anonymousIdentification setting fails to override root configurati

[John H Clark]

I am designing a site that requires AnonymousID. I set my web.config to
allow this using <anonymousIdentification enable="true".../as recommended
in the documentation.

To verify the settings I use the following code in global.asax and stop the
execution using debug to inspect the settings.

Configuration configuration =
WebConfigurationManager.OpenWebConfiguration("/SessionManager");

// Get the section.
AnonymousIdentificationSection anonymousIdentificationSection =
(AnonymousIdentificationSection)configuration.GetS ection("system.web/anonymousIdentification");

In this case anonymousIdentification is enabled.

When I get the root configuration using OpenWebConfiguration(null) and check
the settings anonymousIdentification is not enabled.

Subsequently when I check the Request.AnonymousID during page requests it is
null.

Another issue is which delegate to use to directly set the AnonymousID. The
documentation recommends both AnonymousIdentification_OnCreate and
AnonymousIdentification_Creating in different areas. I supplied both in my
global.asax code and neither are called further substantiating the failure to
use the site application web.config as opposed to the root web.config
settings.

Any suggestions or help is appreciated.
--
John H Clark
www.weownit.coop

[Walter Wang [MSFT]]

Hi John,

Based on my understanding, you have a virtual directory at
"/SessionManager" that is configured with AnonymousIdentification enabled.
However, you found that in Session_Start, Request.AnonymousID is null. If
I've misunderstood anything, please feel free to let me know.

I've done some test on Windows Server 2003 R2 using the information from
your post, however, I found the AnonymousID is correctly set to a GUID
value (default).

Since AnonymousIdentification must be set at Machine.config, Root-level or
Application-level web.config, I think the setting should be honored in the
sub web.

As the documentation of AnonymousIdentificationModule's event, the correct
event is Creating. The documention of AnonymousID is incorrect here. I'm
sorry for the confusion caused.

#How to: Create ASP.NET Application-Level Event Handlers
http://msdn2.microsoft.com/en-us/library/fwzzh56s.aspx
ASP.NET automatically binds application events to event-handler methods in
the Global.asax file using a naming convention of Application_event, such
as Application_BeginRequest and Application_Error.

If you add modules to your application, the modules themselves can raise
events. The application can subscribe to in these events in the Global.asax
file by using the convention modulename_eventname. For example, to handle
the Authenticate event raised by a FormsAuthenticationModule object, you
can create a handler named FormsAuthentication_Authenticate.
You will find following http modules in
%windir%\microsoft.net\framework\v2.0.50727\config \web.config:

<httpModules>
<add name="OutputCache"
type="System.Web.Caching.OutputCacheModule" />
<add name="Session"
type="System.Web.SessionState.SessionStateModule" />
<add name="WindowsAuthentication"
type="System.Web.Security.WindowsAuthenticationMod ule" />
<add name="FormsAuthentication"
type="System.Web.Security.FormsAuthenticationModul e" />
<add name="PassportAuthentication"
type="System.Web.Security.PassportAuthenticationMo dule" />
<add name="RoleManager"
type="System.Web.Security.RoleManagerModule" />
<add name="UrlAuthorization"
type="System.Web.Security.UrlAuthorizationModule" />
<add name="FileAuthorization"
type="System.Web.Security.FileAuthorizationModule" />
<add name="AnonymousIdentification"
type="System.Web.Security.AnonymousIdentificationM odule" />
<add name="Profile" type="System.Web.Profile.ProfileModule" />
<add name="ErrorHandlerModule"
type="System.Web.Mobile.ErrorHandlerModule, System.Web.Mobile,
Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" />
</httpModules>
Which means you can use their events in Global.asax; and if you take a look
at AnonymousIdentificationModule's events, it only has an event named
Creating.

You can use following code in global.asax to set the AnonymousID:

void AnonymousIdentification_Creating(object sender,
AnonymousIdentificationEventArgs
args)
{
args.AnonymousID = DateTime.Now.ToString();
}
To debug this, make sure you've cleared IE cookies related to your web
server; you can use IECookiesView from
http://www.nirsoft.net/utils/iecookies.html to delete the cookies.
Sincerely,
Walter Wang (wa****@online.microsoft.com, remove 'online.')
Microsoft Online Community Support

==================================================
Get notification to my posts through email? Please refer to
http://msdn.microsoft.com/subscripti...ult.aspx#notif
ications. If you are using Outlook Express, please make sure you clear the
check box "Tools/Options/Read: Get 300 headers at a time" to see your reply
promptly.

Note: The MSDN Managed Newsgroup support offering is for non-urgent issues
where an initial response from the community or a Microsoft Support
Engineer within 1 business day is acceptable. Please note that each follow
up response may take approximately 2 business days as the support
professional working with you may need further investigation to reach the
most efficient resolution. The offering is not appropriate for situations
that require urgent, real-time or phone-based interactions or complex
project analysis and dump analysis issues. Issues of this nature are best
handled working with a dedicated Microsoft Support Engineer by contacting
Microsoft Customer Support Services (CSS) at
http://msdn.microsoft.com/subscripti...t/default.aspx.
==================================================

This posting is provided "AS IS" with no warranties, and confers no rights.

[John H Clark]

Walter,

Thanks for the information.

I checked my AnonymousIdentification module configuration and found that the
setting is as described in your reply. I retested after setting both the root
and the application anonymousIdentification enabled = "true". This has no
effect.

Please try testing the situation I described using XP Professional, Visual
Studio, IE7 in a localhost environment. See if that changes your outcome.
--
John H Clark
www.weownit.coop
"Walter Wang [MSFT]" wrote:

Hi John,

Based on my understanding, you have a virtual directory at
"/SessionManager" that is configured with AnonymousIdentification enabled.
However, you found that in Session_Start, Request.AnonymousID is null. If
I've misunderstood anything, please feel free to let me know.

I've done some test on Windows Server 2003 R2 using the information from
your post, however, I found the AnonymousID is correctly set to a GUID
value (default).

Since AnonymousIdentification must be set at Machine.config, Root-level or
Application-level web.config, I think the setting should be honored in the
sub web.

As the documentation of AnonymousIdentificationModule's event, the correct
event is Creating. The documention of AnonymousID is incorrect here. I'm
sorry for the confusion caused.

#How to: Create ASP.NET Application-Level Event Handlers
http://msdn2.microsoft.com/en-us/library/fwzzh56s.aspx
ASP.NET automatically binds application events to event-handler methods in
the Global.asax file using a naming convention of Application_event, such
as Application_BeginRequest and Application_Error.

If you add modules to your application, the modules themselves can raise
events. The application can subscribe to in these events in the Global.asax
file by using the convention modulename_eventname. For example, to handle
the Authenticate event raised by a FormsAuthenticationModule object, you
can create a handler named FormsAuthentication_Authenticate.
You will find following http modules in
%windir%\microsoft.net\framework\v2.0.50727\config \web.config:

<httpModules>
<add name="OutputCache"
type="System.Web.Caching.OutputCacheModule" />
<add name="Session"
type="System.Web.SessionState.SessionStateModule" />
<add name="WindowsAuthentication"
type="System.Web.Security.WindowsAuthenticationMod ule" />
<add name="FormsAuthentication"
type="System.Web.Security.FormsAuthenticationModul e" />
<add name="PassportAuthentication"
type="System.Web.Security.PassportAuthenticationMo dule" />
<add name="RoleManager"
type="System.Web.Security.RoleManagerModule" />
<add name="UrlAuthorization"
type="System.Web.Security.UrlAuthorizationModule" />
<add name="FileAuthorization"
type="System.Web.Security.FileAuthorizationModule" />
<add name="AnonymousIdentification"
type="System.Web.Security.AnonymousIdentificationM odule" />
<add name="Profile" type="System.Web.Profile.ProfileModule" />
<add name="ErrorHandlerModule"
type="System.Web.Mobile.ErrorHandlerModule, System.Web.Mobile,
Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" />
</httpModules>
Which means you can use their events in Global.asax; and if you take a look
at AnonymousIdentificationModule's events, it only has an event named
Creating.

You can use following code in global.asax to set the AnonymousID:

void AnonymousIdentification_Creating(object sender,
AnonymousIdentificationEventArgs
args)
{
args.AnonymousID = DateTime.Now.ToString();
}
To debug this, make sure you've cleared IE cookies related to your web
server; you can use IECookiesView from
http://www.nirsoft.net/utils/iecookies.html to delete the cookies.
Sincerely,
Walter Wang (wa****@online.microsoft.com, remove 'online.')
Microsoft Online Community Support

==================================================
Get notification to my posts through email? Please refer to
http://msdn.microsoft.com/subscripti...ult.aspx#notif
ications. If you are using Outlook Express, please make sure you clear the
check box "Tools/Options/Read: Get 300 headers at a time" to see your reply
promptly.

Note: The MSDN Managed Newsgroup support offering is for non-urgent issues
where an initial response from the community or a Microsoft Support
Engineer within 1 business day is acceptable. Please note that each follow
up response may take approximately 2 business days as the support
professional working with you may need further investigation to reach the
most efficient resolution. The offering is not appropriate for situations
that require urgent, real-time or phone-based interactions or complex
project analysis and dump analysis issues. Issues of this nature are best
handled working with a dedicated Microsoft Support Engineer by contacting
Microsoft Customer Support Services (CSS) at
http://msdn.microsoft.com/subscripti...t/default.aspx.
==================================================

This posting is provided "AS IS" with no warranties, and confers no rights.

[Walter Wang [MSFT]]

Hi John,

Make sure you've enabled "Anonymous access" in IIS for your virtual
directory.

Regards,
Walter Wang (wa****@online.microsoft.com, remove 'online.')
Microsoft Online Community Support

==================================================
When responding to posts, please "Reply to Group" via your newsreader so
that others may learn and benefit from your issue.
==================================================

This posting is provided "AS IS" with no warranties, and confers no rights.

[John H Clark]

Walter,

The directory runs under the control of the ASP.NET Development Server. It
doesn't appear in the IIS list of virtual directories. Its URL is
http://localhost:xxxx/SessionManager.

How do I allow anonymous access to this virtual directory?
--
John H Clark
www.weownit.coop
"Walter Wang [MSFT]" wrote:

Hi John,

Make sure you've enabled "Anonymous access" in IIS for your virtual
directory.

Regards,
Walter Wang (wa****@online.microsoft.com, remove 'online.')
Microsoft Online Community Support

==================================================
When responding to posts, please "Reply to Group" via your newsreader so
that others may learn and benefit from your issue.
==================================================

This posting is provided "AS IS" with no warranties, and confers no rights.

[Walter Wang [MSFT]]

Hi John,

I'm sorry for my misunderstanding that you're using IIS instead of the
built-in development web server.

Based on my research, to make the built-in server to accept anonymous
login, you have to use either "None" or "Forms" authentication mode in
web.config:

<system.web>
<authentication mode="Forms"/>
...
</system.web>
Using "Windows" authentication mode will use current windows user account
to login; thus reading Request.AnonymousID will return null.

This is one of limitations of the built-in web server that is not
documented well. I'm sorry for the inconvenience.

The built-in web server does have many limitations when compared to IIS
server, you may find more information here:

#Web Servers in Visual Web Developer
http://msdn2.microsoft.com/en-us/lib...w5(VS.80).aspx
The ASP.NET Development Server only accepts authenticated requests on the
local computer. This requires that the server can support NTLM or Basic
authentication.

Security Context for the ASP.NET Development Server

An important difference between the ASP.NET Development Server and IIS is
the security context in which the respective servers run your ASP.NET
pages. This difference can affect your testing because of differences in
how the pages run.

When you run a page using the ASP.NET Development Server, the page runs in
the context of your current user account. For example, if you are running
as an administrator-level user, a page running in the ASP.NET Development
Server will have administrator-level privileges.
#File System Web Sites
http://msdn2.microsoft.com/en-us/lib...73(VS.80).aspx

Regards,
Walter Wang (wa****@online.microsoft.com, remove 'online.')
Microsoft Online Community Support

==================================================
When responding to posts, please "Reply to Group" via your newsreader so
that others may learn and benefit from your issue.
==================================================

This posting is provided "AS IS" with no warranties, and confers no rights.

[John H Clark]

Walter,

Thanks for the information.

FYI, I am using Forms authentication so the situation is not resolved by
using Forms authentication.

I will test under the IIS environment.
--
John H Clark
www.weownit.coop
"Walter Wang [MSFT]" wrote:

Hi John,

I'm sorry for my misunderstanding that you're using IIS instead of the
built-in development web server.

Based on my research, to make the built-in server to accept anonymous
login, you have to use either "None" or "Forms" authentication mode in
web.config:

<system.web>
<authentication mode="Forms"/>
...
</system.web>
Using "Windows" authentication mode will use current windows user account
to login; thus reading Request.AnonymousID will return null.

This is one of limitations of the built-in web server that is not
documented well. I'm sorry for the inconvenience.

The built-in web server does have many limitations when compared to IIS
server, you may find more information here:

#Web Servers in Visual Web Developer
http://msdn2.microsoft.com/en-us/lib...w5(VS.80).aspx
The ASP.NET Development Server only accepts authenticated requests on the
local computer. This requires that the server can support NTLM or Basic
authentication.

Security Context for the ASP.NET Development Server

An important difference between the ASP.NET Development Server and IIS is
the security context in which the respective servers run your ASP.NET
pages. This difference can affect your testing because of differences in
how the pages run.

When you run a page using the ASP.NET Development Server, the page runs in
the context of your current user account. For example, if you are running
as an administrator-level user, a page running in the ASP.NET Development
Server will have administrator-level privileges.
#File System Web Sites
http://msdn2.microsoft.com/en-us/lib...73(VS.80).aspx

Regards,
Walter Wang (wa****@online.microsoft.com, remove 'online.')
Microsoft Online Community Support

==================================================
When responding to posts, please "Reply to Group" via your newsreader so
that others may learn and benefit from your issue.
==================================================

This posting is provided "AS IS" with no warranties, and confers no rights.