Windows Web Solutions UPDATE—brought to you by the Windows & .NET Magazine Network

http://www.winnetmag.com

This Issue Sponsored By

HostMySite.com

http://www.HostMySite.com/windot

Windows & .NET Magazine Network

http://www.winnetmag.com

October 7, 2003--In this issue:

1. Commentary: Role-Based Access with Authorization Manager

2. Keeping Up with IIS

  • Scheduling IIS Restarts

3. Announcements

  • New White Paper on Exchange 2003 Deployment
  • Get Problem-Solving Scripts That Will Simplify Your Life

4. Resource

  • Featured Thread: Can't Start IIS 6.0 Web Sites

5. Event

  • The Mobile & Wireless Road Show Is Coming to Tampa and Atlanta!

6. New and Improved

  • Tell Us About a Hot Product and Get a T-Shirt!

7. Contact Us

  • See this section for a list of ways to contact us.

Sponsor: HostMySite.com

HostMySite.com is a provider of quality, customer focused, web hosting. Our high-tech data-center has multiple DS-3 Internet connections, generator, and UPS backups, and is the ideal place to host your website or dedicated server. Our 24/7/365 support staff is trained in both Windows, and Linux, and can assist you with all of your requirements. Our plans are backed by an aggressive 99.9% uptime guarantee, and start as low as $8.95 per month for shared hosting, or $129.00 per month for dedicated servers. Ask us about our E-commerce packages, or ColdFusion and SQL Server plans as well. We are always here, and happy to help. Call us at 1-877-215-HOST, or visit

http://www.HostMySite.com/windot

1. Commentary: Role-Based Access with Authorization Manager

Tim Huckaby, timhuck@interknowlogy.com

In the broad spectrum of security, authentication and authorization are often grouped together, but they differ greatly. Authentication answers the question "Who is this user?" Authorization answers the question "What can this user do?"

Because authentication and authorization differ, you achieve them in different ways. Achieving authentication is easy if you follow a few best practices. One of those best practices is to use the Windows Server OS for authentication when possible. The OS takes care of many authentication details, and the platform stores the users' credentials. For example, you can use Windows Server 2003's Active Directory (AD) to authenticate Microsoft IIS users.

In contrast, authorization was historically tough to achieve because you had to use custom-built applications. However, Windows 2003 has changed that situation by providing a feature called Authorization Manager. Combined with Windows .NET Framework's role-based security, Authorization Manager is a powerful tool.

Since Windows NT 4.0, administrators were able to secure OS resources (e.g., file-system objects) with ACLs. In the ACL approach, you can attach discretionary ACLs (DACLs) to a persistent object and call the AccessCheck API to make access decisions. The API looks at a user's group memberships and compares them against the ACL's contents to determine whether the user has the necessary access rights.

Applications that don't have well-defined persistent objects have no place to put an ACL, so the ACL approach can be difficult, if not impossible, to apply in these applications. Line of business (LOB) applications often fall into this category. Fortunately, Authorization Manager provides an authorization framework that you can use when you need to give users access to an LOB application. Instead of determining whether to grant access based on ACLs, Authorization Manager determines whether to grant access based on "roles" that you assign. A role is an object to which you assign access permissions to certain resources. You can think of a role as a job position; you assign a position the rights to access any resource it needs. You then assign users to appropriate roles.

Authorization Manager consists of a set of COM-based runtime interfaces and the Microsoft Management Console (MMC) Authorization Manager snap-in. Applications written in ASP.NET use the Authorization Manager API through the interop assembly that ships in the \AuthMan directory in the Framework.

You can integrate Authorization Manager with Internet Information Services (IIS) 6.0 to implement IIS 6.0 URL authorization, which lets you authorize users' access to URLs in a Web application. When a client requests a URL, IIS 6.0 URL authorization validates a user's access based on that user's specified role. You control access to URLs by using custom roles, Lightweight Directory Access Protocol (LDAP) queries, and dynamic business rules (BizRules). BizRules let you take runtime data into account.

Although Authorization Manager was a barely known feature at first, it's starting to gain popularity as people discover its power. According to Microsoft, Authorization Manager's goals are to simplify application access-control administration, provide a simplified and natural application-development model, and enable flexible and dynamic authorization decisions. Authorization Manager meets those goals. The bottom line is that Authorization Manager provides role-based authorization security that's not only part of the platform but also easy to use. You can find more information about Authorization Manager at the following four sites:

http://www.microsoft.com/technet/treeview/default.asp?url=/technet/prodtechnol/windowsserver2003/maintain/security/athmanwp.asp
http://msdn.microsoft.com/library/default.asp?url=/library/en-us/dnnetserv/html/azmandynamgrps.asp
http://msdn.microsoft.com/library/default.asp?url=/library/en-us/dnnetserv/html/azmanroles.asp
http://msdn.microsoft.com/library/default.asp?url=/library/en-us/dnnetserv/html/azmanbizrules.asp

Sponsor: Windows & .NET Magazine Network

If You Like This Email Newsletter...

Then be sure to check out the Windows & .NET Magazine Network. You'll find page after page of problem-solving, time-saving articles plus other fantastic resources like our forums, Windows IT library, Download Central, and much, much more. Click here now!

http://www.winnetmag.com

2. Keeping Up with IIS

  • Scheduling IIS Restarts

  • To learn how to schedule Microsoft IIS to restart at specified time intervals, go to

    http://www.winnetmag.com/articles/index.cfm?articleid=37944

    3. Announcements
    (brought to you by Windows & .NET Magazine and its partners)

  • New White Paper on Exchange 2003 Deployment

  • In this timely white paper, Microsoft Exchange Server expert Kieran McCorry, from HP's Exchange consulting group, outlines the best options for organizations migrating to Exchange Server 2003. The paper outlines inter- and intraorganizational migration issues and the benefits of server consolidation during deployment. Get your copy today!

    http://www.aelita.com/100703websolutions

  • Get Problem-Solving Scripts That Will Simplify Your Life

  • OK, so you're not a programmer. But if you read Windows Scripting Solutions every month, you don't need to be. Tackle common problems and automate everyday, time-consuming tasks with our simple tools, tricks, and scripts. Try a no-charge sample issue today!

    http://www.winscriptingsolutions.com/rd.cfm?code=fsep26xxup

    4. Resource

  • Featured Thread: Can't Start IIS 6.0 Web Sites
  • Junior forum member Paul just installed Microsoft Internet Information Services (IIS) 6.0 as part of Windows Server 2003. When he tries to start Web sites, he receives the following errors: "The process cannot access the file because it is being used by another process" and "Unable to bind to the underlying transport for 0.0.0.0:80. The IP Listen-only list may contain a reference to an interface which may not exist on this machine." If you know how to resolve this problem, click the following URL:

    http://www.winnetmag.com/forums/rd.cfm?cid=41&tid=63986

    5. Event
    (brought to you by Windows & .NET Magazine)

  • The Mobile & Wireless Road Show Is Coming to Tampa and Atlanta!
  • Learn more about the wireless and mobility solutions that are available today, plus discover how going wireless can offer low risk, proven performance, and compatibility with existing and emerging industry standards. Register now for this free, 12-city event!

    http://www.winnetmag.com/roadshows/wireless

    6. New and Improved

  • Tell Us About a Hot Product and Get a T-Shirt!
  • Have you used a product that changed your IT experience by saving you time or easing your daily burden? Tell us about the product, and we'll send you a Windows & .NET Magazine T-shirt if we write about the product in a future Windows & .NET Magazine What's Hot column. Send your product suggestions with information about how the product has helped you to

    whatshot@winnetmag.com

    Sponsored Links

    CrossTec
    Free Download - NEW NetOp 7.6 - faster, more secure, remote support

    http://ad.doubleclick.net/clk;5930423;8214395;j?http://www.crossteccorp.com/tryit/w2k.html

    Microsoft
    Attend a Microsoft(R) Office System Launch Event -- Get a FREE Eval Kit

    http://ad.doubleclick.net/clk;6233617;8214395;l?http://click.atdmt.com/DDB/go/msg02800036ddb/direct/01/

    7. Contact Us

  • About the commentary -- timhuck@interknowlogy.com
  • About the newsletter -- kbemowski@winnetmag.com
  • About technical questions -- http://www.winnetmag.net/forums
  • About product news -- products@winnetmag.com
  • About your subscription -- wwsupdate@winnetmag.com
  • About sponsoring UPDATE -- emedia_opps@winnetmag.com
  • Copyright 2003, Penton Media, Inc.