IIS : IE missing “Install Certificate” button on “View Certificates”

 

It’s a common problem with IE. You access a site and get a certificate error and get the pink address bar when you access the site. The solution is to install the certificate into the “Trusted Root CA” certificate store.

You normally do that by clicking the padlock icon to the right of the address bar then “View Certificates” and then clicking the “Install Certificate” button. Lately, I've come across some instances where the button is missing in action. WTF?

Mr. Google to the rescue and the solution is to right-click the IE icon on the desktop and select “Run as administrator”. (In other words, IE needs to be run as Administrator).

And then there was sweetness and light and verily the button doth appear!

Enjoy!

ADFS : Accessing the Windows Internal Database

 

ADFS either uses SQL Server or an WID to store all the configuration components. I’ve tried before to access the WID with no joy but then discovered that the reason why was because of the completely non-intuitive and obtuse server name which has to be:

\\.\pipe\MSSQL$MICROSOFT##SSEE\sql\query

Damn, why on earth didn’t I think of that?!

The easiest way to access it is via the free SQL Server Management Studio Express. Ignore all the talk of SQL Server 2005 Express Edition – it works for the WID.

When you connect, leave the “Server Type” as “Database Engine” and insert the above string as the “Server Name”.

Away you go – the two DB of interest are AdfsArtifactStore and ADFSConfiguration.

Enjoy!

Kerberos : Some useful tools

 

Needed to do some work in this area and found the following extremely useful:

KerbTray is a GUI tool used to display ticket information for a given computer running the Kerberos protocol. You can purge all the Kerberos tickets with this.

KList is a DOS prompt tool used to view and delete the Kerberos tickets granted to the current logon session. It allows you to delete selected Kerberos tickets (as opposed to KerbTray which deletes them all).

In terms of debugging, I found Wireshark to be useful to see what happens on the actual wire. You can sort the packets by using the Kerberos protocol as a filter.

The other alternative is to enable Kerberos event logging. Really simple to do – just one registry setting. Just remember to disable it when you are done.

DelegConfig is an ASP.NET application used to help troubleshoot and configure IIS and Active Directory to allow Kerberos and delegated Kerberos credentials. It can be really useful but has to be setup correctly. Worth running if only to read the comments and explanations.

Enjoy!

WIF : Displaying WIF trace files

 

Trace or log files are very useful to help you find problems with WIF.

I normally add the following to the end of the web.config.

<system.diagnostics>
    <sources>
      <source name="Microsoft.IdentityModel" switchValue="Verbose">
        <listeners>
          <add name="xml" type="System.Diagnostics.XmlWriterTraceListener"
               initializeData="xxx\Logs\WIF.xml" />
        </listeners>
      </source>
    </sources>
    <trace autoflush="true" />
  </system.diagnostics>

</configuration>

This produces a ton of output in XML format but it's not that easy to read it!

The trick is to use the Service Trace Viewer Tool.

See Examining WCF Diagnostic Traces Using Service Trace Viewer Tool for download instructions.

Run up the tool (you may need to run as administrator), then File / Open with the file type set to XML and you'll find it so much easier!

Enjoy!

IIS : Classic ASP, Windows 7 and IIS 7

Classic ASP is the good old Active Sever Pages technology which was the way Microsoft rendered web sites before the advent of managed code and ASP.NET.

It is essentially just a directory of asp, htm and other static content.

It's not supported by Microsoft e.g. there is no Classic ASP project type in VS 2010. May might just as well use Notepad (as I've seen some people do!).

Anyway, needed to do some work with this using the Classic .NET AppPool and got:

"The page you are requesting cannot be served because of the extension configuration. if the page is a script, add a handler. if the file should be downloaded, add a mime map."

Mr Google suggested IIS Handler Mappings but when I looked there I saw that ISAPI.dll was disabled (no way to enable it) and the message:

"You must manage managed handlers directly in the configuration file"

Come in Mr Google - your time is up.

Eventually found the solution under Windows Features:

Under IIS / World Wide Web Services / Application Development Features:

ASP = On
ISAPI Extensions = On
ISAPI Filters = On

Under IIS / World Wide Web Services / Common HTTP Features:

Static Content = On

Enjoy!

TechNet : Wiki top dog

I've been doing a lot of work over at the TechNet Wiki - mainly in the WIF area.

Good to see that this week I'm officially top dog.

Frabjous joy in the North Compound!

Enjoy!

Windows : Windows Integrated Authentication

This is for Windows Integrated Authentication (IWA / WIA)

If you want to use this to automatically log into other sites that you access after logging in once when you come into work:

The site you want to access has to be in the “Local Intranet” zone.

The WIA setting in the IIS site – Authentication icon should be set.

For IE (which can do this behind the scenes):

• Tools / Internet Options / Security / Custom Level (Scroll down to end) / Automatic login only in Intranet zone
• Tools / Internet Options / Advanced (Scroll down to Security) / Enable Windows Integrated Authentication.

For Firefox, see

FireFox supports Integrated Windows Authentication

Also:

Configuring Windows Integrated AuthN

Note there are three articles here.

and

SSO with Office 365: ADFS Logon Web Site / Authentication / Browser Support

and

AD FS, Enhanced Protection for Authentication (EPA), Chrome and Integrated Windows Authentication (IWA)

Enjoy!

Misc : Find a similar article

 

The Internet is a wonderful source of information – the only problem is at least half of it is rubbish and  a quarter of the rest is misleading.

Had an example of this recently on a forum.

I was asking about V2 of a product and the answer was “Look at this article”. Which I duly did and noticed that the article referred to V1 of the product which used a feature which had been removed in V2.

I pointed that out on the forum. Back comes the answer “Oh – just ignore that section” WTF – without that section there is no solution.

Pointed that out on the forum. Back comes the answer “Find a similar article” WTF – that’s where I started. I couldn't find one – hence the forum question.

Thanks for FA dude!

Enjoy!

ADFS : Restoring / re-installing ADFS v 2.0

 

There’s really useful information out there on the forums.

If everything turns to custard when you are trying to customise ADFS, you can always re-install.

A quicker way is to know that a copy of the original installation is found at:

…\Program Files\Active Directory Federation Services 2.0\WSFederationPassive.Web

Simply copy it over to:

…\inetpub\adfs\ls

Thanks to Steve Syfuhs for this tip.

Enjoy!

ASP.NET : A potentially dangerous Request.Form value was detected from the client

I get this message all the time especially when knocking up quick Web applications to test some WIF concept.
The solution is to add the following in the web.config:

 <system.web>
    <pages validateRequest="false" />
    <httpRuntime requestValidationMode="2.0" />
    ...

Update:

It may help to  add:

validateRequest="false"

in the Page directive as well (This is the first line of your .aspx file).

Also, refer this discussion over on stackoverflow.

Enjoy!

Misc : Remote Desktop Connection Manager

When you work with a lot of VM's or remotes sites, you tend to have a lot of RDC (Remote Desktop Connection) windows open which can be confusing to stay the least.

Enter the Remote Desktop Connection Manager.

This is an extremely useful tool which puts everything in one place and accessible with one click. You can also put all your sites into a meaningful hierarchy.

I really wish there was a list of all the internal tools that Microsoft folk have developed over the years!

Enjoy!

Misc : Dual identity

Originally when I registered with MSDN I used my normal name (nzpcmad). Moved on to other areas and when I wanted to use MSDN again, I found that things had changed. When I updated my profile, I was informed that the name “nzpcmad” was already in use (WTF – I know that!) and hence was forced to choose a new name “nzpcmad1”.

So just to confirm:

nzpcmad = nzpcmad1 = Me

Enjoy!