Windows Web Solutions UPDATE, October 7, 2003

This Issue Sponsored By

HostMySite.com

Windows & .NET Magazine Network

October 7, 2003--In this issue:

1. Commentary: Role-Based Access with Authorization Manager

2. Keeping Up with IIS

• Scheduling IIS Restarts

3. Announcements

• New White Paper on Exchange 2003 Deployment
• Get Problem-Solving Scripts That Will Simplify Your Life

4. Resource

• Featured Thread: Can't Start IIS 6.0 Web Sites

5. Event

• The Mobile & Wireless Road Show Is Coming to Tampa and Atlanta!

6. New and Improved

• Tell Us About a Hot Product and Get a T-Shirt!

7. Contact Us

• See this section for a list of ways to contact us.

Sponsor: HostMySite.com

HostMySite.com is a provider of quality, customer focused, web hosting. Our high-tech data-center has multiple DS-3 Internet connections, generator, and UPS backups, and is the ideal place to host your website or dedicated server. Our 24/7/365 support staff is trained in both Windows, and Linux, and can assist you with all of your requirements. Our plans are backed by an aggressive 99.9% uptime guarantee, and start as low as $8.95 per month for shared hosting, or $129.00 per month for dedicated servers. Ask us about our E-commerce packages, or ColdFusion and SQL Server plans as well. We are always here, and happy to help. Call us at 1-877-215-HOST, or visit

1. Commentary: Role-Based Access with Authorization Manager

In the broad spectrum of security, authentication and authorization are often grouped together, but they differ greatly. Authentication answers the question "Who is this user?" Authorization answers the question "What can this user do?"

Because authentication and authorization differ, you achieve them in different ways. Achieving authentication is easy if you follow a few best practices. One of those best practices is to use the Windows Server OS for authentication when possible. The OS takes care of many authentication details, and the platform stores the users' credentials. For example, you can use Windows Server 2003's Active Directory (AD) to authenticate Microsoft IIS users.

In contrast, authorization was historically tough to achieve because you had to use custom-built applications. However, Windows 2003 has changed that situation by providing a feature called Authorization Manager. Combined with Windows .NET Framework's role-based security, Authorization Manager is a powerful tool.

Since Windows NT 4.0, administrators were able to secure OS resources (e.g., file-system objects) with ACLs. In the ACL approach, you can attach discretionary ACLs (DACLs) to a persistent object and call the AccessCheck API to make access decisions. The API looks at a user's group memberships and compares them against the ACL's contents to determine whether the user has the necessary access rights.

Applications that don't have well-defined persistent objects have no place to put an ACL, so the ACL approach can be difficult, if not impossible, to apply in these applications. Line of business (LOB) applications often fall into this category. Fortunately, Authorization Manager provides an authorization framework that you can use when you need to give users access to an LOB application. Instead of determining whether to grant access based on ACLs, Authorization Manager determines whether to grant access based on "roles" that you assign. A role is an object to which you assign access permissions to certain resources. You can think of a role as a job position; you assign a position the rights to access any resource it needs. You then assign users to appropriate roles.

Authorization Manager consists of a set of COM-based runtime interfaces and the Microsoft Management Console (MMC) Authorization Manager snap-in. Applications written in ASP.NET use the Authorization Manager API through the interop assembly that ships in the \AuthMan directory in the Framework.

You can integrate Authorization Manager with Internet Information Services (IIS) 6.0 to implement IIS 6.0 URL authorization, which lets you authorize users' access to URLs in a Web application. When a client requests a URL, IIS 6.0 URL authorization validates a user's access based on that user's specified role. You control access to URLs by using custom roles, Lightweight Directory Access Protocol (LDAP) queries, and dynamic business rules (BizRules). BizRules let you take runtime data into account.

Although Authorization Manager was a barely known feature at first, it's starting to gain popularity as people discover its power. According to Microsoft, Authorization Manager's goals are to simplify application access-control administration, provide a simplified and natural application-development model, and enable flexible and dynamic authorization decisions. Authorization Manager meets those goals. The bottom line is that Authorization Manager provides role-based authorization security that's not only part of the platform but also easy to use. You can find more information about Authorization Manager at the following four sites:

Sponsor: Windows & .NET Magazine Network

If You Like This Email Newsletter...

Then be sure to check out the Windows & .NET Magazine Network. You'll find page after page of problem-solving, time-saving articles plus other fantastic resources like our forums, Windows IT library, Download Central, and much, much more. Click here now!

2. Keeping Up with IIS

To learn how to schedule Microsoft IIS to restart at specified time intervals, go to

3. Announcements
(brought to you by Windows & .NET Magazine and its partners)

In this timely white paper, Microsoft Exchange Server expert Kieran McCorry, from HP's Exchange consulting group, outlines the best options for organizations migrating to Exchange Server 2003. The paper outlines inter- and intraorganizational migration issues and the benefits of server consolidation during deployment. Get your copy today!

OK, so you're not a programmer. But if you read Windows Scripting Solutions every month, you don't need to be. Tackle common problems and automate everyday, time-consuming tasks with our simple tools, tricks, and scripts. Try a no-charge sample issue today!

4. Resource

Junior forum member Paul just installed Microsoft Internet Information Services (IIS) 6.0 as part of Windows Server 2003. When he tries to start Web sites, he receives the following errors: "The process cannot access the file because it is being used by another process" and "Unable to bind to the underlying transport for 0.0.0.0:80. The IP Listen-only list may contain a reference to an interface which may not exist on this machine." If you know how to resolve this problem, click the following URL:

5. Event
(brought to you by Windows & .NET Magazine)

Learn more about the wireless and mobility solutions that are available today, plus discover how going wireless can offer low risk, proven performance, and compatibility with existing and emerging industry standards. Register now for this free, 12-city event!

6. New and Improved

Have you used a product that changed your IT experience by saving you time or easing your daily burden? Tell us about the product, and we'll send you a Windows & .NET Magazine T-shirt if we write about the product in a future Windows & .NET Magazine What's Hot column. Send your product suggestions with information about how the product has helped you to

Sponsored Links

CrossTec
Free Download - NEW NetOp 7.6 - faster, more secure, remote support

Microsoft
Attend a Microsoft(R) Office System Launch Event -- Get a FREE Eval Kit

7. Contact Us

Copyright 2003, Penton Media, Inc.