ADFS : Beware IIS and ADFS

Just read this post:

2012R2 AD FS WAP proxy problem

This was to do with installing WAP with Active Directory Federation Service and getting:

"Unable to retrieve proxy configuration data from the Federation Server." 

The interesting part is the piece at the end:

"Turns out certificate binding precedence is the culprit.  While IIS is not required for 2012 R2 ADFS roles anymore, it can actually get in the way if it is on the same machine.  Binding cert to default web site in IIS will place an ip:port entry into sslcert bindings, which has a higher precedence than service:port entries that ADFS sets up.  Since the IIS entry has no Ctl Store Name, the WAP certificate is placed in a store that is filtered out when ADFS checks for its presence.

Type "netsh http show sslcert" in a terminal on your ADFS machines and look for entries higher on the list than your ADFS service name entries.  If those don't have Ctl Store Name of AdfsTrustedDevices and they can resolve to your ADFS service, the install will fail."

The point for me is that sometimes I'm having problems with ADFS in terms of connectivity. The metadata address and the IDPInitiatedSignOn only work when you have a half-decent install. Ping is disabled by default. So I install IIS just so I can check connectivity

e.g. https://server.domain.

and you should get the IIS splash screen.

So this is something to be aware of.

On a 2012 R2 server with no IIS:

PS C:\> netsh http show sslcert

SSL Certificate bindings:
-------------------------

    Hostname:port                :server.domain:443
    Certificate Hash             : e6a5e9d2358f158ae4e98f753a5cd2bcfda12005
    Application ID               : {5d89a20c-beab-4389-9447-324788eb944a}
    Certificate Store Name       : MY
    Verify Client Certificate Revocation : Enabled
    Verify Revocation Using Cached Client Certificate Only : Disabled
    Usage Check                  : Enabled
    Revocation Freshness Time    : 0
    URL Retrieval Timeout        : 0
    Ctl Identifier               : (null)
    Ctl Store Name               : AdfsTrustedDevices
    DS Mapper Usage              : Disabled
    Negotiate Client Certificate : Disabled

    Hostname:port                : localhost:443
    Certificate Hash             : e6a5e9d2358f158ae4e98f753a5cd2bcfda12005
    Application ID               : {5d89a20c-beab-4389-9447-324788eb944a}
    Certificate Store Name       : MY
    Verify Client Certificate Revocation : Enabled
    Verify Revocation Using Cached Client Certificate Only : Disabled
    Usage Check                  : Enabled
    Revocation Freshness Time    : 0
    URL Retrieval Timeout        : 0
    Ctl Identifier               : (null)
    Ctl Store Name               : AdfsTrustedDevices
    DS Mapper Usage              : Disabled
    Negotiate Client Certificate : Disabled

    Hostname:port                : server.domain:49443
    Certificate Hash             : e6a5e9d2358f158ae4e98f753a5cd2bcfda12005
    Application ID               : {5d89a20c-beab-4389-9447-324788eb944a}
    Certificate Store Name       : MY
    Verify Client Certificate Revocation : Enabled
    Verify Revocation Using Cached Client Certificate Only : Disabled
    Usage Check                  : Enabled
    Revocation Freshness Time    : 0
    URL Retrieval Timeout        : 0
    Ctl Identifier               : (null)
    Ctl Store Name               : (null)
    DS Mapper Usage              : Disabled
    Negotiate Client Certificate : Enabled  

On a 2016 server with IIS:

PS C:\> netsh http show sslcert

SSL Certificate bindings:
-------------------------

    IP:port                      : 0.0.0.0:443
    Certificate Hash             : 51b70e988101c789769c9cd9487c29e88ea7225e
    Application ID               : {4dc3e181-e14b-4a21-b022-59fc669b0914}
    Certificate Store Name       : My
    Verify Client Certificate Revocation : Enabled
    Verify Revocation Using Cached Client Certificate Only : Disabled
    Usage Check                  : Enabled
    Revocation Freshness Time    : 0
    URL Retrieval Timeout        : 0
    Ctl Identifier               : (null)
    Ctl Store Name               : (null)
    DS Mapper Usage              : Disabled
    Negotiate Client Certificate : Disabled
    Reject Connections           : Disabled

    IP:port                      : 0.0.0.0:5986
    Certificate Hash             : bf7db9570b805aa6771be18154e60e4decb295db
    Application ID               : {afebb9ad-9b97-4a91-9ab5-daf4d59122f6}
    Certificate Store Name       : (null)
    Verify Client Certificate Revocation : Disabled
    Verify Revocation Using Cached Client Certificate Only : Disabled
    Usage Check                  : Disabled
    Revocation Freshness Time    : 0
    URL Retrieval Timeout        : 0
    Ctl Identifier               : (null)
    Ctl Store Name               : (null)
    DS Mapper Usage              : Disabled
    Negotiate Client Certificate : Disabled
    Reject Connections           : Disabled

    Hostname:port                : server.domain:443
    Certificate Hash             : 26ea2faabc7764a9bea7f85db6e931b559eff126
    Application ID               : {5d89a20c-beab-4389-9447-324788eb944a}
    Certificate Store Name       : MY
    Verify Client Certificate Revocation : Enabled
    Verify Revocation Using Cached Client Certificate Only : Disabled
    Usage Check                  : Enabled
    Revocation Freshness Time    : 0
    URL Retrieval Timeout        : 0
    Ctl Identifier               : (null)
    Ctl Store Name               : AdfsTrustedDevices
    DS Mapper Usage              : Disabled
    Negotiate Client Certificate : Disabled
    Reject Connections           : Disabled

    Hostname:port                : localhost:443
    Certificate Hash             : 26ea2faabc7764a9bea7f85db6e931b559eff126
    Application ID               : {5d89a20c-beab-4389-9447-324788eb944a}
    Certificate Store Name       : MY
    Verify Client Certificate Revocation : Enabled
    Verify Revocation Using Cached Client Certificate Only : Disabled
    Usage Check                  : Enabled
    Revocation Freshness Time    : 0
    URL Retrieval Timeout        : 0
    Ctl Identifier               : (null)
    Ctl Store Name               : AdfsTrustedDevices
    DS Mapper Usage              : Disabled
    Negotiate Client Certificate : Disabled
    Reject Connections           : Disabled

    Hostname:port                : server.domain:49443
    Certificate Hash             : 26ea2faabc7764a9bea7f85db6e931b559eff126
    Application ID               : {5d89a20c-beab-4389-9447-324788eb944a}
    Certificate Store Name       : MY
    Verify Client Certificate Revocation : Enabled
    Verify Revocation Using Cached Client Certificate Only : Disabled
    Usage Check                  : Enabled
    Revocation Freshness Time    : 0
    URL Retrieval Timeout        : 0
    Ctl Identifier               : (null)
    Ctl Store Name               : (null)
    DS Mapper Usage              : Disabled
    Negotiate Client Certificate : Enabled
    Reject Connections           : Disabled

Note that I didn't have this problem on this installation. I suspect it's because "and they can resolve to your ADFS service." and the IP address 0.0.0.0 ain't going anywhere!

 Enjoy!

IIS : You can ping the box but can't connect to IIS

Had the problem recently.

Laptop all running smoothly - could ping it no problem and connect to it via \\name.

But no way could I http to a website on the laptop.

Did the "ipconfig /flushdns" dance - no joy.

Double-checked all the IIS settings.

Had a chat with Mr. Google and found a suggestion to:

telnet "IP address" 80

This tests if port 80 is open.

No joy - aha - so it's not IIS per se - it's the TCP/IP traffic on port 80.

Run up Windows Firewall. Yup - HTTP traffic on WWW was disabled for port 80. Allowed that - bingo - all A-OK.

Enjoy!

IIS : Could not load file or assembly

 

So I had a website – .NET Framework 4 / IIS 7.5 - working perfectly on my PC.

Moved it to another box and got the error with one of my dlls.

“Could not load file or assembly ‘xxx’ or one of its dependencies. An attempt was made to load a program with an incorrect format”

WTF!

Mr. Google to the rescue. Normal battle with the ten tons of shite but then one link rang a bell.

My original box was 32 bit whereas the new one is 64 bit.

What you have to do with the ApplicationPool is:

In IIS 7 Manager:

• Click ApplicationPools
• Select the one for your application.
• Click “Advanced Settings” on the right
• Under “General” at the top, set “Enable 32-bit Applications” to be “True”

Bingo – problem solved.

Enjoy!

Visual Studio : "Set As Start Page" doesn't work in the real world

I have a web site that contains a "Default.aspx" but I want the start page to be "abc.aspx".

So in Visual Studio 2010, I right click the "abc.aspx" page and select "Set As Start Page".

Hit F5 - works perfectly.

Deploy it to a real IIS 7 server and WTF - Default.aspx is displayed in all its delights?

Turns out the "Set As Start Page" option only applies to Cassini - the VS internal web server (which is why it works when you hit Run ( = F5)).

In the real world, you have to go to the web site inside the IIS Manager, select "Default Document" and then type abc.aspx and move it up to the top.

There you go!

Enjoy!

msdeploy : Package installation failed - 'managedRuntimeVersion' differs

So there I was trying to use msdeploy to deploy a web site from Visual Studio 2010 into an IIS 7 server on another box using the "Build Deployment Package".

I got the error:

The package installation failed.
Details:
The application pool that you are trying to use has the 'managedRuntimeVersion' property set to 'v4.0'. This application requires 'v2.0'.

My web application used the "Default Web Site" and the application pool that it was connected to (DefaultAppPool) was .NET Framework 2.0. Yeah - I screw around with IIS a lot!

Of course, where I was deploying it to was the more usual .NET Framework 4.0.

Mr. Google to the rescue and the answer is to set the following options under the project / Properties / Package/Publish Web:

You need to tick the two text boxes "Include IIS Settings" and "Include application pool settings".
And away you go with msdeploy.

Enjoy!

IIS : Default Web Site dissapears

Happily working away on my Windows 7 box with IIS 7.5, deleted an old web site and somehow (no idea !!!) my "Default Web Site" in IIS 7.5 went west - gone - nixed - went to meet its maker ...!

WTF!

I found this What??? You deleted "Default Web Site" from IIS?!?! had some useful info.

In particular (as per the article), to check that it really has gone:

"First you want to really make sure that there is not a web site known as W3SVC/1. Who knows, maybe someone had simply renamed your default web site or something. Open a command prompt and type this:

c:
cd\Inetpub\AdminScripts

cscript adsutil.vbs enum w3svc/1

If it comes up with "The path requested could not be found" then sure enough, you don't have a true default website anymore. If no error then check out the "ServerComment" to know which web the machine now thinks is the default."

OK - so its really gone. You can follow the rest of the article or simply recreate another one.

I decided to re-install IIS - who knows what else was screwed up?

Control Panel / Programs / Turn Windows features on or off.

Uncheck all the IIS stuff. Then OK - it's all removed.

Then check it all back again - OK - IIS will come back and you may or may not have a "Default Web Site".

If you don't, just add one - there's nothing special about it - it's just another web site.

Start / Administrative Tools / IIS Manager

Right click Sites / Add Web Site

Call it "Default Web Site". Point to:

C:\inetpub\wwwroot

You should now have it back - along with others that may have been in that directory.

Click "Default Web Site" / "Advanced settings". Check that the ID is 1. You are good to go!

If you use ASP.NET and .NET Framework 4 - beware!

Look here: ASP.NET : Handler “PageHandlerFactory-Integrated” has a bad module “ManagedPipelineHandler” in its module list

Enjoy!

ASP.NET : Handler “PageHandlerFactory-Integrated” has a bad module “ManagedPipelineHandler” in its module list

 

I do a lot of work developing applications on my Windows 7 32 bit machine using IIS 7.5 and then migrating them to IIS 7.5 on my Windows Server 2008 R2 64 bit box. Not as simple as it sounds.

Using VS 2010, my DefaultAppPool on Windows 7 uses the .NET 4.0 framework whereas it’s 2.0 on Windows 2008. So you need to make a new application pool and set it to “Integrated” and the 4.0 framework.

OK – then I get the above error. The blurb below on the error page says that the most likely cause is that:

“Managed handler is used; however, ASP.NET is not installed or is not installed completely.”

Check my installed features in IIS 7.5 and Yup – ASP.NET is installed, it has a handler etc. So WTF?

Mr. Google to the rescue.

Run a command prompt in administrative mode.

C:\Windows\Microsoft.NET\Framework\v4.0.30319>aspnet_regiis.exe -i
Start installing ASP.NET (4.0.30319).
..................
Finished installing ASP.NET (4.0.30319).

Note: Your version of the framework may be different!

Notice that it installs ASP.NET even though it is already supposed to be there but it fixes the problem and all is well!

Enjoy!

IIS : IE missing “Install Certificate” button on “View Certificates”

 

It’s a common problem with IE. You access a site and get a certificate error and get the pink address bar when you access the site. The solution is to install the certificate into the “Trusted Root CA” certificate store.

You normally do that by clicking the padlock icon to the right of the address bar then “View Certificates” and then clicking the “Install Certificate” button. Lately, I've come across some instances where the button is missing in action. WTF?

Mr. Google to the rescue and the solution is to right-click the IE icon on the desktop and select “Run as administrator”. (In other words, IE needs to be run as Administrator).

And then there was sweetness and light and verily the button doth appear!

Enjoy!

IIS : Classic ASP, Windows 7 and IIS 7

Classic ASP is the good old Active Sever Pages technology which was the way Microsoft rendered web sites before the advent of managed code and ASP.NET.

It is essentially just a directory of asp, htm and other static content.

It's not supported by Microsoft e.g. there is no Classic ASP project type in VS 2010. May might just as well use Notepad (as I've seen some people do!).

Anyway, needed to do some work with this using the Classic .NET AppPool and got:

"The page you are requesting cannot be served because of the extension configuration. if the page is a script, add a handler. if the file should be downloaded, add a mime map."

Mr Google suggested IIS Handler Mappings but when I looked there I saw that ISAPI.dll was disabled (no way to enable it) and the message:

"You must manage managed handlers directly in the configuration file"

Come in Mr Google - your time is up.

Eventually found the solution under Windows Features:

Under IIS / World Wide Web Services / Application Development Features:

ASP = On
ISAPI Extensions = On
ISAPI Filters = On

Under IIS / World Wide Web Services / Common HTTP Features:

Static Content = On

Enjoy!