Home Access Plus+

[themightymrp]

In this code you use {0} to represent the username, not %username%. Therefore you would need \\servername\users$\administrators\{0}

[themightymrp]

Look under homepage links. The Update My Details entry, you can add showto="" in there

 

I can see that part, unfortunately on the update my details popup screen there is no option for email address!

[nickbro]

I can see that part, unfortunately on the update my details popup screen there is no option for email address!

Yer I don't update the email ad settings. Since in our school the staff's emails are exchange based. The kids are hmailserver based, on a sub domain, which is where this updating thing comes from.

[nickbro]

Nickbro, seeing as you said you could not get it to work with the Windows Authentication I am attaching a setup guide to show what I did. I have actually sent this to a technician in another school as he wants to use this software too!

Looks good. You need to note however that %username% needs to be replaced with {0}. {0} gets the username populated at runtime, %username% does not

[Zenden]

Just installed this and I have to say it really is very ver well done, big thanks for this! Just wondering, we have HAP and Moodle both using LDAP for the authentication, would it be possible to allow SSO from HAP to moodle (as moodle hosts our helpdesk and booking system?).

 

Thanks in advance and thanks again for a truely great piece of work!

[dgsmith]

Just installed this over and weekend, and after fixing a few minor issues in the config file, got it working fine now. I am not too happy with using basic authentication though. I tried switching over to digest but now it seems only domain admin accounts can authenticate and it won't accept the credentials of non-admin accounts.

 

Am I naive in thinking it is that easy? Is there a reason why we should be using basic and not digest? Is there a reason why only domain admin accounts only work on digest, but any valid account will work on basic?

 

I also tried to enable forms authentication but got an error about an invalid/non-existant login script file, so reverted that for the time being. All I need now is to get our LEA to open up access to it externally and we're ready to go, but just a bit concerned about using basic authentication! Also quite annoying that you need to close the broswer to log off - can this be improved upon in a future release to have an actual logoff procedure? I see it has been discussed already but merely stating the point I am making!

[themightymrp]

See my instruction file at the top of this page as to how to set up using Windows Authentication. I have it working here

[dgsmith]

Would Windows Authentication mean that we wouldn't be able to specify a user/pass when logging on within school? Is it much improved from a security angle than basic (talking about logging on externally/from home)?

[themightymrp]

You are right about the logging on in school part, within the school it recognises who is logged onto the machine and uses those credentials to bring up the page automatically. As from a security standpoint, I'm not 100% certain but surely anything other than basic has to be more secure? It's encrypted with Kerberos isn't it??

If anyone else knows I would be happy to find out.

[dgsmith]

I suppose, though would like a login box regardless of where they're logging on!

 

Something else I noticed too - our staff have Mr/Mrs Bloggs at their display name (for obvious reasons not having first name), but when they change their department or just update their details, it changes the display name as well to what they put in the first name. This isn't good! Fine that it replaced the first and last name fields and even the surname in display name, but we don't want their full names showing up to everyone (including students) in outlook. Can this be fixed asap?

 

Also, how can we pull down extra details in the home page from the AD (like we have name, form/dept and email now)? I take it this is hard coded in a dll somewhere?

[themightymrp]

You could try asking staff to only enter their first initial in the 'First Name' box?

[dgsmith]

Well no, because display names are already setup properly, as are the first and last names, but the dept is blank (because we don't use that field). Some may choose to just add in their dept but not change their name, but then when they save it'll still overwrite display name. The other option is to disable the ability to edit details, but it seems a shame to disable that when it could be easily rectified!

[RTi]

I'm struggling to get this working.. I followed the word doc guide on page 25. When I click on Browse My School Computer and then click on My Documents .. I get

 

Error: Unauthorised Access

You have attempted to access a restricted resource

 

I have double checked the web.config.. and have tried mapping the H drive using %homepath% and also using UNC .. I get the same error..

 

really would like to get this working..

[themightymrp]

I had this a couple of times, I have a work-around but not sure how effective it will be.

 

Lets say for example that the server that hosts all of your 'My Documents' drives is called 'Filestore'. Pick a users account (i.e. yours) to test this with.

 

View the NTFS permissions on your folder, go to Add and change the location to search in to the name of the server (not the domain). Add the group 'Users' and give it change/modify permissions. You should now have in the list filestore/Users with modify permissions. Test out the Home Access web page as you, it should work.

 

I don't know how secure it is doing it like this? You can add these permissions en-masse without affecting current security settings by running the following command from a DOS prompt:

 

cacls pathtofolders\* /c /t /e /g "Users":C

 

Let me know if this was helpful.

Edited December 6, 2010 by themightymrp

[2097]

1.) try mapping a shared drive that all users have access to .. like a student drive etc .

2.) check inside web.config there should be 2 or 3 entrys where your admin username and password should be .

3.) make sure all the HAP files have the correct IIS permisions.

 

 

I'm struggling to get this working.. I followed the word doc guide on page 25. When I click on Browse My School Computer and then click on My Documents .. I get

 

Error: Unauthorised Access

You have attempted to access a restricted resource

 

I have double checked the web.config.. and have tried mapping the H drive using %homepath% and also using UNC .. I get the same error..

 

really would like to get this working..

[2097]

Well no, because display names are already setup properly, as are the first and last names, but the dept is blank (because we don't use that field). Some may choose to just add in their dept but not change their name, but then when they save it'll still overwrite display name. The other option is to disable the ability to edit details, but it seems a shame to disable that when it could be easily rectified!

 

In Form i input either Staff or Pupils in AD ... for the correct member

i have also removed the option to change password etc ..

[RTi]

I have just tried what mightymrp had suggested.. and it worked! however.. I am a little concerned about the 'Users' Group permission on staff folders..as the students are also members of this group..

[nickbro]

I suppose, though would like a login box regardless of where they're logging on!

 

Something else I noticed too - our staff have Mr/Mrs Bloggs at their display name (for obvious reasons not having first name), but when they change their department or just update their details, it changes the display name as well to what they put in the first name. This isn't good! Fine that it replaced the first and last name fields and even the surname in display name, but we don't want their full names showing up to everyone (including students) in outlook. Can this be fixed asap?

 

Also, how can we pull down extra details in the home page from the AD (like we have name, form/dept and email now)? I take it this is hard coded in a dll somewhere?

 

It's by design. It should shuve Mrs Blogss into the Notes field, which the system can also user. It is hardcoded, it'll be on the default.aspx.cs file if you want to recompile the code yourself

[dgsmith]

You'd have to explain that a bit further and where specifically to find that info and how to compile, as I have never really gone beyond VB!

 

On the subject of adding stuff - why not utilise the logs on the log directory of Web Components (where the easylink and extranet folders are located on an RM network)? I.E: ..../Web Components/Logs/W3SVC2? It is logging perfectly fine the actions of users using HAP on our network (right now as I speak) so why can't this info be extracted and built in to the logging features of HAP? That really would be real-time action then without the user having to config/install anything else. Just a thought mind - seems s waste to not make use of those logs some way.

[nickbro]

The tracking stuff is for windows. Not the HAP website. Thus you need a program installed that pings HAP.

 

For the other matter, you need to download the HAP source code from codeplex.

 

Load that in visual studio.

 

Open ~/default.aspx.cs

 

find:

 

       [color=blue]protected[/color] [color=blue]void[/color] editmydetails_Click([color=blue]object[/color] sender, [color=#2B91AF]EventArgs[/color] e)
       {
           up.Surname = txtlname.Text;
           up.GivenName = txtfname.Text;
           up.Description = [color=blue]string[/color].Format([color=#A31515]"{0} {1} in {2}"[/color], txtfname.Text, txtlname.Text, txtform.Text);
           up.DisplayName = [color=blue]string[/color].Format([color=#A31515]"{0} {1}"[/color], txtfname.Text, txtlname.Text);
           [color=blue]if[/color] (User.IsInRole(config.ADSettings.StudentsGroupName)) up.EmailAddress = [color=blue]string[/color].Format(config.BaseSettings.StudentEmailFormat, Username, up.GivenName, up.Surname);
           up.Save();
........
       }

 

The stuff you need to change is the the up.DisplayName = line.

 

To detect if it's a staff, you can try something like:

 

 

 

       [color=blue]protected[/color] [color=blue]void[/color] editmydetails_Click([color=blue]object[/color] sender, [color=#2B91AF]EventArgs[/color] e)
       {
           up.Surname = txtlname.Text;
           up.GivenName = txtfname.Text;
           up.Description = [color=blue]string[/color].Format([color=#A31515]"{0} {1} in {2}"[/color], txtfname.Text, txtlname.Text, txtform.Text);
           
           [color=blue]if[/color] (User.IsInRole(config.ADSettings.StudentsGroupName)) {
                up.EmailAddress = [color=blue]string[/color].Format(config.BaseSettings.StudentEmailFormat, Username, up.GivenName, up.Surname);
                up.DisplayName = [color=blue]string[/color].Format([color=#A31515]"{0} {1}"[/color], txtfname.Text, txtlname.Text);
           }
           up.Save();
........
       }

 

Basically, it will only update the Surname, Given Name and description for the staff, it will update everything for everything else.

[dgsmith]

The tracking stuff is for windows. Not the HAP website. Thus you need a program installed that pings HAP.

 

I understand, but it still logs activity and could HAP not extract certain bits of this (even if it is to say recent logon activity/who has used the system over the past 1hr etc)? The logon tracker now, I think, is limited to internal use and doesn't take in to account external access?

 

For the other matter, you need to download the HAP source code from codeplex.

 

Thanks for that - a big help. Will have to take a look over that and see if I can make some necessary amendments. Cheers

 

Not to be on a downer though about your community contribution here - it truely is amazing work and the staff I have shown already are overjoyed at how much better it is than Easylink!

Edited December 7, 2010 by dgsmith

[nickbro]

I understand, but it still logs activity and could HAP not extract certain bits of this (even if it is to say recent logon activity/who has used the system over the past 1hr etc)? The logon tracker now, I think, is limited to internal use and doesn't take in to account external access?

 

 

 

Thanks for that - a bit help. Will have to take a look over that and see if I can make some necessary amendments. Cheers

 

Not to be on a downer though about your community contribution here - it truely is amazing work and the staff I have shown already are overjoyed at how much better it is than Easylink!

 

Using the IIS logs could be done, but it would require some work, as parsing the IIS logs is a bit more time consuming than the xml logon tracker logs.

[themightymrp]

I have just tried what mightymrp had suggested.. and it worked! however.. I am a little concerned about the 'Users' Group permission on staff folders..as the students are also members of this group..

 

I've been looking at this more closely as I agree that I'm not too happy with the "Users" group either as a fixit. I have discovered that instead of adding that group to the users folders, I can add the Computer Account of the HAP web server to their folder with modify permissions and this works too!! I don't know about the pros and cons of doing this but from my tests a student is not able to access other users folders. Whereas with the Server/Users group it was possible with a little bit of trickery

 

Let me know if you find any problems with doing this.

[RTi]

I've been looking at this more closely as I agree that I'm not too happy with the "Users" group either as a fixit. I have discovered that instead of adding that group to the users folders, I can add the Computer Account of the HAP web server to their folder with modify permissions and this works too!! I don't know about the pros and cons of doing this but from my tests a student is not able to access other users folders. Whereas with the Server/Users group it was possible with a little bit of trickery

 

Let me know if you find any problems with doing this.

 

Thanks.. I will test it out on friday..

[gl3nnym]

Hello, thanks again for a great app. Still in testing but the function to access documents from home is a big hit so far!

I am having a little trouble with the Logon Tracker. I followed the video step by step but no data seems to appear in the tracker list. I cannot find any errors and nothing appears in Event Viewer.

 

I downloaded the HAP Logon Tracker.exe from the website and added it to the 4 relevant folders in GPMC. The parameter I used was the https url for the Extranet e.g. https://portal.domain.com/Extranet/. Is this right or should it be the local address e.g. https://serverName/RM/Extranet/?

 

Many thanks in advance.