Insert into instead of add to the HttpModules pipeline

[=?Utf-8?B?Tm9yZW1hYw==?=]

Hi,

We are writing a Web SSO service for all of our websites through Forms
Authentication. We also want to provide our websites with the ability to
protect different parts of their website and redirect to different
registration pages. We are also required to centrally audit authorization
failures to a database only the Web SSO people can see.

We are using .NET 2.0 but need solutions that will use the same code run on
our clients either under 2.0 or 1.1.

We are hoping that sometime in the future ADFS 2+ or another vendor will
provide this functionality but in the meantime the show must go on.
Therefore, our solution is to balance business requirements with simplicity.

The current approach for authorization is to have an HttpModule listen for
Response status 401 on EndRequest. Then we can do some calls to get the
registration page and do the audit.

We are looking for an effecient way for our consuming web apps to hook up
our module.

In .NET 1.1 it looks pretty straight forward. We would have each consuming
web app modify their web.config as follows:
<httpModules>
<remove name="FormsAuth entication" />
<add name="WebSSOAut horization"
type="WebSSOAut horizationModul e, MyApp11"/>
<add name="FormsAuth entication"
type="System.We b.Security.Form sAuthentication Module" />
</httpModules>
In .NET 2.0, this does not appear to be the case. This is what we need to do
to get it to work in a consuming .NET 2.0 web app's web.config:
<httpModules>
<clear />
<add name="OutputCac he" type="System.We b.Caching.Outpu tCacheModule" />
<add name="Session" type="System.We b.SessionState. SessionStateMod ule" />
<add name="WindowsAu thentication"
type="System.We b.Security.Wind owsAuthenticati onModule" />
<add name="WebSSOAut horization" type="WebSSOAut horizationModul e"/>
<add name="FormsAuth entication"
type="System.We b.Security.Form sAuthentication Module" />
<add name="PassportA uthentication"
type="System.We b.Security.Pass portAuthenticat ionModule" />
<add name="RoleManag er" type="System.We b.Security.Role ManagerModule" />
<add name="UrlAuthor ization"
type="System.We b.Security.UrlA uthorizationMod ule" />
<add name="FileAutho rization"
type="System.We b.Security.File AuthorizationMo dule" />
<add name="Anonymous Identification"
type="System.We b.Security.Anon ymousIdentifica tionModule" />
<add name="Profile" type="System.We b.Profile.Profi leModule" />
<add name="ErrorHand lerModule"
type="System.We b.Mobile.ErrorH andlerModule, System.Web.Mobi le,
Version=2.0.0.0 , Culture=neutral , PublicKeyToken= b03f5f7f11d50a3 a" />
<add name="ServiceMo del"
type="System.Se rviceModel.Acti vation.HttpModu le, System.ServiceM odel,
Version=3.0.0.0 , Culture=neutral , PublicKeyToken= b77a5c561934e08 9" />
</httpModules>

Hardcopying this down into each client's web.config during development is
just not practical. No one has any ideo over time what will be installed on
the web servers and modify the server's httpModules list.

Ideally, the client could just add our handler and then our handler could
reorder itself in the modules list at runtime on its Init so it fires before
FormsAuthentica tion. Is this possible?

If not, then would a solution be to put our Module into the server's
web.config? I think that part of that solution would have to be us defining a
configSection so that only the apps that want that module to fire would have
to explicitly turn it on (just like .NET was designed with <authenticati on
mode="Forms">).

Thanks.

[Steven Cheng[MSFT]]

Hello Noremac,

From your description, I understand you've developed a custom httpmodule
for providing SSO service in your ASP.NET web applications, you used to use
some simple configuration settings in application web.config file to
register your custom module, however, you found that you need much more
cofiguration elements in ASP.NET 2.0 application's web.config. So you're
wondering whether there is any more elegant means to do this, correct?

Based on my research, ASP.NET 2.0 has added many new built-in httpmodules,
and the "RoleManage r" module is a new module which also related to forms
authentication and authorization. You can try reordering all the following
modules(put after your custom module) in application's web.config file to
see whether it helps:

"FormsAuthentic ation"
"RoleManage r"
"UrlAuthorizati on"
Also, in .NET 2.0, it provide a set of configuration API that can help us
manage the application(or machine level) configuration in code. For
example, here is a test page which use web configuration API to insert a
custom httpModule before the "FormsAuthentic ation" module:

=============== =
public partial class _Default : System.Web.UI.P age
{
protected void Page_Load(objec t sender, EventArgs e)
{
Response.Write( "<br/>current user: " + Environment.Use rName);

}
protected void btnButton_Click (object sender, EventArgs e)
{
Configuration config =
WebConfiguratio nManager.OpenWe bConfiguration( Request.Applica tionPath);

HttpModulesSect ion section =
config.SectionG roups["system.web "].Sections["httpModule s"] as
HttpModulesSect ion;

if (section != null)
{
Response.Write( "<br/>section: " + section);

ConfigurationEl ement[] modules = new
ConfigurationEl ement[section.Modules .Count];
section.Modules .CopyTo(modules , 0);

List<Configurat ionElementnewmo dules = new
List<Configurat ionElement>();

foreach (ConfigurationE lement elm in modules)
{
Response.Write( "<br/>" +
elm.ElementInfo rmation.Propert ies["name"].Value);

if (elm.ElementInf ormation.Proper ties["name"].Value.Equals(
"FormsAuthentic ation"))
{
Response.Write( "<br/>insert my module here");
HttpModuleActio n mymodule = new
HttpModuleActio n("mymodule", "simpleModule") ;

newmodules.Add( mymodule);

}

newmodules.Add( elm);
}
section.Modules .Clear();
foreach (ConfigurationE lement elm in newmodules)
{
Response.Write( "<br/>new module: " +
elm.ElementInfo rmation.Propert ies["name"].Value);
section.Modules .Add((HttpModul eAction)elm);
}

config.Save(Con figurationSaveM ode.Modified);

}

}
}
=============== =========

Here are some MSDN reference introducing the new web configuration API:

http://msdn2.microsoft.com/en-us/lib...60(vs.80).aspx

http://msdn2.microsoft.com/en-us/library/ms178687.aspx

Hope this helps some.

Sincerely,

Steven Cheng

Microsoft MSDN Online Support Lead

=============== =============== =============== =====

Get notification to my posts through email? Please refer to
http://msdn.microsoft.com/subscripti...ult.aspx#notif
ications.

Note: The MSDN Managed Newsgroup support offering is for non-urgent issues
where an initial response from the community or a Microsoft Support
Engineer within 1 business day is acceptable. Please note that each follow
up response may take approximately 2 business days as the support
professional working with you may need further investigation to reach the
most efficient resolution. The offering is not appropriate for situations
that require urgent, real-time or phone-based interactions or complex
project analysis and dump analysis issues. Issues of this nature are best
handled working with a dedicated Microsoft Support Engineer by contacting
Microsoft Customer Support Services (CSS) at
http://msdn.microsoft.com/subscripti...t/default.aspx.

=============== =============== =============== =====

This posting is provided "AS IS" with no warranties, and confers no rights.

[=?Utf-8?B?Tm9yZW1hYw==?=]

Those are both good suggestions. Just reordering those three modules seem to
work. Re-writing the config file at runtime seems mighty tempting but I tried
to put it into an "Init" HttpModule and I got errors saving the config file
even with ASPNET having read/write.

It looks like the solution with the most elegance (i.e. less client-app
change) is to insert this handler in the machine's web.config and let each
app turn it on through a definition in their own web.config. I plan on adding
a config section to my HttpModule.

For 1.1, I think we may as well be consistent and add it into the
machine.config. Although I will have to figure out naming, etc since the code
needs to be compiled in both 1.1 and 2.0.

As always, thanks again for your help.

"Steven Cheng[MSFT]" wrote:

Hello Noremac,

From your description, I understand you've developed a custom httpmodule
for providing SSO service in your ASP.NET web applications, you used to use
some simple configuration settings in application web.config file to
register your custom module, however, you found that you need much more
cofiguration elements in ASP.NET 2.0 application's web.config. So you're
wondering whether there is any more elegant means to do this, correct?

Based on my research, ASP.NET 2.0 has added many new built-in httpmodules,
and the "RoleManage r" module is a new module which also related to forms
authentication and authorization. You can try reordering all the following
modules(put after your custom module) in application's web.config file to
see whether it helps:

"FormsAuthentic ation"
"RoleManage r"
"UrlAuthorizati on"
Also, in .NET 2.0, it provide a set of configuration API that can help us
manage the application(or machine level) configuration in code. For
example, here is a test page which use web configuration API to insert a
custom httpModule before the "FormsAuthentic ation" module:

=============== =
public partial class _Default : System.Web.UI.P age
{
protected void Page_Load(objec t sender, EventArgs e)
{
Response.Write( "<br/>current user: " + Environment.Use rName);

}
protected void btnButton_Click (object sender, EventArgs e)
{
Configuration config =
WebConfiguratio nManager.OpenWe bConfiguration( Request.Applica tionPath);

HttpModulesSect ion section =
config.SectionG roups["system.web "].Sections["httpModule s"] as
HttpModulesSect ion;

if (section != null)
{
Response.Write( "<br/>section: " + section);

ConfigurationEl ement[] modules = new
ConfigurationEl ement[section.Modules .Count];
section.Modules .CopyTo(modules , 0);

List<Configurat ionElementnewmo dules = new
List<Configurat ionElement>();

foreach (ConfigurationE lement elm in modules)
{
Response.Write( "<br/>" +
elm.ElementInfo rmation.Propert ies["name"].Value);

if (elm.ElementInf ormation.Proper ties["name"].Value.Equals(
"FormsAuthentic ation"))
{
Response.Write( "<br/>insert my module here");
HttpModuleActio n mymodule = new
HttpModuleActio n("mymodule", "simpleModule") ;

newmodules.Add( mymodule);

}

newmodules.Add( elm);
}
section.Modules .Clear();
foreach (ConfigurationE lement elm in newmodules)
{
Response.Write( "<br/>new module: " +
elm.ElementInfo rmation.Propert ies["name"].Value);
section.Modules .Add((HttpModul eAction)elm);
}

config.Save(Con figurationSaveM ode.Modified);

}

}
}
=============== =========

Here are some MSDN reference introducing the new web configuration API:

http://msdn2.microsoft.com/en-us/lib...60(vs.80).aspx

http://msdn2.microsoft.com/en-us/library/ms178687.aspx

Hope this helps some.

Sincerely,

Steven Cheng

Microsoft MSDN Online Support Lead

=============== =============== =============== =====

Get notification to my posts through email? Please refer to
http://msdn.microsoft.com/subscripti...ult.aspx#notif
ications.

Note: The MSDN Managed Newsgroup support offering is for non-urgent issues
where an initial response from the community or a Microsoft Support
Engineer within 1 business day is acceptable. Please note that each follow
up response may take approximately 2 business days as the support
professional working with you may need further investigation to reach the
most efficient resolution. The offering is not appropriate for situations
that require urgent, real-time or phone-based interactions or complex
project analysis and dump analysis issues. Issues of this nature are best
handled working with a dedicated Microsoft Support Engineer by contacting
Microsoft Customer Support Services (CSS) at
http://msdn.microsoft.com/subscripti...t/default.aspx.

=============== =============== =============== =====

This posting is provided "AS IS" with no warranties, and confers no rights.

[Steven Cheng[MSFT]]

Thanks for your reply Noremac,

I think your further consideration is comprehensive. If you have any
further questions or anything we can help later, please feel free to post
here.

Sincerely,

Steven Cheng

Microsoft MSDN Online Support Lead
This posting is provided "AS IS" with no warranties, and confers no rights.