Previous Next

Thread: Custom Authentication to membership provider for webdav?

Last post 10-30-2008 2:13 PM by anilr. 7 replies.

Average Rating Rate It (5)

RSS

Page 1 of 1 (8 items)

Sort Posts:

  • 10-03-2008, 6:32 PM

    Custom Authentication to membership provider for webdav?

    I need to allow users to be able to mount a webdav share running on IIS 7.0 where each user only sees and has access to their folder.  I have done this using windows accounts and it works where user Test1 can only read/write their Test1 folder.  Test2 can only read/write Test2, etc.  The authoring rules work perfect, life is good.

    The problem is I don't want to use a windows account - Neither Basic or Windows.  I would prefer to use the membership provider that is present in my web.config which links to my SQL 2005 database which the rest of my web site uses (forms authentication).  The webdav portion will be on it's own separate website with it's own separate subdomain and IP.

     

    I have quite a few ideas on how to accomplish this but I need help.

    1.  Use a Custom Membership Provider like this one:

     Custom Basic Authentication for IIS

    This way when a user tries to mount https://webdav.site.com/Test1 they get a prompt and enter their credentials and mount the webdav share.  The webdav module running on IIS 7.0 just sees that someone is authenticated and doesn't care how, only that their authenticated and send them to the folder defined in the authoring rules.

    2.   Use a custom HTTP Module

    HTTP Basic Authentication without Active Directory

     You have a HttpModule that does the authentication ahead of the webdav module.  The only problem I see is from reading this post:

    WebDav and Forms Authorization in IIS7

    anilr says that webdav module will ignore any code run in App_code or Bin folders unless you set the variable "runManagedModulesForWebDavRequests=true".  The only problem I see with this is I have no idea how to set this variable runManagedModulesForWebDavRequests because there is only 1 google result and it's the above link!  Even MSDN has no results for this flag...

    I also read this post where robmcm touches a bit on what needs to happen in the HttpModule but am confused on how to accomplish it without further clarification.

     Anonymous PUT in WebDAV

    anilr, if your out there could you please comment on how this can be accomplished?  I'm sure Robert McMurray (robmcm) would also know if this is possible or help push me further in the right direction...

    Once I figure out how to accomplish this, I will gladly share it with the community as I'm sure others have struggled with this problem.

     Cheers,

    Keith

  • 10-03-2008, 6:43 PM In reply to

    • anilr
    • Top 10 Contributor
    • Joined on 05-23-2006, 10:13 PM
    • Redmond, WA
    • Posts 1,210

    Re: Custom Authentication to membership provider for webdav?

    When in doubt about IIS configuration, look in %windir%\system32\inetsrv\config\schema\iis_schema.xml - in this case

    %windir%\system32\inetsrv\appcmd.exe set config -section:system.webServer/modules -runManagedModulesForWebDavRequests:true

    note that this means that you can break webdav using webdav by publishing bad code for your module.

    Anil Ruia
    Senior Software Design Engineer
    IIS Core Server
  • 10-05-2008, 12:59 PM In reply to

    Re: Custom Authentication to membership provider for webdav?

    Update:

    I have gotten the Custom Basic Authentication for IIS to work on my IIS7 server.  I can navigate to http://localhost and it prompts me for the username/password which I enter and it validates against the SQL membership provider.  The only problem I am now having is that I have had to go into the aspnet_Users table in SQL Server and put the computer name in front of the user name to be able to map a network drive using the membership provider credentials.

    So when I use webdav with the built in IIS7 Basic Authentication the http header it uses is:

    AUTH_USER :WIN-HWRM91XQXWN\keith

    When I use the Custom Basic Authentication validating against my SQL membership provider it only sends:

    AUTH_USER :keith

    Is there a way to tell Webdav module to not require the computer name?

    I feel it is a bad security practice to have the user know the name of the server and would like to essentially tell webdav to ignore the computer name and only look at the name.

     Can anyone help here or is this unfamiliar territory?

  • 10-07-2008, 8:08 PM In reply to

    • anilr
    • Top 10 Contributor
    • Joined on 05-23-2006, 10:13 PM
    • Redmond, WA
    • Posts 1,210

    Re: Custom Authentication to membership provider for webdav?

    What is the exact failure on the server side (using failed request tracing) when you do not use machine/domain name.

    Anil Ruia
    Senior Software Design Engineer
    IIS Core Server
  • 10-08-2008, 4:02 PM In reply to

    Re: Custom Authentication to membership provider for webdav?

    Anilr,

     I have gotten past the name issue as it's not a big deal to include the machinename\user in my instructions to my userbase.

    I have discovered a much bigger issue though.  Special characters like + % and & are not allowed in the file name when you upload or download through the webdav mapped drive.

    Let me describe what I'm doing and maybe you can replicate the bug.

    1.  I made a new web site in IIS 7 calling it 'Webdav' and enabled webdav for the site.

    2.  I made the bindings for the 'Webdav' site respond to the address 'http://storage.mytestsite.com' and configured my XP machine host file to know storage.mytestsite.com is the correct IP address.

    3.  I created a virtual directory named 'Keith' at the root of the drive.

    4.  I added a webdav authoring rule to the virtual directory 'Keith' with Path=*, Users=*, Access="Read, Source, Write"

    5.  I enabled the built in IIS 7 Basic authentication module and disabled all other authentication.

    6.  On XP I right clicked 'My Computer' and left clicked 'Map Network Drive'.  I put in 'http://storage.mytestsite.com/keith' as the address and click 'Finish' button.  The authentication prompt appears and I enter my username 'WIN-HWRM91XQXWN\Keith' and password (I had previously made a windows user account on the server).  The drive is now mapped.

    7.  I made a test file on my XP machine called, 'I am keith.txt' and put some sample text into it.  I copied it from my XP machine onto the mapped network drive.  I went to the 2008 server and looked in the folder the virtual directory 'Keith' is associated with, sure enough the file 'I am keith.txt' is located on the server.  I then made a file 'This is a & test.txt' put sample text into it and copied it to the mapped network drive.  The file copied fine, life is good.

    8.  I then implemented an HttpModule that does basic authentication for my webdav web site using this article: Developing a Module Using .NET

    The article is pretty simple and in Appendix A I have used the exact code in the article, added it to my app_code directory and modified the web.config file to use the HttpModule.  I then disabled the built in Basic Authentication Module in the IIS 7 interface.

    9.  On my XP machine I right clicked 'My Computer' and left clicked 'Disconnect Network Drive' and removed the previous mapped drive.  I then mapped the drive again to 'http://storage.mytestsite.com/keith' and this time used the credentials specified in the BasicAuthenticationModule.cs in the app_code directory for the webdav web site, 'WIN-HWRM91XQXWN\Test' and password.  The drive maps. 

    I tried to delete the file 'This is a & test.txt' and I get the messagebox error: 'Cannot delete file: Cannot read from the source file or disk.' 

    I tried to make a new file on my local XP machine, 'This is a + test.txt' and copy it to the mapped network drive and get the error: 'Cannot copy This is a + test: The parameter is incorrect.'

     

    So basically everything works great (including files with special characters + % and &) when I use the built in microsoft basic authentication module in the IIS 7 interface.

    Once I use a HttpModule that does basic authentication I can only work with files that do not have a + % or a & in the file name.

     

    My theory is that somewhere in the custom basic authentication HttpModule url encoded strings from the querystring are not being decoded correctly.

    File names with the following symbols work correctly: !@#$^()_

    File names with the following symbols don't work correctly: %&+

    I ran etherreal (now known as wireshark) while trying to do a F5 when I had previously created the file 'This is a test + .txt' and saw it gave a 404 error.  I then turned on failed request tracing and hit F5 again.

    Cheers

  • 10-09-2008, 10:02 AM In reply to

    Re: Custom Authentication to membership provider for webdav?

    I fixed this problem by going into the Server Manager and removing the Role, 'Request Filtering'  IIS 7 then no longer will filter out symbols like : % & * ?

     

    I'm still having a problem with files with a + symbol in them.

    I have created a new post to highlight this problem

    Cheers,

    Keith

  • 10-30-2008, 9:46 AM In reply to

    Re: Custom Authentication to membership provider for webdav?

    As I also e-mailed Anilr, I'm trying to do the exact same things on a Windows 2003 machine. I have the feeling I'm almost there, but there are a few things different from the IIS7 approach.

    - I've setup webDAV and setup the site example of the custom basichttp handler.

    - I'm able to authenticate to the database logging in with IE (the auth popup comes up as it should), everythings fine

    - When I setup webDAV on a client PC, it just shows the entire folder without asking for any authentication. I guess that's because I need the 'runManagedModulesForWebDavRequests' property which I can't set.

    - I've also tried adding a wildcard handler for the isapi module, but then authentication fails alltogether (IE stops working too) for some reason. If I look at the application event log, it shows one succeeded authentication event for my user, and one (immediately after the first) failed one for an empty username "".

    - The last thing I tried is disabling anonymous access and enabling basic authentication in IIS, but that seems to bypass the httpmodule and use IIS' default basic authentication mechanism for validation, which offcourse isn't what I want.

     

    Anyone any idea on how to resolve this on IIS6/Win2003? I could upgrade to 2008, but only if that's really the only solution left.

  • 10-30-2008, 2:13 PM In reply to

    • anilr
    • Top 10 Contributor
    • Joined on 05-23-2006, 10:13 PM
    • Redmond, WA
    • Posts 1,210

    Re: Custom Authentication to membership provider for webdav?

    There is no integrated pipeline for managed modules in IIS6 - you will need IIS7 to do this.

    Anil Ruia
    Senior Software Design Engineer
    IIS Core Server
Page 1 of 1 (8 items)
Page view counter