How to enable windows authentication of IIS 7 + in Windows 7 or Vista ? No Windows authentication in IIS ?

I always had a Windows 7 Laptop at my home which I never used for development purposes. Today I installed Windows 7 enterprise version on my office laptop .  I created a website and wanted to set the authentication to Windows . Surprisingly I could see only anonymous authentication which is enabled by default. 


I remember sometime back I was modifying application host config file to play with windows Authentication settings on IIS 7.x .  The configurations of IIS 7 + is not as simple and straight forward as it used to be in IIS 6 and lower version ( Probably Microsoft wanted the IIS admin to be a Geek :) ). So How do we enable Windows authentication in IIS 7 for windows 7 or Vista ?

• First of all , you should have sufficient administrative access to turn or turn off windows features.
• If you have the admin previliges , Please go to control panel in Windows and select Programs as shown in figure below.
  
  
  
  
  
  
  
  
  
  
  
• In the settings page that opens, please select Turn windows features on or off .
• Now Navigate to Internet Information services --> World wide Web Services --> Security and there you should be able to see different kinds of authentications in a dialog window, just as shown in the figure below.
  
  
• Now you can choose the type of authentication you want to be enabled on your IIS 7.x server.
• If it is Windows authentication , please select windows authentication or if it is Basic authentication , select Basic authentication based on your need.
• Click Ok after selection and let windows handle it.
• Now close / Restart your IIS and you should be able to see the chosen authentication types in your IIS as below.
  
  Hope this has helped you.
  Need more asp.net tips and tricks ? For more Subscribe here or click here to get updates via email

Read More

how to find column dependencies in SQL server ? SQL server 2005 / 2008

Did you ever want to find the dependencies of a column in all the tables and stored procedures in the database ! It helps you sometimes in finding the impact of the changes you want to make very easily. May be if you dont know about the database, it would help you understand the size of the changes you want to make.

Its very simple. All you need to do is just fire this query :)...

select name
from syscomments c
join sysobjects o on c.id = o.id
where TEXT like '%TableName%' and TEXT like '%ColumnName%'

Replace the Table name and the column name with the  name of the table where the column is and the column name itself.


What is syscomments ?

As per MSDN, syscomments contains entries for each view, rule, default, trigger, CHECK constraint, DEFAULT constraint, and stored procedure within the database. The text column contains the original SQL definition statements.


What is Sysobjects ?

Sysobjects contains one row for each object that is created within a database, such as a constraint, default, log, rule, and stored procedure.


These are part of system views which you can find in the link below.


http://msdn.microsoft.com/en-us/library/ms177862.aspx


Love SQL server tips ? For more Subscribe here or click here to get updates via email

Read More

Efficient SQL server query tuning with SQL sentry Plan Explorer : Zoom in Zoom out SQL plan

A day back I had to fine tune a sql query which was way too complex to analyze with a glance. It would take endless time to do that by analyzing just the statements as I was dealing with a couple of million records..

So I decided to start using the tools available in Sql server Management Studio (SSMS) for fine tuning the query. For finding the cost associated with my query, I ran my query with my actual execution Plan set to On. When I ran the query, SSMS displayed the execution plan in the bottom pane of SSMS. Since My query is complex, so my execution plan looked like a train with 100 coaches :)...Navigating through the plan displayed in SSMS was so difficult. I could not make anything out of it. So I tried to find out tools which would help me to understand this plan in a efficient way and do some tuning with it.

I came across a wonderful tool ( Freeware ) which helped me in fine tuning my sql query easily.

SQL Sentry Plan Explorer is a lightweight standalone app that builds a graphical view using SQL query plan so that developers can understand it very easily. It does not require a collector service or database.

SQL Sentry Plan Explorer x64
SQL Sentry Plan Explorer x86

The image below explains how well the graphical view is constructed. Please click on the image to enlarge it

It helps us understand which elements in the plan costs more by displaying them in different colors ( Red for high cost, yellow for medium cost...)... It even displays the amount of data that flows between different elements to help you understand where you have more data. All you need to do is tweak accordingly and check the costs again.

How to load your plan into SQL sentry Plan explorer ?

There are different ways through which you can load your execution plan into SQL sentry plan explorer.

• In SSMS, right-click a graphical plan and select “Show Execution Plan XML”, then copy and paste the plan XML into the Plan Explorer. It doesn’t matter which pane is active, the clipboard handler is global and will auto-detect the plan XML.
• Save an execution plan from SSMS to a .sqlplan file, then open the file using the Open toolbar button, File->Open menu, or Ctrl + O. Raw plan XML files and .QueryAnalysis files (our own proprietary format) are also supported.
• Right-click an existing .sqlplan file in Windows Explorer and select “Open with -> SQL Sentry Plan Explorer”.
• Drag-and-drop a plan file onto the application (The easiest way !)

The sentry plan explorer offers you different views of the plan tree namely :

• Plan Diagram
  
• Plan Tree - A tree representation of the plan which shows all operations and associated metrics
• Top Operations - List of all plan operations, sorted by total estimated cost by default in descending Order
  
• Query Columns - List of all columns accessed by the query along with the table, operation, and index used.

The best part of this is that you can zoom in and zoom out SQL query execution plan which lets you to view your plan in a glance. Its definitely lot better than SSMS plan viewer.

You MUST HAVE .NET 4.0 PRE-INSTALLED to install and use the Plan Explorer. Download .NET 4.0 here.
SQL Sentry Plan Explorer x64
SQL Sentry Plan Explorer x86
SQL Sentry Plan Explorer Documentation
SQL Sentry Plan Explorer Change List

Need more asp.net tips and tricks ? For more Subscribe here or click here to get updates via email

If you want detailed description , please check here.

Read More

How to write your custom role provider in ASP.NET : Role provider for oracle

Did you ever have to get the user membership information / Role information from a custom table in a database other than ASPNET SQL db ... Something like you want to get the information about user role from a userinfo procedure !!

There are two primary reasons that might make you look at creating a custom role provider.

* You need to store role information in a data source that is not supported by the role providers included with the .NET Framework, such as a teradata database, an Oracle database etc...

* You need to manage role information using a database schema that is different from the database schema used by the providers that ship with the .NET Framework. E,g May be your company uses a custom schema for role authorization..

So how difficult is it to write your own custom role provider in ASP.NET ??

Believe me its as easier as drinking a glass of water :)....A Custom RoleProvider inherits from the abstract base class RoleProvider and has a number of optional methods and properties that can be overrriden.

Follow the steps below to create your own custom role provider !!

1. Add a new class to your project and name it as Something like "CustomRoleProvider".
2. Make sure you inherit the class from Abstract class Role Provider.

public class CustomRoleProvider : RoleProvider
{
///

/// This method will override the getrolesforuser method in roleprovider and do the custom implementation
///

///
///
public override string[] GetRolesForUser(string username)
{

List<string> roles = new List<string>();
//Write your own implementation and add roles returned by your methond to role array
return roles.ToArray();
}

public override void AddUsersToRoles(string[] usernames, string[] roleNames)

{
throw new NotImplementedException();
}

}

You can choose the methods for which you want to implement in the role provide class. Now your Custom role provider class is ready. Now you need to modify your web.config.

3, You need to enable the custom role provider and let your application know that the Custom role provider is its default role provider. So please add the following section to your web.config in <system.web> section.

<roleManager enabled="true" defaultProvider="RapidRoleProvider" cacheRolesInCookie="true"
cookieName="AppRoles"
cookieTimeout="20"
cookiePath="/"
cookieRequireSSL="false"
cookieSlidingExpiration="true"
cookieProtection="All">
<providers>
<clear/>
<add name="RapidRoleProvider" type="CustomeRoleProvider"/>
providers>
roleManager>

If you are using namespace in your web application, make sure you give full directive of the class location in type ... Namespace.ClassName ....

You can see that we are caching the roles in a protected cookie which expires periodically. Once you set Cacherolesincookie = true , your role provider will not reach your datbase everytime user requests for a resource. Instead it checks in the cookie and fetches the result fastly. The advantage is the improvement in performance of the application.

4. Now you are done with your custom role provider and you are ready to use it.. Lets make a small test using declarative security attributes. Lets take some page which is only accessible to user role "Normal".

[PrincipalPermission(SecurityAction.Demand, Role = "Normal")]

public partial class Default : System.Web.UI.Page

{

// ...

}

When a user tries to access the above page, the GetRolesForUser Method in CustomRoleProvider will be called to verify the user is assigned to the “Normal” Role. If so, the page works fine. If not, a SecurityException will be thrown, not allowing the page to be viewed.

Now your role provider works fine.So you can enable security trimming on your sitemap and implement role based security in your application.

If you have any doubts / Questions, please feel free to leave your comment.

Need more asp.net tips and tricks ? For more Subscribe here or click here to get updates via email

EESJ9D5YMRCC

Read More

Query String Encryption using HTTP Module : ASP.NET Security

Most of times we tend to pass information between different web pages in the application with the help of query string. However query string offers direct visibility to the end user about the parameters your page might be expecting. If some one modifies your query string and pass the information to the page , it could become a potential security threat.

/technade.aspx/ID=123&Query=select

There are lot of ways you can normally encrypt your query string. But most of them don't help you in encrypting your query parameter. They only encrypt your values. However if someone tries with different algorithms, it could again lead to a security breach unless you did some very good exception handling.

/technade.aspx/ID=s1kokkkh1kjn&Query=kjoiujooijoi

If you encrypt your query string, everytime you want to access in your values, you have to decode it and access it. If you had already written some code, there is a great impact that you will have to adapt your code after the implementation. What if there is a way where you display in encrypted format to the user but for the code its still the same ?

What I mean is :

The user sees this

?Technade=VXzal017xHwKKPolDWQ

while your code sees

ID=123&Query=select and accesses it through Request.querystring["ID"]....

How to encrypt your query string in ASP.NET with the help of HTTP Module ?

Before we dive in, let me explain you what this HTTP module is !!

HTTP modules are one among the series of extensible objects that could be initiated by ASP.NET runtime to process a request. They are filters that can pre and post-process requests as they pass through the HTTP pipeline Many of the services provided in ASP.NET are exposed as HTTP modules esp the ones related to security.

So How do we use HTTP module for encrypting and decrypting query strings ?

Download the source code for the file here.

The source file in the above link contains the code for encryption and decryption of the query string.

How to use it ?

• Include the file in your project and change the namespace accordingly.
• Once you included the file in your project, please add the following tag to your Web.config in your section.
  
  <httpModules>
  <add name="EncryptDecryptModule" type=" Technade.Web.Core.Application.EncryptDecrypt"/> httpModules>
  
• Make sure that you included correct type in the above line.

Thats it.. You are done . Now all the query string in your application will be automatically encrypted. Sometimes you may want to enable/disable query string encryption manually. The source code in the file does have the provision of enabling and disabiling query string encryption.

You will find the following line in the source code.

// Encrypt the query string and redirects to the encrypted URL.
// Remove if you don't want all query strings to be encrypted automatically.

string encryptedQuery = Encrypt(query);

Remove the line and the query strings will not be automatically encrypted. Instead you will have to call everytime manually as below whenever you want .

string querystring = EncryptDecrypt.Encrypt( "ID=123&query=select" );

But the decryption is automatic as it always checks for the encryption key that is appended before the query string in the code. So if the encryption key exists ,it will decrypt or else it will let it remain as it is. The file has been documented to a good extent. So it should not be too difficult for you to understand how it works.

Love ASP.NET tips ? For more Subscribe here or click here to get updates via email

Read More