Home Access Plus+

[mac_shinobi]

Fantastic, grouping! it's like a little xmas present for me wrapped up in a bundle of code haha

 

It's all in the wrapper - use the sauce, sorry source

[AngryTechnician]

Nick,

 

I've been working on implementing this in the run up to Christmas, and just wanted to pass on my comments and thanks. I'm primarily using it for file access, and you've put together an impressive product in that regard - so much so that I abandoned my foray into testing Unified Access Gateway, for which I am truly grateful.

 

I'll almost certainly have some more comments once the staff are let loose on it, but here's some initial feedback based on my testing so far:

 

Identity impersonation

. I've seen a couple of posts in this thread by people who aren't seeing the expected behaviour with file permissions, the most recent one being just a few posts above. I saw the same thing, and realised that

ASP.NET Impersonation

was

not

enabled by default on my install (IIS 7.5). Once I turned it on manually, everything worked as expected, but this wasn't mentioned in the installation instructions. Maybe it's something specific to later version of IIS, but it may be worth mentioning in later revisions to the documentation.

 

Alternate port for Silverlight file access.

As has been previously mentioned by

ASW1980

, I would find it handy to be able to run the site on a non-standard port and still have the Silverlight My Computer functionality. If it's possible to make that a configurable option in later version, that would be awesome.

 

Problems with Application Request Routing

. This is a fairly obscure issue but I thought it worth mentioning. I was planning to publish HAP behind a reverse proxy using

Application Request Routing

for IIS. This mostly worked, but downloading files did not work correctly as the download would drop part of the file (large files would be missing a few 100kB off of the end, small files would return 0 bytes). Tracing on the IIS side showed a 503 (Bad gateway) error being returned. The best lead I could find on this is that in cases where requests are proxied, data could be dropped if the ASP code sending the data calls Response.End before calling Response.Close. A small write-up on this is

here

. I haven't gone digging through the source code to see if that is the case, but since you will be much more familiar with the code, I thought it worth mentioning even though it only happens over proxied connections.

 

Security hardening.

I'm a bit of a security freak, and I get very nervous publishing external websites using a highly privileged account like Network Service, and would be even more nervous of doing so on a Domain Controller - especially with the domain admin account username and password sitting in Web.config. I know RM like to ignore a lot of best practice in this area since they require running IIS on their DCs for the RMMC, but if a malicious user managed to compromise HAP while running in this configuration, you could potentially lose the entire domain. I configured HAP to run under a completely separate standard user account, with no special privileges other than begin configured as an IIS worker, and use the same account for the LDAP queries. I have encountered no problems with this configuration at all when using the My Computer functionality, though I suspect I would need to grant delegation privileges to that account in the AD for password changes if I were using that part of HAP. Are there any other access rights that HAP would need for other parts of the product, to assist others who were as nervous about using privileged accounts as I am?

 

I hope the above doesn't seem too critical; as I've already said, I'm very impressed with Home Access Plus as a whole, and the fact that those last two things above are very specific should act as a testament to how mature the product is already. Mrs AT works for the local university, and their remote file access system is substantially inferior to yours. I hope your school appreciates how fortunate they are to have a talented coder on staff, and of the enormous benefit to the community of releasing it freely. I know plenty of schools would be very eager to cash in, especially right now, and it's a testament to you and your school's management that they haven't done so.

 

Thanks,

AT

[Edu-IT]

I also have HAP running under a standard account with no problems.

[nickbro]

Thanks AT, the IdentityImpersonation issue is an odd one, it should be there by default (but disabled), however the IIS7.5 settings package should of enabled that.

 

Silverlight using a port, well that should be already working, since the way my silverlight app works, it uses the web browsers URL and just rewrites the end of it for the API calls.

 

The Application Request Routing problem, well that might be because of the way I do auth in the basic browser, with a Response.Redirect(url, true). True crudely stops processing of any other rules. I'll try and see if I can remember how to properly code that.

 

Security wise, the Admin Username/Password is only for AD calls, it is not used anywhere else. The web.config file cannot be accessed through http. You can use a standard user, that is fine, but delegate access would be needed for something to work (mainly in the booking system/help desk). The updating of user info is done under identity impersonate, so it's accessing AD using the users own credentials. The Network Service role is set only to help with NTFS permissions for the App_Data folder. You can leave it as Application Pool Identity, but you need to find that identity name and give the app_data folder the relevant permissions

[nickbro]

RE: The Application Request Routing problem, can you try the attached ZIP file and give feedback. It contains an updated HAP.web.dll file

[dgsmith]

I hope your school appreciates how fortunate they are to have a talented coder on staff, and of the enormous benefit to the community of releasing it freely. I know plenty of schools would be very eager to cash in, especially right now, and it's a testament to you and your school's management that they haven't done so.

 

Thanks,

AT

 

Very well said. Totally agree here - it is a fantastic product!

 

On a side note, thanks AT for publishing your testing with a standard user account. I too am very concerned about using the domain admin account (not least, as you say, about having the credentials in the web.config file too), so it is promising to see it may not cause problems to use an account with somewhat lesser priviledges, which i'd imagine would certainly be safer.

Edited December 26, 2010 by dgsmith

[dgsmith]

Security wise, the Admin Username/Password is only for AD calls, it is not used anywhere else. The web.config file cannot be accessed through http. You can use a standard user, that is fine, but delegate access would be needed for something to work (mainly in the booking system/help desk). The updating of user info is done under identity impersonate, so it's accessing AD using the users own credentials.

 

If we do not use the booking system/helpdesk, is there any reason at all why we should be (or is there any benefit in) using a/the domain admin account vs a standard user account?

[nickbro]

If we do not use the booking system/helpdesk, is there any reason at all why we should be (or is there any benefit in) using a/the domain admin account vs a standard user account?

None at all.

 

Really as long as you give some form of delegate access you can use a standard account. (The system just needs to be able to get a user list and perform queries in AD (what roles a user has, what OU a user is in etc...)

[AngryTechnician]

Silverlight using a port, well that should be already working, since the way my silverlight app works, it uses the web browsers URL and just rewrites the end of it for the API calls.

 

I tried it, but the rewriting seems to be dropping the alternate port definition off the end at some point. If I'm at the root of My Computer (https://internal.angrytech.com:8443/Extranet/MyComputerSL.aspx) and double click the N: drive, the N: drive flashes up for a second but is then redirected to https://internal.angrytech.com/Extranet/MyComputerSL.aspx#n - without the :8443 port definition.

 

RE: The Application Request Routing problem, can you try the attached ZIP file and give feedback. It contains an updated HAP.web.dll file

 

No change I'm afraid.

Edited December 27, 2010 by AngryTechnician

[nickbro]

I tried it, but the rewriting seems to be dropping the alternate port definition off the end at some point. If I'm at the root of My Computer (https://internal.angrytech.com:8443/Extranet/MyComputerSL.aspx) and double click the N: drive, the N: drive flashes up for a second but is then redirected to https://internal.angrytech.com/Extranet/MyComputerSL.aspx#n - without the :8443 port definition.

Try the attached silverlight version, extract the XAP file into the client bin folder

[ATTACH]8989[/ATTACH]

[AngryTechnician]

Try the attached silverlight version, extract the XAP file into the client bin folder

[ATTACH]8989[/ATTACH]

Alternate port works great with that, many thanks! Given the bank holiday I should really say 'stop doing work', but that would be slightly hypocritical of me...

[john]

Just wanted to post that, for some reason I've managed to overlook and not realise that we had this amazing product linked to on here! (or if I had done in the past it had escaped my mind!!) anyway, I've just set it up tonight on my system at work, and fine I need to sort an SSL out for it and get the LA to do a DNS entry, but I've got it working fine over my ADSL link to work, and accessing files fine, it really is a great tool so well done on it and sharing it with us

[mrbios]

First day back, just got around to updating, thank you very much for the last update nickbro im very happy with how ours looks now

[nickbro]

First day back, just got around to updating, thank you very much for the last update nickbro im very happy with how ours looks now

Wow, that looks really cool. How much does the Office TS licenses cost?

[mrbios]

Wow, that looks really cool. How much does the Office TS licenses cost?

 

Well that's an issue, i'm unsure of the legality with it, most teachers have purchased the home use program which we have via our MSVL so they would be covered, we have excess licenses too as we always expand the amount of PCs year on year, i assume that also means we're covered. I assume we should be purchasing an extra 150 (assuming that's the number of staff we have) office licenses on top of our usual required amount.

 

I was unaware as to whether there was any terminal server specific licenses though? could they be cheaper than the way we're doing it now? (adding on to our VL)

[mrbios]

Found a problem mentioned by a member of staff this morning, see the image below, could it be to do with the "+" symbol in the folder name?

[jonnykewell1]

yes this is true, + and & symbols do not work in home access plus for file or folders.

[mrbios]

yes this is true, + and & symbols do not work in home access plus for file or folders.

 

Ah ok, mildly annoying but not a huge issue i guess and easily resolved

[sister_annex]

From the hap website Home Access Plus

 

Problem with + in folder/file name

Run:

%windir%\system32\inetsrv\appcmd set config "Default Web Site" -section:system.webServer/security/requestFiltering -allowDoubleEscaping:true

 

HTH

 

Mark

[AngryTechnician]

If like me you are afraid of the command line, here's where the setting is in IIS7:

 

[mrbios]

Already done the command line route but handy to know the GUI route as well, thank you angrytechnician

[nickbro]

Ah, forgot to mention double escaping. It's one of those annoying IIS7 features.

[nickbro]

Actually, no I didn't: Home Access Plus+

 

Problem with + in folder/file name

 

Run:

%windir%\system32\inetsrv\appcmd set config "Default Web Site" -section:system.webServer/security/requestFiltering -allowDoubleEscaping:true

 

Note that "Default Web Site" should be replaced with the IIS website name

[2097]

thanks for your great Product . Had it running for a while now since the Homedrive problem . But worked away around it . I know the latest version includes a fix for this.

Any way to remove the Update my product information ?

 

I changed the colours etc to match in with our website Welcome To Grays Convent School

 

http://img213.imageshack.us/img213/5706/72886449.png

 

Uploaded with ImageShack.us

[nickbro]

It'll only display the version info for domain admins, if you don't have the latest version