IIS : Errors with web.config

Had a situation where I had a legacy website that I was attempting to convert to WIF and claims-based and when I ran the application, all I got was a white screen and the application just hung.

Not that familiar with the application but obviously it somehow hides errors from the user.

There was error logging but nothing in the logs.

I was completely baffled.

So I loaded IIS Manager and started looking at various controls e.g. ".NET Authorisation", ".NET Error Pages", "SSL Settings" etc. in some kind of hope that I would notice something that would give me a clue.

Then I clicked on "Default Document" and lo and behold it threw an exception because of an error in web.config.

This application has a huge web.config and in hand-crafting the WIF constructs I'd duplicated some sections.

So I did a "rinse and repeat" until IIS Manager showed me the default documents.

Makes sense - to get the default documents IIS Manager has to parse the web.config and throws exceptions if it can't.

Really neat trick to remember.

Of course. it would be cooler if VS actually did this for you!

Enjoy!

IIS : Application pool service account

IIS web sites run under application pools and if you look under "Advanced settings" you see an application pool runs under an Identity.

This Identity can be a number of accounts e.g. ApplicationPoolIdentity or NetworkService. But you can also set your own service account under "Custom account".

I needed to do this but kept getting:

"The specified password is invalid.Type a new password."

WTF?

Had a conversation with Mr. Google. Seriously - about the only probable cause not mentioned was the proverbial kitchen sink!

Then I realised that this was a domain account so I needed to type:

domain\account

Bang! Problem solved - sometimes we keep getting confused by all the trees.

Enjoy!

IIS : IE missing “Install Certificate” button on “View Certificates”

 

It’s a common problem with IE. You access a site and get a certificate error and get the pink address bar when you access the site. The solution is to install the certificate into the “Trusted Root CA” certificate store.

You normally do that by clicking the padlock icon to the right of the address bar then “View Certificates” and then clicking the “Install Certificate” button. Lately, I've come across some instances where the button is missing in action. WTF?

Mr. Google to the rescue and the solution is to right-click the IE icon on the desktop and select “Run as administrator”. (In other words, IE needs to be run as Administrator).

And then there was sweetness and light and verily the button doth appear!

Enjoy!

IIS : Classic ASP, Windows 7 and IIS 7

Classic ASP is the good old Active Sever Pages technology which was the way Microsoft rendered web sites before the advent of managed code and ASP.NET.

It is essentially just a directory of asp, htm and other static content.

It's not supported by Microsoft e.g. there is no Classic ASP project type in VS 2010. May might just as well use Notepad (as I've seen some people do!).

Anyway, needed to do some work with this using the Classic .NET AppPool and got:

"The page you are requesting cannot be served because of the extension configuration. if the page is a script, add a handler. if the file should be downloaded, add a mime map."

Mr Google suggested IIS Handler Mappings but when I looked there I saw that ISAPI.dll was disabled (no way to enable it) and the message:

"You must manage managed handlers directly in the configuration file"

Come in Mr Google - your time is up.

Eventually found the solution under Windows Features:

Under IIS / World Wide Web Services / Application Development Features:

ASP = On
ISAPI Extensions = On
ISAPI Filters = On

Under IIS / World Wide Web Services / Common HTTP Features:

Static Content = On

Enjoy!

Visual Studio : Debgging ASP.NET appaliocation running in IIS

VS 2010 - IIS 7.5.

Normal situation for me is to run my applications inside IIS rather than inside the VS web server or IIS Express. This is mainly because of issues around https (although IIS Express does help in this regard).

The problem then is how to debug it. The way around this is to use Debug / Attach to Process.

First connect to your application from a browser.

Now go to VS, set your breakpoint and in the "Attach to Process" entry, you'll see a w3wp.exe entry. (Under the user name , you'll see that it uses the DefaultAppPool.) Click on this, ignore warnings and execute your application workflow from the browser until you hit the breakpoint.

Job done!

Note: Nearly all of my applications use the DefaultAppPool. Would it breakpoint if it used a different one?

Note: I've found that unless you run up your app in the browser first, you don't see the w3wp entry.

Enjoy!

WIF : Generating self-signed certificates

If you work with WIF (Windows Identity Foundation), you'll soon find that you need lots of self-signed certificates. These are used for securing the top level SSL connection and signing and encrypting the token.

Potentially, you need three certificates. The SSL certificate is mandatory as is the token signing certificate but the token encryption certificate is optional. You could use the same certificate for all three - not that that is recommended!

In IIS 7.5, in IIS manager, click on the very top level on the LHS. In the middle pane, under IIS, click on "Server Certificates". Then in the RHS, click on "Create Self-Signed Certificate". After creating one, click on "Default Web Site" on the LHS. On the RHS, click on "Bindings" and you can associate this certificate with the HTTPS port 443 connection.

The problem with this certificate is that the cn (common name) is the machine name of your IIS server, not the URL of the web site. Also, the certificate is not added to the "Trusted Root Certificate Authorities" section of the browser certificate store. You need to do this manually. All this results in browser certificate errors.

SElfSSL7 overcomes these problems and this is the utility I generally use to resolve this. There are options to automatically add the new certificate to the certificate store and to update the IIS binding. (See a previous blog entry for more info.)

There are many other ways to create certificates e.g.:

Makecert.exe (Certificate Creation Tool)

or the

Win32 version of OpenSSL. There's a good article on how to use it here.

You can also do this in PowerShell - refer: Creating Self Signed Certificates with PowerShell.

DeployManager is a neat tool to create and display certificates (coming largely from the WCF viewpoint). Unlike the mmc snap-in which shows the Windows names (Personal), this shows the .NET names (My):

DeployManager

To look at the certificates, use:

Certutil

or OpenSSL

or the Certificate snap-in to mmc : How to: View Certificates with the MMC Snap-in. The same article also shows you how to view certificates with Internet Explorer.

The Certmgr.exe (Certificate Manager Tool) is also useful.

Enjoy!