ASP .NET Web Site Administration Tool Problem

Hi,

I have a problem when I use ASP .NET Web Application Administration tool. When I click the Security tab, I receive following message

"There is a problem with your selected data store. This can be caused by an invalid server name or credentials, or by insufficient permission. It can also be caused by the role manager feature not being enabled. Click the button below to be redirected to a page where you can choose a new data store.

The following message may help in diagnosing the problem:Unable to connect to SQL Server database."

In the same page, there is a button to go to Provider section. I clicked it, and I went to the Provider page. There, there were two links, which were: "Select a single provider for all site management data" and
"Select a different provider for each feature (advanced)". I clicked the earlier, and I was redirected to a page to select provider. There, there was a link, I clicked it and I receive following message:

"

Provider ManagementCould not establish a connection to the database.
If you have not yet created the SQL Server database, exit the Web Site Administration tool, use the aspnet_regsql command-line utility to create and configure the database, and then return to this tool to set the provider.

"

After reading this message, I opened Command Prompt and went to C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727. There, I ran the aspnet_regsql command, and then ASP .NET SQL Server Setup Wizard was displayed. In the first page of this wizard I chose "Configure SQL Server for application services" and then I clicked "Next" button. In the second page I left all fields as they were and then I clicke"Next". In the third page I only clicked "Next" and then some process ran. Finally, in the last page I received following message:

"

Setup failed.

Exception:
Unable to connect to SQL Server database.

------------
Details of failure
------------

System.Web.HttpException: Unable to connect to SQL Server database. --> System.Data.SqlClient.SqlException: An error has occurred while establishing a connection to the server. When connecting to SQL Server 2005, this failure may be caused by the fact that under the default settings SQL Server does not allow remote connections. (provider: Named Pipes Provider, error: 40 - Could not open a connection to SQL Server)
at System.Data.SqlClient.SqlInternalConnection.OnError(SqlException exception, Boolean breakConnection)
at System.Data.SqlClient.TdsParser.ThrowExceptionAndWarning(TdsParserStateObject stateObj)
at System.Data.SqlClient.TdsParser.Connect(ServerInfo serverInfo, SqlInternalConnectionTds connHandler, Boolean ignoreSniOpenTimeout, Int64 timerExpire, Boolean encrypt, Boolean trustServerCert, Boolean integratedSecurity, SqlConnection owningObject)
at System.Data.SqlClient.SqlInternalConnectionTds.AttemptOneLogin(ServerInfo serverInfo, String newPassword, Boolean ignoreSniOpenTimeout, Int64 timerExpire, SqlConnection owningObject)
at System.Data.SqlClient.SqlInternalConnectionTds.LoginNoFailover(String host, String newPassword, Boolean redirectedUserInstance, SqlConnection owningObject, SqlConnectionString connectionOptions, Int64 timerStart)
at System.Data.SqlClient.SqlInternalConnectionTds.OpenLoginEnlist(SqlConnection owningObject, SqlConnectionString connectionOptions, String newPassword, Boolean redirectedUserInstance)
at System.Data.SqlClient.SqlInternalConnectionTds..ctor(DbConnectionPoolIdentity identity, SqlConnectionString connectionOptions, Object providerInfo, String newPassword, SqlConnection owningObject, Boolean redirectedUserInstance)
at System.Data.SqlClient.SqlConnectionFactory.CreateConnection(DbConnectionOptions options, Object poolGroupProviderInfo, DbConnectionPool pool, DbConnection owningConnection)
at System.Data.ProviderBase.DbConnectionFactory.CreatePooledConnection(DbConnection owningConnection, DbConnectionPool pool, DbConnectionOptions options)
at System.Data.ProviderBase.DbConnectionPool.CreateObject(DbConnection owningObject)
at System.Data.ProviderBase.DbConnectionPool.UserCreateRequest(DbConnection owningObject)
at System.Data.ProviderBase.DbConnectionPool.GetConnection(DbConnection owningObject)
at System.Data.ProviderBase.DbConnectionFactory.GetConnection(DbConnection owningConnection)
at System.Data.ProviderBase.DbConnectionClosed.OpenConnection(DbConnection outerConnection, DbConnectionFactory connectionFactory)
at System.Data.SqlClient.SqlConnection.Open()
at System.Web.Management.SqlServices.GetSqlConnection(String server, String user, String password, Boolean trusted, String connectionString)
-- End of inner exception stack trace --
at System.Web.Management.SqlServices.GetSqlConnection(String server, String user, String password, Boolean trusted, String connectionString)
at System.Web.Management.SqlServices.SetupApplicationServices(String server, String user, String password, Boolean trusted, String connectionString, String database, String dbFileName, SqlFeatures features, Boolean install)
at System.Web.Management.SqlServices.Install(String database, SqlFeatures features, String connectionString)
at System.Web.Management.ConfirmPanel.Execute()
"

What should I do? I tried to use this administration tool on computer in my house and everything was just fine. Why do I have this problem in my office?

Hi,

It seems that you are not providing correct information about your SQL Server database on second page of that wizard. It should be properly pointing to the database which would be used by your application. When you have properly pointed it to that, it will then create some default tables and objects for you to use and enable this feature in your application.

|||

Yes, you are right! I made a mistake in step 2 of ASP .NET SQL Server Setup Wizard. Recently, I successfully went through all the steps. However, I still can't open the Security tab in ASP .NET Web Site Administration Tool. When I open the Provider section, I still receive the message below:

"

Provider ManagementCould not establish a connection to the database.
If you have not yet created the SQL Server database, exit the Web Site Administration tool, use the aspnet_regsql command-line utility to create and configure the database, and then return to this tool to set the provider.

"

What should I do? I need to create a login functionality for my site in near future. Please help me...

|||

Hi haris101,

There, there were two links, which were: "Select a single provider for all site management data" and
"Select a different provider for each feature (advanced)". I clicked the earlier, and I was redirected to a page to select provider.

Open your machine.config and search for "localsqlserver" connection string. The default is configured to use sql server express database. So, if you are not using sql express, you need to modify this "localsqlserver" connection string or specify a new connection string for the default provider.

I suggestion you read this walk-through first:http://msdn2.microsoft.com/en-us/library/879kf95c(VS.80).aspx

Hope my suggestion helps

|||

hey haris

im having the same problem -
i can get the web site to run queries
but i cant get the website administration to connect
did you ever find out the solution??
would love to know your experience

thanks
toy

|||

I'm also having a similar problem, I tried to connect the aspnet_regsql to my sql 2005 server on the network but it keeps telling me it can't connect. and i'm not sure why that is. I already have information for my web app stored in this server so i know that it is running just fine. if anyone can help that would be great, im running the vs 2005 pro with the 2.0 framework.

Thank,

Shane S.
FDOT

|||

Bo Chen – MSFT:

Hi haris101,

There, there were two links, which were: "Select a single provider for all site management data" and
"Select a different provider for each feature (advanced)". I clicked the earlier, and I was redirected to a page to select provider.

Open your machine.config and search for "localsqlserver" connection string. The default is configured to use sql server express database. So, if you are not using sql express, you need to modify this "localsqlserver" connection string or specify a new connection string for the default provider.

I suggestion you read this walk-through first:http://msdn2.microsoft.com/en-us/library/879kf95c(VS.80).aspx

Hope my suggestion helps

Thanks Bo! You are right!

For others who experience the same problem like mine, all you have to do is modify machine.config file in ...\WINDOWS\Microsoft.NET\Framework\v2.0.50727\CONFIG (this is the default location). Scroll down until you find

<connectionStrings> <add name="LocalSqlServer" connectionString="data source=.\SQLEXPRESS;Integrated Security=SSPI;AttachDBFilename=|DataDirectory|aspnetdb.mdf;User Instance=true" providerName="System.Data.SqlClient" /></connectionStrings>

What I did is changing the connection string to "Data Source=IT-HARIS\SQLEXPRESS;Integrated Security=True" since "IT-HARIS\SQLEXPRESS" is my SQL Server name and I use windows authentication to log on to this server. I hope this works for you too.

Best regards,

Haris

AS400 password request

Hi all,

I'm loading a working SSIS package in VB.NET and executing it programmatically. As the 'Persist Security Info' is set, it executes fine, presumably because I executed it previously with valid login info. But, when I update the connection info (programmatically) it prompts me for a password at runtime. The connection string will be provided by the user (DB Admin) and this is running as a Windows service, so what I want to do is, in the case of invalid login info, just receive a rejection, that I can respond to in the code. I'm using the IBMDA400 data provider to connect to an iSeries. Ideally, I need a generic solution that will apply to all connection strings and providers, if possible, but provider specific would be fine for now. Hope you can help....

Mazmo

i ran into this using 3 different AS400 connectors. Try making the Connection componments connection string a variable, and setting the connection string there. Fixed it for me, though security freaks would say this is bad. You could always encrypt your config file .|||

I'm pretty sure this won't solve my problem.

Regardless of the 'Persist Security Info' flag and whether it has connected previously, my customers will be creating the SSIS packages for my program to deal with. Wherever the connection string is stored, there will always be cases where it cannot authenticate. This is acceptable, as long as I can respond to the rejection by telling the user to edit their SSIS package and try again, instead of it automatically throwing up the login box.

So, basically, I want to supress the login box.

Any ideas?

|||We used a program called Macro Express that could track dialog boxes (amongst other things). This was our "Automation Process" before we got an open standards DMS. You could read the form title of the CLAE prompt, do a macro to email the person resonsible. Crummy workaround, but you are dealing with a 3rd party driver pop-up. So however else you do this in .net i don't know. Basically you will be screen scraping the environment, which menas you will also have to have the ssis running in a logged in user context, whcih goes over real well with sys admins (I hate it). Otherwise, maybe a windows programmer can shed some light on this using a pre-execute event or something.|||

maybe you could run a pre-emptive sql query against the 400 (such as SELECT 1+1) as a fake first step of you SSIS program. If it fails, send an email to somebody. Of course, it might time out and never trigger your catch clause.

(tried to edit but forums kept throwing errors...hopefully this gets through)

Article on RS Forms Authentication - Part II

Here comes the second part. Learn how to implement role-membership and
troubleshoot custom security.
http://www.devx.com/dotnet/Article/27133/0/page/1
--
Hope this helps.
---
Teo Lachev, MVP [SQL Server], MCSD, MCT
Author: "Microsoft Reporting Services in Action"
Publisher website: http://www.manning.com/lachev
Buy it from Amazon.com: http://shrinkster.com/eq
Home page and blog: http://www.prologika.com/
---Hi Teo
I have succesfully implemented the FAuth in my reporting services , but my
problem is I cannot use the rs.exe publishreports.rss script to deploy
reports as it gives the follwoing error: could not connect to
http://ws034/reportserver/reportservice.asmx My understanding is because it
is not passing the sqlauth cokie and hence could not connect this is how I am
calling the script:
rs -i C:\PublishReports.rss -s http://ws034/ReportServer/reportservice.asmx
-u admin -p admin -v filePath="C:\unzipped\11946\Reports" -v
sqlServerName="ws034" -v parentFolder="ScriptUpload"
any assistance would be most appreciated.
thanks in advance
"Teo Lachev [MVP]" wrote:
> Here comes the second part. Learn how to implement role-membership and
> troubleshoot custom security.
> http://www.devx.com/dotnet/Article/27133/0/page/1
> --
> Hope this helps.
> ---
> Teo Lachev, MVP [SQL Server], MCSD, MCT
> Author: "Microsoft Reporting Services in Action"
> Publisher website: http://www.manning.com/lachev
> Buy it from Amazon.com: http://shrinkster.com/eq
> Home page and blog: http://www.prologika.com/
> ---
>
>|||Yes, this stems from the fact that the cookie is not supplied. Remember, you
have to call LogonUser first to get the cookie. You may find my WinForm
sample useful to find out how to maintain and send the cookie from a non-web
client.
http://prologika.com/blog/archive/2004/08/27/169.aspx
--
Hope this helps.
---
Teo Lachev, MVP [SQL Server], MCSD, MCT
Author: "Microsoft Reporting Services in Action"
Publisher website: http://www.manning.com/lachev
Buy it from Amazon.com: http://shrinkster.com/eq
Home page and blog: http://www.prologika.com/
---
"shahab" <shahab@.discussions.microsoft.com> wrote in message
news:88A44FCD-5BD2-494F-BBB5-0E86C95AA36F@.microsoft.com...
> Hi Teo
> I have succesfully implemented the FAuth in my reporting services , but my
> problem is I cannot use the rs.exe publishreports.rss script to deploy
> reports as it gives the follwoing error: could not connect to
> http://ws034/reportserver/reportservice.asmx My understanding is because
> it
> is not passing the sqlauth cokie and hence could not connect this is how I
> am
> calling the script:
> rs -i C:\PublishReports.rss -s
> http://ws034/ReportServer/reportservice.asmx
> -u admin -p admin -v filePath="C:\unzipped\11946\Reports" -v
> sqlServerName="ws034" -v parentFolder="ScriptUpload"
> any assistance would be most appreciated.
> thanks in advance
> "Teo Lachev [MVP]" wrote:
>> Here comes the second part. Learn how to implement role-membership and
>> troubleshoot custom security.
>> http://www.devx.com/dotnet/Article/27133/0/page/1
>> --
>> Hope this helps.
>> ---
>> Teo Lachev, MVP [SQL Server], MCSD, MCT
>> Author: "Microsoft Reporting Services in Action"
>> Publisher website: http://www.manning.com/lachev
>> Buy it from Amazon.com: http://shrinkster.com/eq
>> Home page and blog: http://www.prologika.com/
>> ---
>>|||"Teo Lachev [MVP]" <teo.lachev@.nospam.prologika.com> wrote in
news:eHxxOG7EFHA.2600@.TK2MSFTNGP09.phx.gbl:
> Yes, this stems from the fact that the cookie is not supplied.
> Remember, you have to call LogonUser first to get the cookie. You may
> find my WinForm sample useful to find out how to maintain and send the
> cookie from a non-web client.
> http://prologika.com/blog/archive/2004/08/27/169.aspx
>
I am trying to implement the role-based piece of the security extension in
a web farm environment. I think that I am having my issues because of the
use of "HttpContext.Current.Cache" -- would this be an issue in a web farm?
If so, do you have any alternatives other than to not cache the roles?
Thanks!|||I don't think caching will cause any issues. Basically, if the load balanced
server doesn't find the roles in its cache, it will load them from the data
store. So, you will end up with as many cached instances of the user roles
as the number of servers but this is just a performance optimization
technique and shouldn't be a problem.
That's said though, as the article mentiones, you should be aware of memory
constraints that caching may cause. For example, if you have thousands of
users, you may consider expiring the cache on a regular basis.
--
Hope this helps.
---
Teo Lachev, MVP [SQL Server], MCSD, MCT
Author: "Microsoft Reporting Services in Action"
Publisher website: http://www.manning.com/lachev
Buy it from Amazon.com: http://shrinkster.com/eq
Home page and blog: http://www.prologika.com/
---
"Jason A. Bentley" <jason_a_bentley@.hotmail.com> wrote in message
news:Xns95FF6B0C984EDjasonabentleyhotmail@.207.46.248.16...
> "Teo Lachev [MVP]" <teo.lachev@.nospam.prologika.com> wrote in
> news:eHxxOG7EFHA.2600@.TK2MSFTNGP09.phx.gbl:
>> Yes, this stems from the fact that the cookie is not supplied.
>> Remember, you have to call LogonUser first to get the cookie. You may
>> find my WinForm sample useful to find out how to maintain and send the
>> cookie from a non-web client.
>> http://prologika.com/blog/archive/2004/08/27/169.aspx
> I am trying to implement the role-based piece of the security extension in
> a web farm environment. I think that I am having my issues because of the
> use of "HttpContext.Current.Cache" -- would this be an issue in a web
> farm?
> If so, do you have any alternatives other than to not cache the roles?
> Thanks!|||I should've given more thought on this, Jason.
I forgot the fact that article code implements role caching in LogonUser.
This WILL present an issue with load balancing since LogonUser is called
once during the cookie lifetime and the custom extension will not find the
roles on the second server during user authorization (assuming that
authentication takes place on server one and the user is re-directed and
authorized on server two). So, one workaround is to move role caching to the
CheckOperations helper function in the Authorization extension. Another
workaround of course is to use sticky sessions.
Thanks for bringing this up.
---
Teo Lachev, MVP [SQL Server], MCSD, MCT
Author: "Microsoft Reporting Services in Action"
Publisher website: http://www.manning.com/lachev
Buy it from Amazon.com: http://shrinkster.com/eq
Home page and blog: http://www.prologika.com/
---
"Teo Lachev [MVP]" <teo.lachev@.nospam.prologika.com> wrote in message
news:u1aseJKFFHA.2572@.tk2msftngp13.phx.gbl...
>I don't think caching will cause any issues. Basically, if the load
>balanced server doesn't find the roles in its cache, it will load them from
>the data store. So, you will end up with as many cached instances of the
>user roles as the number of servers but this is just a performance
>optimization technique and shouldn't be a problem.
> That's said though, as the article mentiones, you should be aware of
> memory constraints that caching may cause. For example, if you have
> thousands of users, you may consider expiring the cache on a regular
> basis.
> --
> Hope this helps.
> ---
> Teo Lachev, MVP [SQL Server], MCSD, MCT
> Author: "Microsoft Reporting Services in Action"
> Publisher website: http://www.manning.com/lachev
> Buy it from Amazon.com: http://shrinkster.com/eq
> Home page and blog: http://www.prologika.com/
> ---
> "Jason A. Bentley" <jason_a_bentley@.hotmail.com> wrote in message
> news:Xns95FF6B0C984EDjasonabentleyhotmail@.207.46.248.16...
>> "Teo Lachev [MVP]" <teo.lachev@.nospam.prologika.com> wrote in
>> news:eHxxOG7EFHA.2600@.TK2MSFTNGP09.phx.gbl:
>> Yes, this stems from the fact that the cookie is not supplied.
>> Remember, you have to call LogonUser first to get the cookie. You may
>> find my WinForm sample useful to find out how to maintain and send the
>> cookie from a non-web client.
>> http://prologika.com/blog/archive/2004/08/27/169.aspx
>>
>> I am trying to implement the role-based piece of the security extension
>> in
>> a web farm environment. I think that I am having my issues because of
>> the
>> use of "HttpContext.Current.Cache" -- would this be an issue in a web
>> farm?
>> If so, do you have any alternatives other than to not cache the roles?
>> Thanks!
>|||Teo thanks for your article I have successfully implemented the Forms based
authentication. My biggest problem now is I cannot run any reports that have
ORACLE datasource. It comes with an error that logon failed!
Do you know some workaround. Please any assistance would be most appreciated.
Thanks
============================================"Teo Lachev [MVP]" wrote:
> I should've given more thought on this, Jason.
> I forgot the fact that article code implements role caching in LogonUser.
> This WILL present an issue with load balancing since LogonUser is called
> once during the cookie lifetime and the custom extension will not find the
> roles on the second server during user authorization (assuming that
> authentication takes place on server one and the user is re-directed and
> authorized on server two). So, one workaround is to move role caching to the
> CheckOperations helper function in the Authorization extension. Another
> workaround of course is to use sticky sessions.
> Thanks for bringing this up.
> ---
> Teo Lachev, MVP [SQL Server], MCSD, MCT
> Author: "Microsoft Reporting Services in Action"
> Publisher website: http://www.manning.com/lachev
> Buy it from Amazon.com: http://shrinkster.com/eq
> Home page and blog: http://www.prologika.com/
> ---
> "Teo Lachev [MVP]" <teo.lachev@.nospam.prologika.com> wrote in message
> news:u1aseJKFFHA.2572@.tk2msftngp13.phx.gbl...
> >I don't think caching will cause any issues. Basically, if the load
> >balanced server doesn't find the roles in its cache, it will load them from
> >the data store. So, you will end up with as many cached instances of the
> >user roles as the number of servers but this is just a performance
> >optimization technique and shouldn't be a problem.
> >
> > That's said though, as the article mentiones, you should be aware of
> > memory constraints that caching may cause. For example, if you have
> > thousands of users, you may consider expiring the cache on a regular
> > basis.
> >
> > --
> > Hope this helps.
> >
> > ---
> > Teo Lachev, MVP [SQL Server], MCSD, MCT
> > Author: "Microsoft Reporting Services in Action"
> > Publisher website: http://www.manning.com/lachev
> > Buy it from Amazon.com: http://shrinkster.com/eq
> > Home page and blog: http://www.prologika.com/
> > ---
> >
> > "Jason A. Bentley" <jason_a_bentley@.hotmail.com> wrote in message
> > news:Xns95FF6B0C984EDjasonabentleyhotmail@.207.46.248.16...
> >> "Teo Lachev [MVP]" <teo.lachev@.nospam.prologika.com> wrote in
> >> news:eHxxOG7EFHA.2600@.TK2MSFTNGP09.phx.gbl:
> >>
> >> Yes, this stems from the fact that the cookie is not supplied.
> >> Remember, you have to call LogonUser first to get the cookie. You may
> >> find my WinForm sample useful to find out how to maintain and send the
> >> cookie from a non-web client.
> >>
> >> http://prologika.com/blog/archive/2004/08/27/169.aspx
> >>
> >>
> >> I am trying to implement the role-based piece of the security extension
> >> in
> >> a web farm environment. I think that I am having my issues because of
> >> the
> >> use of "HttpContext.Current.Cache" -- would this be an issue in a web
> >> farm?
> >> If so, do you have any alternatives other than to not cache the roles?
> >>
> >> Thanks!
> >
> >
>
>|||The report data source fails or the LogonUser fails? What kind of
authentication do you use?
--
Hope this helps.
---
Teo Lachev, MVP [SQL Server], MCSD, MCT
Author: "Microsoft Reporting Services in Action"
Publisher website: http://www.manning.com/lachev
Buy it from Amazon.com: http://shrinkster.com/eq
Home page and blog: http://www.prologika.com/
---
"shahab" <shahab@.discussions.microsoft.com> wrote in message
news:5E6A0C29-AB87-4B5E-A788-927A87003CFA@.microsoft.com...
> Teo thanks for your article I have successfully implemented the Forms
> based
> authentication. My biggest problem now is I cannot run any reports that
> have
> ORACLE datasource. It comes with an error that logon failed!
> Do you know some workaround. Please any assistance would be most
> appreciated.
> Thanks
>
> ============================================> "Teo Lachev [MVP]" wrote:
>> I should've given more thought on this, Jason.
>> I forgot the fact that article code implements role caching in LogonUser.
>> This WILL present an issue with load balancing since LogonUser is called
>> once during the cookie lifetime and the custom extension will not find
>> the
>> roles on the second server during user authorization (assuming that
>> authentication takes place on server one and the user is re-directed and
>> authorized on server two). So, one workaround is to move role caching to
>> the
>> CheckOperations helper function in the Authorization extension. Another
>> workaround of course is to use sticky sessions.
>> Thanks for bringing this up.
>> ---
>> Teo Lachev, MVP [SQL Server], MCSD, MCT
>> Author: "Microsoft Reporting Services in Action"
>> Publisher website: http://www.manning.com/lachev
>> Buy it from Amazon.com: http://shrinkster.com/eq
>> Home page and blog: http://www.prologika.com/
>> ---
>> "Teo Lachev [MVP]" <teo.lachev@.nospam.prologika.com> wrote in message
>> news:u1aseJKFFHA.2572@.tk2msftngp13.phx.gbl...
>> >I don't think caching will cause any issues. Basically, if the load
>> >balanced server doesn't find the roles in its cache, it will load them
>> >from
>> >the data store. So, you will end up with as many cached instances of the
>> >user roles as the number of servers but this is just a performance
>> >optimization technique and shouldn't be a problem.
>> >
>> > That's said though, as the article mentiones, you should be aware of
>> > memory constraints that caching may cause. For example, if you have
>> > thousands of users, you may consider expiring the cache on a regular
>> > basis.
>> >
>> > --
>> > Hope this helps.
>> >
>> > ---
>> > Teo Lachev, MVP [SQL Server], MCSD, MCT
>> > Author: "Microsoft Reporting Services in Action"
>> > Publisher website: http://www.manning.com/lachev
>> > Buy it from Amazon.com: http://shrinkster.com/eq
>> > Home page and blog: http://www.prologika.com/
>> > ---
>> >
>> > "Jason A. Bentley" <jason_a_bentley@.hotmail.com> wrote in message
>> > news:Xns95FF6B0C984EDjasonabentleyhotmail@.207.46.248.16...
>> >> "Teo Lachev [MVP]" <teo.lachev@.nospam.prologika.com> wrote in
>> >> news:eHxxOG7EFHA.2600@.TK2MSFTNGP09.phx.gbl:
>> >>
>> >> Yes, this stems from the fact that the cookie is not supplied.
>> >> Remember, you have to call LogonUser first to get the cookie. You may
>> >> find my WinForm sample useful to find out how to maintain and send
>> >> the
>> >> cookie from a non-web client.
>> >>
>> >> http://prologika.com/blog/archive/2004/08/27/169.aspx
>> >>
>> >>
>> >> I am trying to implement the role-based piece of the security
>> >> extension
>> >> in
>> >> a web farm environment. I think that I am having my issues because of
>> >> the
>> >> use of "HttpContext.Current.Cache" -- would this be an issue in a web
>> >> farm?
>> >> If so, do you have any alternatives other than to not cache the roles?
>> >>
>> >> Thanks!
>> >
>> >
>>|||thanks for your time. I managed to get it working, what I did was that I
uninstalled RS ,uninstalled the Oracle 9.1 client and then reinstalled Oracle
client and RS respectively. for some reason the RS was not identifying the
existence of Oracle on my machine maybe I installed Oracle client after the
RS was installed.
"Teo Lachev [MVP]" wrote:
> The report data source fails or the LogonUser fails? What kind of
> authentication do you use?
> --
> Hope this helps.
> ---
> Teo Lachev, MVP [SQL Server], MCSD, MCT
> Author: "Microsoft Reporting Services in Action"
> Publisher website: http://www.manning.com/lachev
> Buy it from Amazon.com: http://shrinkster.com/eq
> Home page and blog: http://www.prologika.com/
> ---
> "shahab" <shahab@.discussions.microsoft.com> wrote in message
> news:5E6A0C29-AB87-4B5E-A788-927A87003CFA@.microsoft.com...
> > Teo thanks for your article I have successfully implemented the Forms
> > based
> > authentication. My biggest problem now is I cannot run any reports that
> > have
> > ORACLE datasource. It comes with an error that logon failed!
> > Do you know some workaround. Please any assistance would be most
> > appreciated.
> > Thanks
> >
> >
> > ============================================> > "Teo Lachev [MVP]" wrote:
> >
> >> I should've given more thought on this, Jason.
> >>
> >> I forgot the fact that article code implements role caching in LogonUser.
> >> This WILL present an issue with load balancing since LogonUser is called
> >> once during the cookie lifetime and the custom extension will not find
> >> the
> >> roles on the second server during user authorization (assuming that
> >> authentication takes place on server one and the user is re-directed and
> >> authorized on server two). So, one workaround is to move role caching to
> >> the
> >> CheckOperations helper function in the Authorization extension. Another
> >> workaround of course is to use sticky sessions.
> >>
> >> Thanks for bringing this up.
> >>
> >> ---
> >> Teo Lachev, MVP [SQL Server], MCSD, MCT
> >> Author: "Microsoft Reporting Services in Action"
> >> Publisher website: http://www.manning.com/lachev
> >> Buy it from Amazon.com: http://shrinkster.com/eq
> >> Home page and blog: http://www.prologika.com/
> >> ---
> >>
> >> "Teo Lachev [MVP]" <teo.lachev@.nospam.prologika.com> wrote in message
> >> news:u1aseJKFFHA.2572@.tk2msftngp13.phx.gbl...
> >> >I don't think caching will cause any issues. Basically, if the load
> >> >balanced server doesn't find the roles in its cache, it will load them
> >> >from
> >> >the data store. So, you will end up with as many cached instances of the
> >> >user roles as the number of servers but this is just a performance
> >> >optimization technique and shouldn't be a problem.
> >> >
> >> > That's said though, as the article mentiones, you should be aware of
> >> > memory constraints that caching may cause. For example, if you have
> >> > thousands of users, you may consider expiring the cache on a regular
> >> > basis.
> >> >
> >> > --
> >> > Hope this helps.
> >> >
> >> > ---
> >> > Teo Lachev, MVP [SQL Server], MCSD, MCT
> >> > Author: "Microsoft Reporting Services in Action"
> >> > Publisher website: http://www.manning.com/lachev
> >> > Buy it from Amazon.com: http://shrinkster.com/eq
> >> > Home page and blog: http://www.prologika.com/
> >> > ---
> >> >
> >> > "Jason A. Bentley" <jason_a_bentley@.hotmail.com> wrote in message
> >> > news:Xns95FF6B0C984EDjasonabentleyhotmail@.207.46.248.16...
> >> >> "Teo Lachev [MVP]" <teo.lachev@.nospam.prologika.com> wrote in
> >> >> news:eHxxOG7EFHA.2600@.TK2MSFTNGP09.phx.gbl:
> >> >>
> >> >> Yes, this stems from the fact that the cookie is not supplied.
> >> >> Remember, you have to call LogonUser first to get the cookie. You may
> >> >> find my WinForm sample useful to find out how to maintain and send
> >> >> the
> >> >> cookie from a non-web client.
> >> >>
> >> >> http://prologika.com/blog/archive/2004/08/27/169.aspx
> >> >>
> >> >>
> >> >> I am trying to implement the role-based piece of the security
> >> >> extension
> >> >> in
> >> >> a web farm environment. I think that I am having my issues because of
> >> >> the
> >> >> use of "HttpContext.Current.Cache" -- would this be an issue in a web
> >> >> farm?
> >> >> If so, do you have any alternatives other than to not cache the roles?
> >> >>
> >> >> Thanks!
> >> >
> >> >
> >>
> >>
> >>
>
>

Are these the correct steps? Encrypted Connection String and Security

Hi,

Assume I have an asp.net/sql server 2000 web app in a shared hosting
environment. I then encrypt the connection string using
ProtectSection("DataProtectionConfigurationProvider") in the page load
of my default.aspx page.

Am I understanding the following concepts then correctly?

1. I upload the site to the shared hosting server.
2. The first time I run the app eg. www.whatever.com/default.aspx,
the ProtectSection method above is executed.
3. Now the conn string area of my web.config is encrypted, and
asp.net will decrypt as needed.

4. If someone were to hack the server and view the web.config --
whether via getting into the server or via ftp, they would see an
encrypted connection string.

Thanks very much!If the hosting server is shared then there is a risk, if not you have to rely upon the ISP.

Are there any diagrams on security / permissions?

I am not getting a good handle on the security implementation of SQL Server.
Is there a good diagram that visually shows the relations between the
Server Logins, Database Users and all the possible permissions etc.,
If I read volumes of text about it, I am either not getting the whole
picture or easily forgetting it after a couple of weeks!!
Thanks in advance,
SarahOn Feb 8, 12:07 pm, Sarah Bram <sarahb...@.hotmail.com> wrote:
> I am not getting a good handle on the security implementation of SQL Serve
r.
> Is there a good diagram that visually shows the relations between the
> Server Logins, Database Users and all the possible permissions etc.,
> If I read volumes of text about it, I am either not getting the whole
> picture or easily forgetting it after a couple of weeks!!
> Thanks in advance,
> Sarah
I'm not sure this is really what you want but you could try looking
at ...
http://www.microsoft.com/downloads/...ang=en#Overview
... or ...
http://tinyurl.com/t2u83
... if that's too long. The security views are in the bottom half just
left of centre.

Are SOX Auditors focused on the wrong things?

The Security Catalyst had an interesting post last week, The
Psychology of Fraud -Revisited.
In the post, Sarbanes-Oxley auditors are criticized for focusing on
minutia that is costing corporations millions, while the real cause of
fraud is corrupted humans.
In developing this argument, the author draws upon a model developed
in the early 1950's by Dr. Donald Cressey, a criminologist whose
research focused on embezzlers, called the fraud triangle. Where Dr.
Cressey's triangle consisted of pressure, rationalization, and
opportunity, the Security Catalyst altered the points of triangle for
IT fraud to include the following definitions:
- Access. Physical or logical ability to enter, touch, or reach a
resource. In computers, this is often controlled by network rules and
a user id and password.
- Knowledge. To be familiar or have experience with an object or
resource. This means having the concepts and ability on what to do
after you have accessed the resource.
- Intent. The purpose or an anticipated outcome that guides a person's
planned actions. Knowingly causing damage to the resource.
These make a great deal of sense, but the rest of the argument is lost
on me. The author tries to make the case that access rights should not
be scrutinized to the degree they are currently in SOX audits because
it is only a portion of the fraud triangle. Improper access doesn't
necessarily mean that someone has knowledge or intent.
The post even states "You can't audit against knowledge and intent."
Well, if you can't audit knowledge and intent, don't you have to audit
access? In the absence of a way to detect someone with the knowledge
and intent to perpetrate fraud, don't you have to ensure access is
being provided on an as needed basis?
In my opinion, the author's own statements actually justify why
auditors give access rights the demanding scrutiny they do today. If
access rights are poorly documented and managed, the odds are that
much greater that a person who already has the knowledge and intent
will get the golden key that completes their fraud triangle.
SOX does not prevent or reduce corporate fraud. Its requirements exist so
that a prosecuting attorney can presumptively use a corporation's records as
legal evidence against the corporation's management. Viewed in that light,
the requirements make perfect sense.
Geoff N. Hiten
Senior SQL Infrastructure Consultant
Microsoft SQL Server MVP
<jmichaud@.ecora.com> wrote in message
news:1185212726.689666.6170@.n2g2000hse.googlegroup s.com...
> The Security Catalyst had an interesting post last week, The
> Psychology of Fraud -Revisited.
> In the post, Sarbanes-Oxley auditors are criticized for focusing on
> minutia that is costing corporations millions, while the real cause of
> fraud is corrupted humans.
> In developing this argument, the author draws upon a model developed
> in the early 1950's by Dr. Donald Cressey, a criminologist whose
> research focused on embezzlers, called the fraud triangle. Where Dr.
> Cressey's triangle consisted of pressure, rationalization, and
> opportunity, the Security Catalyst altered the points of triangle for
> IT fraud to include the following definitions:
> - Access. Physical or logical ability to enter, touch, or reach a
> resource. In computers, this is often controlled by network rules and
> a user id and password.
> - Knowledge. To be familiar or have experience with an object or
> resource. This means having the concepts and ability on what to do
> after you have accessed the resource.
> - Intent. The purpose or an anticipated outcome that guides a person's
> planned actions. Knowingly causing damage to the resource.
> These make a great deal of sense, but the rest of the argument is lost
> on me. The author tries to make the case that access rights should not
> be scrutinized to the degree they are currently in SOX audits because
> it is only a portion of the fraud triangle. Improper access doesn't
> necessarily mean that someone has knowledge or intent.
> The post even states "You can't audit against knowledge and intent."
> Well, if you can't audit knowledge and intent, don't you have to audit
> access? In the absence of a way to detect someone with the knowledge
> and intent to perpetrate fraud, don't you have to ensure access is
> being provided on an as needed basis?
> In my opinion, the author's own statements actually justify why
> auditors give access rights the demanding scrutiny they do today. If
> access rights are poorly documented and managed, the odds are that
> much greater that a person who already has the knowledge and intent
> will get the golden key that completes their fraud triangle.
>