ASP : Classic ASP and ADFS

This question comes up from time to time and there was a recent one on the forum.

I did this back in the day so thought it would be a good idea to write up.

Classic ASP is basically just static HTML files, no web.config, no ASP pipeline, no code behind etc.

And they are still out there.

So we will integrate it with ADFS using WIF i.e. everything is driven by a web.config.

Which means we need to add one - example in this gist.

To test this, I used a Windows 8 PC.

This PC has both WIF 3.5 and WIF 4.5 installed. WIF 4.5 is built into ASP.NET 4.5.

So you may need to install this.

This is the line in the web.config:

section name="microsoft.identityModel" type="Microsoft.IdentityModel.Configuration.MicrosoftIdentityModelSection, Microsoft.IdentityModel, Version=3.5.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35"

Also WIF doesn't run on Server 2003 - hopefully you've upgraded by now :-)

The key to getting WIF to be added to the pipeline is this line:

modules runAllManagedModulesForAllRequests="true"

Note that the logging at the end is optional and this part of the file can be removed if not required.

All the above has to be done "on the fly". There is no way to create a Classic ASP project in Visual Studio. (In fact, Microsoft go out of their way to actively discourage this. The official line is that Classic ASP is no longer supported). Consequently, there is no context checking, intellisense or compile / run phase.

I didn't use VS at all - just Notepad++.

Also remember to enable ASP under Windows Features / IIS / World Wide Web Services / Application Development Features.

And you can't use an classic Application Pool in IIS - it needs to be integrated.

I just took a folder on my local PC and added a Default.asp (which contained some basic HTML) and the web.config.

Then I added this as an application in IIS. I called the application "ClassicASPBasic".

I then configured an RP on ADFS. There is no metadata so it easiest to do this manually.

Then configure the web.config. You just need to alter the "my-adfs" to your ADFS FQDN and "my-pc" to wherever you have the website hosted.

Also remember to update the thumbprint with your ADFS token-signing certificate.

Then in IIS on the RHS - "Browse Application" - use the port 443 link.

IIS sees the web.config. The web.config tells it to use the WIF classes. WIF by default protects everything so it sends you off to ADFS to authenticate. Authenticate and you are redirected back to the simple .asp page.

The next step is to Sign Out. You cannot use the standard WIF FederatedSignOut messages because there is no .NET framework so it has to be done via a URL link on the page. If you want the user to end up on the ADFS logout page, use:

<a href="https://my-adfs/adfs/ls/?wa=wsignout1.0">Sign out</a>

If you want to the user to be redirected back to the application use:

<a href="https://my-adfs/adfs/ls/?wa=wsignout1.0&wreply=https://xxx/yyy/Logout.asp">Sign out and return</a>

where:

• xxx is the ADFS URL
• yyy is the application URL
• Logout.asp is a new page added to the site

The other way is to use VS and create an MVC application. Refer How To: Build Claims-Aware ASP.NET MVC Web Application Using WIF.

Then simply copy all your static files over.

This way allows you to access the claims as per the link. 

Enjoy!

ASP : The Web Form equivalent of MessageBox

When you are writing a Windows application, the ubiquitous MessageBox is extremely useful for popping up a quick debug message but it’s not available for ASP.NET Web Forms.

In such cases, use:

Response.Write("<script language='javascript'>alert('Your message');</script>");

Enjoy!

ASP : Displaying server variables

Sometimes you need to know who you are logged in as.

In the claims world, it’s easy because you have the IPrincipal and IIdentity objects but if these are not available, you need to go back to first principles.

Enter stage left the server variables. These are accessed from the Request object. A simple way to enumerate then all is via the html segment below which you just whack into an asp page.

<html>
    <body>
    
        <h1>ASP Request Variables Page</h1>

        <h2>
            The current user you are logged in as is: 
            <u>
                <!-- <%=Request.ServerVariables("AUTH_USER" & "<br />") %> -->
                
                <%= response.write("AUTH_USER" & "    " &  Request.ServerVariables("AUTH_USER") & "<br /><br />") %>
            <u>
        </h2>
                
            <%
                for each x in Request.ServerVariables
                    response.write(x & "&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;" &  Request.ServerVariables(x) & "<br /><br />")
                next
            %> 
            
    </body>

</html>

Enjoy!

Visual Studio : Unable to make the session state request

I was running up Visual Studio for an ASP.NET project when I got this error:

"Unable to make the session state request to the session state server. Please ensure that the ASP.NET State service is started and that the client and server ports are the same. If the server is on a remote machine, please ensure that it accepts remote requests by checking the value of HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\aspnet_state\Parameters\AllowRemoteConnection."

Mr. Google to the rescue and you have to start up:

Control Panel / Administrative Tools / Services.

Right click on ASP.NET State Service / Start



Refresh the browser and you're good to go.

Enjoy!

ASP : Using LiveHTTPHeaders to monitor what's being sent

Quite often, you need to see what a web site is sending from the ASP pages. You could use something like Ethereal but if you are a Firefox fan, an easy way is to use LiveHTTPHeaders.

You can get the LiveHTTPHeaders Firefox extension from here.

Then install it.

Click Firefox Tools / LiveHTTPHeaders.

If you want to limit the URL's that are monitored and you are a dab hand at regular expressions, then click Config tab / Filter URL's with regexp

Close the Config tab

From the Firefox menu, click Select View / Sidebar / LiveHTTPHeaders (or alternatively click Alt L)

Open a page from the website you wish to monitor. What is displayed is what is being sent to the server.

Enjoy!

ASP : Getting configuration variables from web.config

Instead of hard-coding these in the .cs code, you could use the following:

string inputFile = ConfigurationManager.AppSettings.Get("FileLoc");

In the web.config, in the appSettings section, enter something like:

LSBadd key="FileLoc" value="C:\somewhere\File.xml" /RSB

where:

LSB = Left square bracket
RSB = Right square bracket

You can also do this from Visual Studio when viewing an .aspx page. Click Website / ASP.NET configuration and type in the entries there.

Enjoy!

ASP : Creating Javascript on the server side

Javascript is normally created in the HTML file but it can be created on the server side.

e.g. the script to open another window could be:

string exampleScript =
"LSBscript language='javascript'RSB\n" +
"window.open ('http://some url', '_blank', " +
"'scrollbars=yes,resizable=yes,status=yes" +
",toolbar=no,menubar=yes,location=no" +
",width=screen.availWidth" +
",height=screen.availHeight" +
",screenX=0,screenY=0,top=0,left=0');\n" +
"LSB/scriptRSB";

ClientScript.RegisterStartupScript(typeof(Page), "ExampleScript", exampleScript);

where:

LSB = Left square bracket
RSB = Right square bracket

Enjoy!

ASP : Deploying web site from Visual Studio 5

From the ASP solution,

File / Add / New Project / Setup and Deployment / Web Setup Project

Type in a name and enter "OK".

The entry will now be in "Solution Explorer". Right-click and select "Add / Project Output". Ensure "Content Files" is selected and click "OK".

Now we want to build it. Right-click again and select build. This will create the .msi file in the directory.

Enjoy!

SOAP : Asynchronous web service

Had to implement an asynchronous web service which did not need to be real-time so no response was needed.

Had me a bit puzzled until I realised that a web service can return void!

i.e. in ASP:

[WebMethod]
public void webMethod(Some parameter)

compiles and runs no problem.

So what does it return?

The WSDL shows:

s:element name="webMethodResponse"
s:complexType /
/s:element

So it actually returns null!

Enjoy!