Monthly Archives: October 2005

Steve started writing a nifty GUI tool for HttpCfg. Good work. Now, Keith convinced him to incorporate his ACL dialog helper, maybe I can convince him to add support for well known SIDs – like here. cool!    

This is the kind of stuff I did in my “former life” – and sometimes I miss it. http://www.dhs.gov/interweb/assetlibrary/OIGr_05-31_Aug05.pdf  

I guess this is the final update for ShowContexts.aspx – it now shows: authentication & impersonation configuration settings type of Membership and Role provider type of current IPrincipal/IIdentity on Context.User  process identity thread identity (if impersonating) Context.User IIS authentication outcome … Continue reading →

Lots of information if you want to understand and extend the provider model. here.  

I posted a little command line tool here. Keith wrapped the unmanaged API here.  

I forgot to mention that there are also special directories in ASP.NET that generally cannot be browsed, e.g. App_Data and App_Code (there are more). App_Data seems to be the “designated” directory to put files that should under no circumstances be … Continue reading →

A common problem I see in audits is, that people throw all kinds of files into their ASP.NET vdir (like .xml, .mdb etc) and just assume that these files will be protected by ASP.NET authentication & authorization. This is not … Continue reading →

I am currently writing the authentication & authorization chapters of my book…the little ShowContexts.aspx page is invaluable for testing – and I even extended it a little bit and added client certificate support – so now it shows: authentication & impersonation configuration … Continue reading →

here I found the managed API for the Common Log File System. I was not sure at that time if CLFS is also included in Vista (5219) because I got some strange exceptions when I tried to use the classes. As … Continue reading →

ASP.NET 2.0 features a new configuration element called deployment. If you set this in machine.config – debugging, tracing and detailed errors are turned off machine wide. This is a nice switch for admins to make sure a dev didn’t forget … Continue reading →