP.NET Development server) for CAC cards for testing - How?

I'm developing a new website (ASP.Net, VB codebehind pages, .Net 3.5) to replace a "Classic ASP" site.
Some of the pages are 'public' and the rest require authentication - in this case it's done by reading DoD-issued CAC cards through the keyboard.
Now, for 'production', they configure IIS so that it does the authentication challenge (reading the card and requesting a PIN) when it hits a certain directory (/secure in this case) so that all pages in that tree are secured.
I'm coming ot the point where I need to see some of the information fomr the card - but when I "F5" the website I'm developing, all the Request.Clientcertificate stuff is empty - there's no 'challenge' happening with the Cassini ASP.Net development server.
I see references to "configure IIS to put SSL on the target directory" - but I'm not running IIS on this development PC (nor is the other developer who's going to run into this shortly). The network support people will be doing this when the site is eventually copied into production but I need to test certain security features now.
How can I configure the server that came with VS2008 to read the CAC card and 'load up' the server/session variables that I need to query? Alternatively, is there anything I can put into the .aspx or .aspx.vb pages themselves that can simulate or trigger the security challenge?
Thanks in advance.
Short answer. Cassini doesn't support that kind of security.
I would hope you found a solution to this by now... but just in case, I will tell you that I do similar development and I ran into the same problem. The only "solution" I found was to simply publish the website/webpage to a server with IIS configured to require client certificates, etc...
Of course, this does prevent you from using the "debug" feature in Visual Studio, but there is always the method of injecting debug statements into code [e.g.: response.write() followed by response.end() if necessary]... I also built a page I used for enumerating all the strings available from request.clientcertificate(), and even later expanded it to run a provided regex for searching the entire certificate...
Hope those ideas prove useful!

Resources