Although it’s fairly obvious that a website is running asp.net (through session cookie and the viewstate) you may protect your server by removing a few response headers that advertise the iis and the asp.net version. The most common response headers you should remove are the following: X-Powered-By:ASP.NET X-AspNet-Version:*.*.* Server:Microsoft-IIS/*.* The X-Powered-By response header This header is added by the iis and you may remove it via the “Http Response Headers” in the iis configuration tool as shown in the following images for iis 7+: and for iis 6 you should check the following image: The X-AspNet-Version response header This is advertised by the .net framework. You may remove this by adding the following entry in your application’s web.config file: httpRuntime is located at configuration\system.web In the case of the MVC, you should also consider disabling the MvcResponseHeader setting the value of System.Web.Mvc.MvcHandler.DisableMvcResponseHeader to true in the gloabal.asax...

Once upon a time I won a Silverlight coding competition by writing a simple game in Silverlight 1.1 Alpha Refresh. A few weeks ago a beta tester of my game requested to play with it, once more. Installing the redistributable (thanks god I keep an archive of these because I couldn’t find it on Microsoft’s site) I came up with a message box that said that this version has expired (the alpha version should expire on 1st nov 2007). Thus, I tried the version 2.0 redistributable. To my disappointment, the Silverlight 2.0 that was released after the Silverlight 1.1 Alpha didn’t support the code I had written and I had to modify a couple of things to make it run under version 2.0. In order to avoid editing the code I tried to “extend” the alpha expiration date. So I ended up installing a trial of IDA Pro 6 and checking the assembly of the “C:\Program Files\Microsoft Silverlight\npctrl.1.0.20816.0.dll” file. If you open up the file in a hex editor and go to the 00014EE5 address you will see the...

If you search around the net, you’ll most probably find a lot of articles discussing how to create windows sharepoint services (WSS) modules or even how to install WSS on top of existing web site. In my case, I have to create a document management system in an existing asp.net application. In order to do so, I will be using the office integration that is provided by the document library of WSS and will be writing custom forms to handle the rest of the gui. My asp.net application uses a customasp.net membership provider in order to authenticate users. So, my first idea was to enable Form Based Authentication (FBA) on WSS and setup the custom membership provider to handle the requests. Well, although this worked concerning the security aspects of the integration, the user had to login once more in WSS whenever he was requesting something from sharepoint and moreover, the office integration of the document library didn’t work well . To be more precise, whenever the user requested a document...

If you have configured forms authentication across multiple asp.net applications , you may want to force users to authenticate in a single signing form. To do so you may implement a simple HttpModule that will be handling the AuthenticateRequest and redirecting to the corresponding login form. Custom configuration section We shall create a configuration section in order to save the login form url. The configuration section in the web.config should look like the following: < RedirectToLoginConfiguration > < loginForm url = "http://authenticationServer/login.aspx" /> </ RedirectToLoginConfiguration > To do so, we will write two classes; one inheriting from ConfigurationSection and another inheriting from ConfigurationElement. The code for those two classes is self-explaining (I hope): /// <summary> /// This is the class that represents the web.config section for the RedirectToLogin module /// The following is a valid configuration section: /// <RedirectToLoginConfiguration>...

In order to enable forms authentication across multiple asp.net application you will have to setup the forms authentication to specify the same name, protection and path among all the asp.net applications that will be collaborating. The following is an example of the configuration\system.web\authentication node in the web.config of each asp.net application. < authentication mode = "Forms" > < forms loginUrl = "login.aspx" name = ".ASPXFORMSAUTH" protection = "All" path = "/" timeout = "30" /> </ authentication > Moreover, you will have to modify the MachineKey in the web.config (under the section configuration\system.web) of each application and remove the IsolateApps that is declared in the default machine.config. If your applications are located on the same server or farm, then you may leave validationKey="AutoGenerate" and decryptionKey="AutoGenerate". Otherwise, you will have to specify...

Playing around with the available authentication methods I came up with a simple Http module that forces the browser to display the build in credentials form and authenticates the user by simply adding a line in the web.config file. This is actually a pretty simple class that inherits the IHttpModule interface and hooks up on the web application’s Authenticate request event in order to modify the response headers and reply with a 401 error code. In order to dictate the browser in showing the build in login form, you’ll have to add the WWW-Authenticate header on the first unauthenticated call. IE default "request for credentials" dialogue When the user provides the requested credentials, the module parses the new request and tries to locate the “Authorization” header that should contain a value like the following: Basic aGVsbG86bGw= This string contains the username and the password in a username:password format that is provided in a Base64 encoding. To be more specific, aGVsbG86bGw...

My father replaced an old LG KU380 and wanted to transfer his contacts to his new Ericson mobile phone. Unluckily for me, LG provided some software that was promising to synchronize the mobile phone with the outlook, but it wouldn’t stay connected with the phone for more than one minute. Thus, every 100 contacts it would stall and start over again. The next available option was to export the contacts in a vcf file from within the mobile phone and transfer the generated file via Bluetooth. The file had the following format: Code highlighting produced by Actipro CodeHighlighter (freeware) http://www.CodeHighlighter.com/ --> BEGIN:VCARD VERSION: 2.1 N ; ENCODING=QUOTED-PRINTABLE;CHARSET=UTF-8:;=CE=91 TEL ; HOME;CELL;CHARSET=UTF-8:123456789 REV:20141012T151100Z END:VCARD BEGIN:VCARD VERSION: 2.1 N ; ENCODING=QUOTED-PRINTABLE;CHARSET=UTF-8:;=CE=91=CE=B1 TEL ; HOME;CELL;CHARSET=UTF-8:6900000000 REV:20140313T085200Z END:VCARD ...   which is an aggregation of multiple VCARD s (starting...

Ever wanted to create a manual for you application? Well, instead of pressing the print screen button and then editing the captured screens you may use a few build-in tools of windows 7 to help you out. The first tool I would like to mention is the “Snipping Tool” (located in Accessories) which allows you to select the region you want to capture and then edit it. The second one is the amazing “Problem Steps Recorder” (psr.exe located in windows\system32 folder) which allows you to record the steps you do and writes a pretty nice tutorial for you. The only problem is that it takes full screen pictures, but you can always resize the screen resolution and hide the start menu bar. Hope this will help save a few hours from the nasty manual making job! ...read more

Σε μια από τις δουλειές που έχω αναλάβει με υποχρέωσαν να κάνω την ανάπτυξη της βάσης σε my sql. Αφού έψαξα διάφορα εργαλεία για να μπορέσω να σχεδιάσω την βάση σαν άνθρωπος, τελικά κατέληξα να εγκαθιστώ το MySQL Workbench . Ενώ το εργαλείο είναι αρκετά...

The last couple of days I’ve been coding with the Windows Identity Foundation (WIF) in order to create a WS Federation Security Token Service (STS) that provides the user authentication for multiple relying parties (RPs). I decided to write a small tutorial and a sample (full commented) project that describes the basic steps that are required in order to setup the authentication via passive federation. First of all you should start by downloading the Windows Identity Foundation (aka WIF) from Microsoft . This download provides all the necessary dlls (including System.IdentityModel and Microsoft.IdentityModel) to build a WIF claim based application. The second thing you have to do is download the Windows Identity Foundation SDK that integrates into visual studio and provides many helpful examples. This download provides the FedUtil.exe also known as Federation Utility that automatically configures the trust between an RP and an STS and also auto generates a custom STS based on your RP configuration...

Federation utility is a very nice little tool that can automatically configure your claim based web application (which is called Relying Party or RP in the Federation language) to trust an existing security token service (STS). It comes with WIF SDK available from Microsoft . This tool can also create a new STS based on your own claim based web application, but this is not on the scope of the current post. In order to establish the trust you’ll have to do the following steps: Right click on you project and select the “Add STS Reference…”. If you haven’t got the WIF SDK extensions installed on your computer, you may run the tool from C:\Program Files (x86)\Windows Identity Foundation SDK\v4.0\FedUtil.exe (removing the x86 on x32 operating systems). Fill in your RP application info and click next. On this stage you may face the following error (unless you have your website on a secure https layer): Locate the STS’s Federation Metadata xml file (usually located on http://sts-address/FederationMetadata...

I have just opened a new project on codeplex to host the source code of the Federation Metadata Editor I mentioned on my previous post . Check it out at http://stsmetadataeditor.codeplex.com/ ...read more

The last couple of days I have been working on Windows Identity Foundation. In order to take advantage of this framework, you should start writing claim based application. Forget the old fashion role based and start demanding claims! Why to convert to claim based application you may wonder... There are many reasons why you should do that but the most appealing ones I can think of are the following: Security granularity. You can demand specific claims from a user in order to do a specific action in your application. For example, imagine that you have a simple calendar application. You may demand a “read calendar” claim from the users in order to view the contents and request another “edit calendar entries” claim in order to edit the contents. By demanding claims, you don’t have to know the application’s roles a priory. You define the claims the user must have in order to access the specified code and when you finish, you may optionally associate the application roles to specific claims,...

Lately I’ve been having some requests on how to build openvpn 2.1.1 with enable-password-save. The truth is that a few things have changed since my last post . In order to fill these requests I decided to write down a few things about the process. If you are intrested in downloading an allready compiled version or openvpn 2.1.1 with enable-password-save, check out this post . Before you start, you should download the following source files from openvpn.net 2.1_rc22-prebuilt.tbz openvpn-2.1.1.zip openvpn_install_source-2.1beta7-gui-1.0.3.zip openvpn-gui-1.0.3.zip For the MinGW you should download binutils-2.20-1-mingw32-bin.tar.gz gcc-ada-3.4.5-20060117-3.tar.gz gcc-core-3.4.5-20060117-3.tar.gz gcc-g++-3.4.5-20060117-3.tar.gz gcc-g77-3.4.5-20060117-3.tar.gz gcc-java-3.4.5-20060117-3.tar.gz gcc-objc-3.4.5-20060117-3.tar.gz make-3.81-20090914-mingw32-bin.tar.gz MinGW-5.1.6.exe mingw.ini mingwrt-3.17-mingw32-dev.tar.gz mingwrt-3.17-mingw32-dll.tar.gz w32api-3.14-mingw32-dev.tar.gz and the following...

Are you tired of having ugly urls in your website like product.aspx?product=1? Are you concerned about having a search engine optimized web site? Asp.net provides the mean to easily rewrite your urls via the System.Web.Routing namespace. I have composed a simple asp.net website with lots of comments in it, that demonstrates this new (not so new actually because this mechanism exists since .net 3.5 sp1) mechanism. Download the source from the link below: The main benefits of this website are: User friendly urls like /product/1/My_First_Item Search engine optimization (no error in the SEO Toolkit ) Ease on url rewrite rules Things you should see: Global.asax.vb During the startup of our application we define the routes. This means that whenever you change the routes, you should close the webdev server in order to reinitiate the application. In the Application_Start you will find the use of RouteTable.Routes.MapPageRoute and its overloads which provides an easy way to defines routes, while...

The last couple of days I have been wondering in the magic world of Identity Federation. Although the windows identity foundation SDK provides a great tool to associate an RP (Relying Party) application with an existing STS (Security Token Service), it requires that the STS have a Federation metadata xml file. If you simply want to automatically generate the STS from the application, then the SDK provide the automatic STS generation on the right click of the RP website, which generates a new STS web site (in c#) based on the RP’s web config file. On the other hand, if you are up to creating a new custom STS without the RP, then you have to manually create the manifest file, which is really very frustrating! On my search around the net I found a couple of federation metadata file creators but none of them had the ability to edit an existing one. Unfortunately, I had to edit the manifest file quite often and thus I had to create a tool to do so. This is why I created the STS Federation Metadata...

I wanted to make windows autorun some application (like openvpn-gui and SQL 2005 Service Manager ) whenever I logged in in order to have them loaded in the tray. Placing them in the Startup folder would autostart them but I had to confirm both of them in the UAC (User Account Control) since they both run as administrator. In order to bypass this, I had to schedule them in the windows scheduler. In order to do so you must follow the following steps. Press the windows key and type “Task Scheduler” or any part of it to launch (by pressing enter when you have it selected in the results) Task Scheduler. In the actions menu on the right, click “Create task” In the “General” tab, you must specify the task’s name (which you will not be able to change once you have created the task) and you must also check the “Run with highest privileges” checkbox. This checkbox forces windows to run the application in a higher security context and the application doesn’t require the UAC verification. I also change...

I just moved a DNN ( DotNetNuke ) installation from a computer to another and restored the database in order to be able to work locally. DNN uses asp.net Membership as its default security provider thus I could not login to the web site (all passwords are encrypted using the local machine key). In order to override the password I wrote the following lines of code: Dim mu As MembershipUser = Membership.GetUser("MyUserName") mu.ChangePassword(mu.ResetPassword(), "mytoughpassword") In the default page’s init event. This is the way to programmatically change any membership account’s password. Happy codding and don't forget to delete the above mentioned lines after reseting the passwords! ...read more

Όσοι έχουν dual boot windows με Linux με boot loader το grub έχουν σίγουρα αντιμετωπίσει το φαινόμενο να μην ξεκινάει ο υπολογιστής και να πετάει κάποιο σφάλμα ο grub. Σε αυτές τις περιπτώσεις, μια επανεγκατάσταση του grub μπορεί να επιλύσει το πρόβλημα που αντιμετωπίζεται. Για αυτό μάζεψα παρακάτω τις οδηγίες που επιτυγχάνουν την επιδιόρθωση του boot sector. Windows 7 Σε περίπτωση που θέλετε να διώξετε τελείως τον grub και να ξεκινάνε τα windows 7 κατευθείαν, τότε τα βήματα έχουν ως εξής: Εκκινήστε τον υπολογιστή με το dvd εγκατάστασης των windows 7. Στην πρώτη οθόνη που θα εμφανιστεί, επιλέξτε τις ρυθμίσεις γλώσσας, ώρας και πληκτρολογίου που θέλετε και κάντε κλικ στο επόμενο. Σε αυτό το βήμα θα εμφανιστούν 3 επιλογές. Επιλέξτε "Repair Your Computer". Αυτή η επιλογή θα σας εμφανίσει το παράθυρο System Recovery. Επιλέξτε "Command Prompt" για να ανοίξει η κονσόλα επιδιόρθωσης. Εκτελέστε την εντολή "bootsect / NT60 C: \" αν είχατε τα Windows 7 εγκατεστημένα...

A couple of days ago, I received an email from VPNUK asking whether I could compile the latest openvpn ( 2.1.1 ) with save-password enabled and if I could make a setup that would include their pre-configured config files in the config folder. I accepted the challenge and not only did I build the latest version of openvpn with save-password enabled , I also modified the openvpn-gui application in order to provide the end users the means to set their connections’ credentials. In the beginning I added a new menu item that said “Change credentials…” but later on I decided to modify the build-in “Change password” menu item. The modified version will detect whether or not you have the auth-user-pass in you .ovpn file and if you have it, it will display the following dialogue: I also modified the installation a little bit in order to fix a couple of bugs (uninstalling while openvpn –gui is running etc) and add a few extra things (reboot at the end of the setup, autostart openvpn-gui etc). If you...

A few days ago, i noticed that i had in my language bar 5 language options, instead of 2 that i had configured for my English Windows 7. I checked it out and i had, for no obvious reason, Japanese (JP), Chinese (CH) and Korean (KO). I looked in my "Text Services and Input Languages" where i could only see the Greek and English keyboards that i had installed. Reboot didn't help so in order to get rid of them, i had to manually add them and after applying the changes i removed them. That worked for me and now i only have my original keyboard settings. I have no idea how i got them there in the first place... Just for reference, the steps where: Open "Text Services and Input Languages" Right click on the Language bar → Settings... OR Control Panel → Region and Language → Keyboards and Languages → Change Keyboards... Click Add... Select the Keyboards you want to add. In my case: Chinese (Simplified, PRC) → Chinese (Simplified) - US Keyboard Japanese (Japan) → Japanese...

Θέλετε να φτιάξετε το δικό σας λειτουργικό αλλά δεν θέλετε να μπλέξετε με C++; Κανένα πρόβλημα. Γράψτε τον κώδικα σας σε .net και φορτώστε το μέσα στο λειτουργικό Cosmos το οποίο δεν είναι τίποτα άλλο παρά ένα λειτουργικό που μεταφράζει il κώδικα σε machine...

Πριν από λίγα λεπτά άνοιξε επισήμως το download site για το πολύαναμενόμενο powerpivot για το Excel 2010 (aka Gemini)… Τι είναι το powerpivot; Αποτελεί ένα πολύ εξελιγμένο και παράλληλα τραγικά απλό reporting tool για οποιαδήποτε μορφή δεδομένων! Με αυτό...

Ξεκινάει σήμερα το ΙΤ συνέδριο SINERGIJA 09 της Microsoft στο Βελιγράδι της Σερβίας. Το ταξίδι ήταν πολύ καλό και η πόλη ακόμα καλύτερη. Τεράστιοι δρόμοι, τέλεια ρυμοτομημένη αστική περιοχή και άφθονο πράσινο είναι τα βασικά χαρακτηριστικά της άκρως φιλικής...

Αποφάσισα φέτος να κάνω μια σειρά από events που θα έχουν σαν στόχο να σας προετοιμάσουν για να κατεβείτε να δώσετε τις προγραμματιστικές εξετάσεις πιστοποίησης MCTS της Microsoft. Σε αυτή την σελίδα θα συγκεντρώνονται τα threads από τα διάφορα events...