MSDN Magazine - January 2008 - (Page 54)

Finally, because Qdig generates thumbnails on the fly, I needed to grant Write access to the qdig-files subdirectory of the application to the IIS_IUSRS group in order to allow the IIS worker process to write to it. That’s it. At this point I could hit http://myphpgallery and see the images as shown in Figure 1. Securing the Gallery Qdig is a simple image gallery focused on doing one thing really well: letting you browse your image collection via the Web. As such, it doesn’t have some of the more complex features that are often needed for Web applications. One such feature is access control, which allows you to restrict access to parts or all of your Web application. Unfortunately, implementing access control in PHP requires implementing a credential store and cookie-based authentication from the ground up, and it can be quite hard to get right. By contrast, ASP.NET makes access control a breeze by providing a complete solution with the membership service and a set of built-in credential store providers, the forms authentication module, and a set of pre-made Login controls. In previous versions of IIS, this wouldn’t mean much for the Qdig gallery, since it is not an ASP.NET application. But in IIS 7.0, the ASP.NET Integrated mode engine is designed specifically for this scenario, allowing ASP.NET features to be used with any content, including other application frameworks. Using the functionality of ASP.NET Integrated mode, the Qdig gallery can take advantage of the ASP.NET membership, forms authentication, and Login controls just like a native ASP.NET application. In fact, if you already have an existing ASP.NET application that uses forms authentication, you can simply drop in the Qdig gallery and, with just a few steps, enable it to have the same user security as the rest of your application. This results in consistent user security across your entire site. To implement a forms authentication solution from scratch for the gallery, I first had to choose a membership credential store provider to store user credentials. ASP.NET 2.0 comes with two built-in providers, one for SQL Server™ and one for Active Directory®. The SQL Server provider can be used with SQL Server 2005 Express Edition, which is a great option for many applications. The best thing about using SQL Server 2005 Express Edition with the membership provider is its ability to automatically create and deploy the database tables to your application’s App_Data subdirectory on first use. This doesn’t require any external database deployment and produces a credential store database that you can Xcopy with your application files. The SQL Server membership provider is, by default, configured to use a connection string that uses the local SqlExpress instance to connect to the aspnetdb.mdf database inside the App_Data directory for your application. To make it work, I simply took the following three steps: 1. Downloaded and installed SQL Server 2005 Express Edition, leaving it running as a named SqlExpress instance (default). (You can download it at microsoft.com/sql/editions/express.) 2. Created an App_Data subdirectory in your application root, and made it writable by IIS_IUSRS. 3. Opened IIS Manager and created a few users for the application. To do this, select your Web site in the left-hand tree view, and click the .NET Users feature icon (see Figure 2). Be sure to close the tool after you are finished, as SQL Server Express Edition allows only one user identity to access the database at a time. Note the integration between IIS Manager and the ASP.NET membership infrastructure—you can manage both users and roles directly from the administration tool where you configure other IIS authentication and access control features. In fact, when you create the first user, IIS Manager will automatically create the membership database in your application if one doesn’t already exist. Forms Authentication Figure 2 Configuring Users in IIS Manager Now that membership is ready to go, I need to enable forms authentication for the application. I will also need to allow the forms authentication module that implements the authentication service to run for all requests in the application, not just for ASP.NET requests (this is the 54 msdnmagazine IIS 7.0 Extensibility http://microsoft.com/sql/editions/express

Table of Contents Feed for the Digital Edition of MSDN Magazine - January 2008

MSDN Magazine - January 2008 Contents Toolbox CLR Inside Out Data Points Advanced Basics Cutting Edge IIS 7.0 - Enhance Your Apps with the Integrated ASP.NET Pipeline World Ready - Around the World with ASP.NET AJAX Applications WCF Syndication - HTTP Programming with WCF and the .NET Framework 3.5 Wicked Code Foundations Extreme ASP.NET {End Bracket}

MSDN Magazine - January 2008

For optimal viewing of this digital publication, please enable JavaScript and then refresh the page. If you would like to try to load the digital publication without using Flash Player detection, please click here.