New Posts New Posts RSS Feed: Security on Production Server
  FAQ FAQ  Forum Search   Calendar   Register Register  Login Login

Security on Production Server
 Post Reply Post Reply
Author
  Share Topic Share Topic  Topic Search Topic Search  Topic Options Topic Options
CodeNameTech View Drop Down
Newbie
Newbie


Joined: 03-Dec-2010
Posts: 10 		Post Options Post Options   Quote CodeNameTech Quote  Post ReplyReply Direct Link To This Post Topic: Security on Production Server
    Posted: 27-Apr-2011 at 1:26pm
That worked!  

I granted the IIS_USERS group "read" and "list folder contents" permissions to the C:\Windows\Temp folder.
After restarting IIS, I could successfully log in to my DevForce Silverlight app, using the ASP.NET membership provider.

Thank-you KimJ!  And a HUGE thank-you to Greg, who very kindly took the time, and helped me debug and troubleshoot the issue.

DevForce rocks!

Mike
Back to Top
kimj View Drop Down
IdeaBlade
IdeaBlade
Avatar

Joined: 09-May-2007
Posts: 1391 		Post Options Post Options   Quote kimj Quote  Post ReplyReply Direct Link To This Post Posted: 27-Apr-2011 at 8:28am
Thanks for the research and help Greg.
That error message with the web.config is interesting, and some googling on it proved enlightening. Since the ideablade.configuration isn't being loaded, the ASP.NET support within DevForce isn't kicking in.
Check the permissions on the c:\windows\temp folder. The IIS_USERS group should have "read" and "list folder contents" permissions. After changing the folder permissions bounce IIS. Doing this should allow the ideablade.configuration information to load successfully.
Back to Top
gregweb View Drop Down
DevForce MVP
DevForce MVP
Avatar

Joined: 10-Sep-2009
Location: Clearwater, Fl
Posts: 253 		Post Options Post Options   Quote gregweb Quote  Post ReplyReply Direct Link To This Post Posted: 27-Apr-2011 at 7:32am
Just to follow up on this for the benefit of the DevForce guys, I have been in touch with Mike via email to try to debug this.  It seems to be an IIS setting issue as he can upload an empty SL template and log in correctly, but doing the same with the DevForce an empty dev-force template hangs when the user trys to register or log-in.
 
The Entity Server is working and connects just fine as the app retrieves data correctly for anonymous user.  It is only when you try to log-in with the ASPNETDB that it hangs. 
 
No errors are produced in the Error Log except the following, but I don't know if this has to do with it.
 
IdeaBladeConfig resolution: File: C:\inetpub\wwwroot\QORSystem\web.config - found but failed to load: Unable to deserialize an object of type 'IdeaBlade.Core.IdeaBladeConfig' from the <{http://schemas.ideablade.com/2010/IdeaBladeConfig}ideablade.configuration> configuration section: Unable to generate a temporary class (result=1). error CS2001: Source file 'C:\Windows\TEMP\40bbrfsu.0.cs' could not be found error CS2008: No inputs specified
 
The config file looks like this:
 
<objectServer>
      <serverSettings useAspNetSecurityServices="true" allowAnonymousLogin="true" loginManagerRequired="true" />   
    </objectServer>
 
If the DevForce project is run from VS on his local machine connecting to the remote server, it does connect and log in just fine.
 
I am not sure what else to try.
 
Greg
Back to Top
CodeNameTech View Drop Down
Newbie
Newbie


Joined: 03-Dec-2010
Posts: 10 		Post Options Post Options   Quote CodeNameTech Quote  Post ReplyReply Direct Link To This Post Posted: 26-Apr-2011 at 11:40am
Thanks Greg.  Could you send me an email to:  mike at codename dot ca?
I will send you the link and username/password. 
I just don't want to post them on a public forum.

Thanks!
 
Mike
Back to Top
gregweb View Drop Down
DevForce MVP
DevForce MVP
Avatar

Joined: 10-Sep-2009
Location: Clearwater, Fl
Posts: 253 		Post Options Post Options   Quote gregweb Quote  Post ReplyReply Direct Link To This Post Posted: 26-Apr-2011 at 11:11am
If you post the project somewhere where I can access it, I will look at it for you.   The ASP.NET membership has a great deal in it, you don't want to have to rewrite it!
 
Greg
Back to Top
CodeNameTech View Drop Down
Newbie
Newbie


Joined: 03-Dec-2010
Posts: 10 		Post Options Post Options   Quote CodeNameTech Quote  Post ReplyReply Direct Link To This Post Posted: 26-Apr-2011 at 11:06am
So, I have resolved the issue with the non-devforce application using your suggestion above.
The permissions are fine, and everything works great with the non-devforce app.  It authenticates to the default aspnetdb.mdf, no problem.

So, I tried to apply the same principles to my DevForce app, but with no success.
Even after ensuring that the Application Pool identity has sufficient permissions to the site and database, it still will not authenticate properly.

As I mentioned above, it will accept the username/password, connect to the database to verify, but then it remains logged out, without giving any error messages.

I have also checked the configuration of the Windows 2008 server.  It has all of the Server Roles and Features that it needs to properly operate IIS & ASP.NET & Silverlight applications (as is evidenced by the fact that the non-devforce app works fine).

Any other ideas?

My next step would be to totally scrap the ASP.NET Membership provider, and attempt to build an authentication mechanism from scratch (probably using core WCF), but I would like to avoid re-inventing the wheel if at all possible.

Thanks again for your help.
Regards,

Mike
Back to Top
CodeNameTech View Drop Down
Newbie
Newbie


Joined: 03-Dec-2010
Posts: 10 		Post Options Post Options   Quote CodeNameTech Quote  Post ReplyReply Direct Link To This Post Posted: 20-Apr-2011 at 3:45pm
Thanks Greg!  I will give that a try, and let you know how it goes.
Back to Top
gregweb View Drop Down
DevForce MVP
DevForce MVP
Avatar

Joined: 10-Sep-2009
Location: Clearwater, Fl
Posts: 253 		Post Options Post Options   Quote gregweb Quote  Post ReplyReply Direct Link To This Post Posted: 20-Apr-2011 at 3:44pm
Are you running your own instance of WS08?  If so, you need to make sure that the permissions are correctly set up for the website.  This requires several steps.
 
First, verify which application pool is being used by the website.  It probably is using DefaultAppPool. Then go to the Advanced Settings of the AppPool and check which identity is being used.  It should say "ApplicationPoolIdentity"  This in fact means the Identity called "DefaultAppPool" which is created by IIS automatically.
 
You then need to make sure that the "DefaultAppPool" identity has NTFS permissions on your testbizapp directory.  If not, you need to add the permissions.  The only way to do that is through a command line tool called ICACLS.
 
ICACLS C:\inetpub\wwwroot /grant "IIS AppPool\DefaultAppPool":(M)
After you run it, open up the permissons GUI and you will see it has been added.  Verify that it has the correct permissions.
 
Here is a thread on the above: http://forums.iis.net/p/1177263/1978361.aspx
 
Then you need to make sure the Anonymous user identity is set to the Application Pool Identity. 
To do this, go to the website in IIS 7, and click on "Authentication", then click on "Anonymous Authentication".  Click on Edit, and then make sure "Application Pool Identity" is selected.
 
I am no expert on these things, I have just gotten my own web server to work!
 
Greg
 
 
Back to Top
CodeNameTech View Drop Down
Newbie
Newbie


Joined: 03-Dec-2010
Posts: 10 		Post Options Post Options   Quote CodeNameTech Quote  Post ReplyReply Direct Link To This Post Posted: 20-Apr-2011 at 2:42pm
Thanks for the reply Greg.

So, I created a blank application using the "Silverlight Business Application" (non-DevForce) template.   I then deployed the app using the standard Web Deploy function.  I did not create the aspnetdb.mdf file, as this should be created for me the first time I run the app, correct?

I run the app, click on login, and try to create a new user. It gives me the error: 
"Invoke operation 'CreateUser' failed.  Access to the path 'C:\Inetpub\wwwroot\testbizapp\App_Data' is denied."

So, for some reason, it doesn't have permission to create the database in that directory.

So, I tried creating the aspnetdb.mdf database first, and then publish it to the server along with everything else.  That doesn't work either.

I didn't encounter any of these issues with the DevForce app, as the SQL Database was not a User Instance.  It was a SQL Express DB that was  created ahead of time.

So, I am not sure what's going on.  Any ideas?
Back to Top
gregweb View Drop Down
DevForce MVP
DevForce MVP
Avatar

Joined: 10-Sep-2009
Location: Clearwater, Fl
Posts: 253 		Post Options Post Options   Quote gregweb Quote  Post ReplyReply Direct Link To This Post Posted: 20-Apr-2011 at 1:16pm
Just as a test, try a non-dev force template on your local machine, and then uploading it and see if it works.  If it does, it means it is something with DevForce, if it doesn't, it means it is something with the configuration on the server.
 
Are you using the same connection string locally as well as on the production server?  In other words, hit the production server from your Dev-Machine for the data - it should connect just fine, but you can get more data about what's going on from VS.
 
You can also pull out Fiddler and see what's going back and forth across the wire.
 
Greg


Edited by gregweb - 20-Apr-2011 at 1:16pm
Back to Top
CodeNameTech View Drop Down
Newbie
Newbie


Joined: 03-Dec-2010
Posts: 10 		Post Options Post Options   Quote CodeNameTech Quote  Post ReplyReply Direct Link To This Post Posted: 20-Apr-2011 at 11:20am
I just realized that my issue is very similar to this one:

However, how that was solved was by deleting all project files on the server, and re-uploading.
That did not work for me, unfortunately.
Back to Top
CodeNameTech View Drop Down
Newbie
Newbie


Joined: 03-Dec-2010
Posts: 10 		Post Options Post Options   Quote CodeNameTech Quote  Post ReplyReply Direct Link To This Post Posted: 20-Apr-2011 at 11:14am
I am experiencing an issue when trying to deploy my finished Silverlight application.
My application is based on the "DevForce Silverlight Business Application" template (DevForce 6.0.7), which included support for the authentication/authorization features of ASP.Net's membership provider.

When it is running on my development machine, everything works great - login/logout function works, role authorization works, etc.

As soon as I upload the application to my production server (an Amazon EC instance running Win2008 server), the security features no longer work correctly.  No changes are made to the code before deployment.

And the weird thing is, it does not even report an error - it just doesn't login.
To explain:  I click on the link in the Silverlight application to login; it brings up the dialog box to enter username & password; if I type in the incorrect password, it responds correctly by saying they are invalid credentials (so it is connecting to the database).  If I enter the correct password, it accepts the login, closes the dialog box, but does not update the application, and it remains logged out.  No error messages, no indications that anything is wrong at all.

I can't debug the application, as the problem doesn't happen when it is running on my machine!  There is no debugger on the production server.

Here's my full environment:
 - Silverlight 4
 - DevForce 6.0.7
 - IIS 7 on production server (IISExpress on dev machine)
 - SQL Server Express (on both production server and dev machine)
 - I have integrated the ASP.Net membership tables into my main database using the aspnet_regsql.exe command.  
 - Web.config file has been verified to use Membership provider correctly.

It's hard to fully detail everything in this post, so feel free to ask more questions if you think you might know what it is.
Any help is greatly appreciated.

Thanks!

Mike
Back to Top
 Post Reply Post Reply

Forum Jump Forum Permissions View Drop Down