Adam Tuliper's Development Stuff

VSLive is coming to Vegas!!!

2012-01-30T07:07:00.000-08:00

I'll be doing two sessions at VSLive Las Vegas
The popular "Hack Proofing your ASP.NET Applications" and
"Entity Framework 4.2 for Web Applications"

You'll get one on one time with me for any security or EF (or anything else for that matter) questions you might have as well.

Register with promo code VLSPK25 for some extra savings!!!

Visual Studio Live Las Vegas
Mirage Resort & Casino
March 26-30, 2012
Event web site: http://vslive.com/lasvegas

Visual Studio Live is five days of practical, Microsoft-supported training for developers to help solve your tough .NET development challenges. You'll find how-to advice and the tips and tricks that you'll be ready to implement as soon as you get back to the office. Our expert faculty - including many Microsoft instructors - makes each session interactive so you can discuss your particular development roadblocks and come away with actionable solutions.

Visual Studio Live Las Vegas offers in-depth training in:
Cloud Computing
Cross Platform Mobile
Data Management
HTML5
Silverlight / WPF
Visual Studio 2010+/.NET 4+
Web
Windows 8/WinRT
Windows Phone 7

Visual Studio Live Las Vegas – Expert Solutions for .NET Developers

Using Dependency Injection with MVC

2011-12-08T21:43:00.000-08:00

This is the code from the brief talk on Dependency Injection with MVC.
There are two projects here. This uses Unity, MVC3, and the UNity.MVC3 nuget package which has some additional code in it to handle lifetime management (ie objects that need disposal need special note in the bootstrapper.cs file.

IoC MVC Demos

Stop using MVC's ViewBag in most places, please!

2011-12-05T17:23:00.000-08:00

Even the built in templates give us support for ViewBag. The scaffolding templates create ViewBag.SomeEnumerable to use for our pages.
Sure - its quick code and since it's auto-generated will likely work ok. The problem comes in from the fact that ViewBag is a dynamic object. There are no compile time type checks. If you misspell something you won't be notified from the compiler.

I've seen this used in such bad ways, I would love to see it's usage curbed and applications cleaned up.

So in a controller:

ViewBag.SomeProperty = "10"

and in the view:

@ViewBag.Som3Pr0p3rty

We won't ever know of this error. It won't even generate a runtime error since the misspelled name just generated a null.

Use ViewModels and save yourself from these potential problems. Our templates set a page title in ViewBag as well.

There are several options in setting a page title. Since this is a well known property one could argue that using it just for Title is ok. I wouldn't argue this. There are other options.
1. Set it in a section in the layout and render it from the client.
2. Use ViewBag.Title
3. Use a filter (seems much too complicated for a title)
4. Use a Model.Title field.

Since by default we have a ViewBag.Title field created and our templates also get it by default, I'll yield that in this case, its ok.

What about select lists?
Rather than the default

 ViewBag.CustomerId = new SelectList(db.Customers, "CustomerId", "FirstName", order.CustomerId);

Do something like

yourViewModel.Customers = customers; //a loaded collection

and in your view

@Html.DropDownListFor(x => x.CustomerId, new SelectList(Model.Customers, "CustomerId", "Name"))

Or if you prefer to set your ViewModel to contain the SelectList

yourViewModel.Customers = new SelectList(db.Customers, "CustomerId", "Name", order.CustomerId);

and now your view would be slightly cleaner as:

@Html.DropDownListFor(x => x.CustomerId, x.Customers)

See, that's not so difficult now is it? Enjoy!

CodeCamp NYC Entity Framework / MVC code

2011-10-07T10:05:00.000-07:00

Thanks to all the attendees for a great event! Here is a link to the demo project used both for the MVC and Entity framework application. Some more advanced MVC samples are included in a prior posting in august, but for this demo everything is in the zip.
Files here - Note - Click 'download original' in the upper right hand corner once the view loads

Learning MVC for the Web Forms Developer - Code + Slides

2011-08-19T23:12:00.000-07:00

There was a slightly older version of this posted, here's the slides (and code projects) from the current user group presentation. This is a 7-zip file for reduced size (yes - every time 7-zip wins out over zip in my tests!)

Code and slides

Remote (Ajax) Validation in MVC3

2011-08-17T19:05:00.000-07:00

Code for sample app
Remote validation is a neat new feature in MVC3 that makes it easy to do AJAX validations. Why would you use these? Any time you don't want to use a full postback but must validate data on the server. How about two basic but common scenarios:
1. Ensuring a registered email address is unique
2. Checking if a login name is in use and in turn Recommending a login name for people to choose - as many systems currently do.

For example, this cheesy app that validates an email address does not equal "test@test.com"

It's quite easy to implement Remote Validation in MVC3. I would recommend getting it working in a small test project first and then migrating to your real project and make sure it works there.

1. I have this working with jQuery 1.4.4 IE ~/Scripts/jquery-1.4.4.min.js
2. Include the [Remote()] attribute on the property on your Model to point to the controller's method to call

        [RegularExpression(@"\w+([-+.']\w+)*@\w+([-.]\w+)*\.\w+([-.]\w+)*", ErrorMessage = "Please enter a valid e-mail address")]

        [Required()]

        [Display(Name = "Email Address")]

        [Remote("EmailAddressUsed", "Demo", ErrorMessage = "Email Address Already On File")]

        public string EmailAddress { get; set; }

Note here I specify a controller named "Demo" and a method in that controller named EmailAddressUsed. The ErrorMessage attribute above actually didn't work for me, not entirely sure why so I'm returning a message from inside my controller method.

3. The validation fires upon leaving focus (blur) on the form element.
4. Return a Json result from your controller code. Return true if valid, otherwise I'm returning a validation message here.

public JsonResult EmailAddressUsed(string emailAddress)

{

    if (emailAddress == "test@test.com")

    {

        return Json(emailAddress + " is already in use.", JsonRequestBehavior.AllowGet);

    }

    else

    {

        return Json(true, JsonRequestBehavior.AllowGet);

    }

}

That's all there is to it to get up and running: jQuery, controller method, attribute on the model.
Enjoy!!

Finally HtmlEncoding syntax is coming to the databinding tag

2011-06-08T10:45:00.000-07:00

In ASP.Net 4 MVC and WebForms, we currently have these two methods for automatically HtmlEncoding output without having to call HttpUtility.HtmlEncode(xxx)

1. @ (Mvc 3 Razor syntax)
2. <%: which both automatically html encode the output to help prevent against XSS (Cross Site Scripting) attacks. This was lacking for data binding syntax for example:



<%# Eval("FirstName") %>

This above syntax had no html encoding and you specifically had to call it

<%# HttpUtility.HtmlEncode((string)Eval("FirstName")) %>

In the future you will be able to just:

<%#: Eval("FirstName") %>

This new syntax will be available in the next version of asp.net (4.1?)

Tech Ed Atlanta 2011 - Hack Proofing your ASP.Net MVC and WebForms Applications

2011-06-07T07:11:00.000-07:00

We had a great time at tech ed this year!!
My session on hack proofing is now online - check it out at:
http://channel9.msdn.com/Events/TechEd/NorthAmerica/2011/DEV333

If you watch it, please give it a rating so I know that you enjoyed it : )

MVC - Using Views outside of /Views or other content in /Views

2011-06-03T08:29:00.000-07:00

I learned something new recently regarding this subject.
First - to use a View outside of the /Views folder you must put a copy of your web.config from /Views into your new folder. It's that simple.

Secondly - Views by default won't allow other content in them. If you drop a css file in the /Views folder and reference it via http://localhost/views/test.css you will get a 404 file not found error.

If we look in the web.config inside of our views, we have:

<system.web>
    <httpHandlers>
      <add path="*" verb="*" type="System.Web.HttpNotFoundHandler"/>
    </httpHandlers>

This essentially says make any item referenced in /Views (from path="*") a 404 status code - hence file not found. This means you can't address css files, jpegs, etc. - anything inside of /Views.
The workaround is easy though. Simply change the defined handler to exclude ONLY *.cshtml (hence views)

Ideally we probably want to exclude *.cshtml and *.aspx in case we have any web forms view engine code. Unfortunately IIS6 and IIS7 have different syntax here. Changing the web.config in the /Views folder we have:

IIS6:

<system.web>
    <httpHandlers>
      <add path="*.cshtml,*.aspx" verb="*" type="System.Web.HttpNotFoundHandler" />
    </httpHandlers>
  </system.web>

In IIS7:

<system.webServer>
    <handlers>
      <add name="ExcludeRazorViews" path="*.cshtml" verb="*" type="System.Web.HttpNotFoundHandler" />
      <add name="ExcludeWebFormsViews" path="*.aspx" verb="*" type="System.Web.HttpNotFoundHandler" />
    </handlers>
  </system.webServer>

Note also that the web.config in the /Views folder also contains this one as well at the bottom you'll need to watch out for that is provided for IIS 7 compatibility:

    <handlers>
      <remove name="BlockViewHandler"/>
      <add name="BlockViewHandler" path="*" verb="*" preCondition="integratedMode" type="System.Web.HttpNotFoundHandler" />
    </handlers>

Learning MVC for the Web Forms Developer - Code + Slides

2011-04-23T21:44:00.000-07:00

Download code and slides here

Note the file is ~25MB because of the size of the embedded databases. Unzipped around 60MB or so for all of the projects (again mostly because of the databases)

Let me know if you have any problems setting it up. The first couple slides contain some notes on the projects.

Thanks for attending!!!

I realize it was a _ton_ of information to throw at you. This could easily have been turned into a 4+ hour talk but there's a reason I put all of that in this talk. If you are new to MVC it makes it even more difficult, but I feel these are all areas important to getting up and running effectively on MVC. Where to start if you are new? Create a new mvc 3 project. Now go through the slides and create each item. Create a route. Create a model, a controller, a view. Then save data using the PRG pattern. Then try to load some data into a div via an ajax call or even just an ajax form using @Ajax.BeginForm. This will get you off to a nice start - just let me know if you have any questions - I'll try to steer you in the right direction : )

Entity Framework Error - The relationship '{0}' was not loaded because the type '{1}' is not available.

2011-04-23T17:30:00.000-07:00

I had changed an applications data architecture slightly and instead of going to a network Sql Server instance, I decided to use the App_Data folder to make this application distribute a bit easier for demo purposes.

This error was caused because my connect string wasn't correct to the database. The connect strings for App_Data databases use a local path to attach to a database file such as:
AttachDbFilename=|DataDirectory|\MyDatabase.mdb

I thought my connect string was correct in the web.config of the application that used my data access layer and the error doesn't of course tell me anything is wrong with my connect string, but I figured I'd give it a try.

In order to properly reference my database in _another project_ I needed the dialog to give me the connect string to make sure it was all 100% ok, and then I just would edit the db path to be relative from the absolute path the dialog displays. So - I went back into my data access project and selected to add a new entity framework model. When the dialog came up, I simply copied the app_data database connectstring and then canceled out of the dialog and updated my other project's web.config:

Schema specified is not valid. Errors:
The relationship 'NASA.FK_Booster_Catalog' was not loaded because the type 'NASA.Catalog' is not available.
Exception Details: System.Data.MetadataException: Schema specified is not valid. Errors:
The following information may be useful in resolving the previous error:
The required property 'Password' does not exist on the type 'NASA.DataAccess.Models.Catalog'.

Description: An unhandled exception occurred during the execution of the current web request. Please review the stack trace for more information about the error and where it originated in the code.

The required property 'Password' does not exist on the type 'WebStore.DataAccess.Models.Customer'.

Source Error:

Line 69: public ObjectSet Products
Line 70: {
Line 71: get { return _catalogs ?? (_catalogs = CreateObjectSet("Catalogs")); }
Line 72: }
Line 73: private ObjectSet _catalogs;

Stack Trace:

System.Data.Metadata.Edm.ObjectItemCollection.LoadAssemblyFromCache(ObjectItemCollection objectItemCollection, Assembly assembly, Boolean loadReferencedAssemblies, EdmItemCollection edmItemCollection, Action`1 logLoadMessage) +480
System.Data.Metadata.Edm.ObjectItemCollection.ImplicitLoadAssemblyForType(Type type, EdmItemCollection edmItemCollection) +84
System.Data.Metadata.Edm.MetadataWorkspace.ImplicitLoadAssemblyForType(Type type, Assembly callingAssembly) +151
System.Data.Objects.ObjectContext.GetTypeUsage(Type entityCLRType) +35
System.Data.Objects.ObjectContext.GetEntitySetForNameAndType(String entitySetName, Type entityCLRType, String exceptionParameterName) +33
System.Data.Objects.ObjectContext.CreateObjectSet(String entitySetName) +66
..
..
..

I finally joined 2011 and created my twitter account

2011-04-23T10:08:00.000-07:00

My twitter account is @AdamTuliper - I feel so 'modern' : ) Stay tuned for various links, updates, tech ed info, etc!

MVC MVC MVC

2011-04-22T06:46:00.000-07:00

Its been a busy couple weeks!! Presentations in NYC, Philly, CT, and now Tech Ed Atlanta coming up. For those that attended the MVC presentation on "Learning MVC for the Web Forms Developer" - Thanks! I'll be posting the code and slides shortly, I just need to make sure the projects don't just work on my machine and are easy for you to setup - including database access. Please check back shortly, hopefully this weekend I'll have everything up there.

A special thanks to the guys that took me out after last nights Manhattan presentation for a couple brews : )

R.I.P. To our friend, The Free Version of Reflector

2011-03-11T15:03:00.000-08:00

Reflector is one of the best tools every invented and unfortunately is no longer free. If this was a brand new product, I would have no issue paying the mere $35 for it - however this tool has _always_ been free. Red Gate bought this tool a couple years ago and as of this month it is no longer free. OK - so run the older version. Well - it deletes itself.

So this shows a bit of premeditation built into their software that they would one day delete this from people's systems. I have a problem with this. A free tool is a FREE tool. Not 'free until we decide to make you pay and delete the free version you had'. I don't feel this is correct in any way.

With that said if the Pro version of this tool was $35 with built in debugging for compiled assemblies, I would think that would be a great deal. Alas, we are paying $35 to regain what we already had in this tool.

This practice has made quite a few people angry. I love Red Gate's products, but I really believe they went about this the wrong way by deleting free software installed on our machines.

I now will be recommending ILSpy. An open source program that started development when Red Gate announced they would be charging for Reflector.

http://wiki.sharpdevelop.net/ilspy.ashx

Is it as good as reflector? No. Is it free? Yes!

The WRONG way to use stored procedure calls

2011-02-28T18:23:00.000-08:00

Stored procedures are an excellent way to prevent sql injection attacks. However they must be called using parameters, and in addition, using parameters _correctly_.
The following is an example of how NOT to call a stored procedure.

We start with the following procedure

Create Procedure Proc_GetUser
@userId int
AS
Select UserName, Password From User Where UserId = @userId 
GO

And the following code call

using (SqlCommand command = new SqlCommand("proc_GetUser(@UserId='" + userId.ToString() + "')", ctx.Connection))
{
    SqlDataReader dataReader = command.ExecuteReader();
    //use data reader here..
    //...
}

What is wrong with this? It uses a named parameter, isn't that OK?

Nope.

I've seen this done in production applications, and it is susceptible to sql injection. If an attacker sets UserId to something like:
nobody');EVILSQL;print ('
This makes our sql statment now

Proc_GetUser(@UserId='nobody');EVILSQL; print ('')

They have just executed the first call and then the second batch of "EVILSQL" and have successfully closed off your query with "print('" to form "print('')" which then does nothing.

The correct way to do this is as follows:

using (SqlCommand command = new SqlCommand("Proc_GetUser", ctx.Connection))
{
    command.CommandType = System.Data.CommandType.StoredProcedure;
    command.Parameters.AddWithValue("@UserId", userId);
    SqlDataReader dataReader = command.ExecuteReader();
    //use data reader here..
    //...
}

Unobstrusive Javascript in MVC 3 helps clean up your forms

2011-02-28T18:03:00.000-08:00

A great new feature in MVC 3 is unobstrusive javascript. This uses the magic of jQuery to hook attributes on your page without injecting a bunch of javascript into your forms as was done before.

To enable it, simply add this to your web.config

<configuration>
<appSettings>
<add key="UnobtrusiveJavaScriptEnabled" value="true"/>
</appSettings>
</configuration>

This makes ajax form submission code extremely easy. If you've ever tried to debug why a form wasn't submitted because of the emitted javascript from Ajax.BeginForm, you'll be happy to know your forms now are so much more readable.

We'll discuss the various options available shortly, but let's explain this from the beginning. If you want this all to happen automagically, you don't need to do anything but include the scripts (mentioned below), use mvc 3, and continue to use Ajax.BeginForm. The 'javascript-less' form tag will be emitted. If you want to do this manually, you enable your forms by including data-ajax="true" such as:
<form data-ajax="true" ...>

The inclusion of data-ajax="true" is where the magic comes into play.

In the unobtrusive jQuery library (jQuery.unobtrusive-ajax.js), we see this piece of code below that finds certain elements with data-ajax="true" and hooks them using the .live() method of jQuery. This methods hooks anything that exists in the DOM now and anything that is dynamically created in the DOM later via code.

//A HREF links hooked
$("a[data-ajax=true]").live("click", function (evt) {
evt.preventDefault();
asyncRequest(this, {
url: this.href,
type: "GET",
data: []
});
});

//images hooked inside a form
$("form[data-ajax=true] input[type=image]").live("click", function (evt) {
var name = evt.target.name,
$target = $(evt.target),
form = $target.parents("form")[0],
offset = $target.offset();

$(form).data(data_click, [
{ name: name + ".x", value: Math.round(evt.pageX - offset.left) },
{ name: name + ".y", value: Math.round(evt.pageY - offset.top) }
]);

setTimeout(function () {
$(form).removeData(data_click);
}, 0);
});

//Form submit function hooked
$("form[data-ajax=true] :submit").live("click", function (evt) {
var name = evt.target.name,
form = $(evt.target).parents("form")[0];

$(form).data(data_click, name ? [{ name: name, value: evt.target.value }] : []);

setTimeout(function () {
$(form).removeData(data_click);
}, 0);
});

//Form hooked
$("form[data-ajax=true]").live("submit", function (evt) {
var clickInfo = $(this).data(data_click) || [];
evt.preventDefault();
if (!validate(this)) {
return;
}
asyncRequest(this, {
url: this.action,
type: this.method || "GET",
data: clickInfo.concat($(this).serializeArray())
});
});

So, using this we no longer have to use code like such (but WE CAN still use this syntax if you want, as long as unobtrusive javascript is enabled in the web.config, the new form syntax will automatically be emitted):

<% using (Ajax.BeginForm("Index", "Customer", new AjaxOptions { UpdateTargetId = "customerArea", LoadingElementId = "customerWaitImage", OnFailure="ajaxCustomerFailed", OnSuccess="ajaxCustomerSuccess" } )) { %>
..
..
<%}%>

We can now simply

<form data-ajax="true" data-ajax-failure="ajaxCustomerFailed" data-ajax-success="ajaxCustomerSuccess" data-ajax-update="customerArea" data-ajax-loading="customerWaitImage" data-ajax-method="Post" >
...
..
</form>

Its very readable, requires no inline code, and renders with no javascript emitted to the page. You must make sure though you

1. Set the mentioned flag in the web.config: <add key="UnobtrusiveJavaScriptEnabled" value="true"/>
2. Include a reference to the jQuery library ~/Scripts/jquery-1.4.4.js
3. Include a reference to the library that hooks this magic at ~/Scripts/jquery.unobtrusive-ajax.js

If you do not have the script reference, note - the form will do a full post as opposed to an ajax post.

The options that are supported map directly from what was available in Ajax.BeginForm's AjaxOptions. The only reference I could find was the table I included below from Brad Wilson's blog, it doesn't seem as though Microsoft has the documentation available at the moment of this writing.

AjaxOptions	HTML attribute
Confirm	data-ajax-confirm
HttpMethod	data-ajax-method
InsertionMode	data-ajax-mode *
LoadingElementDuration	data-ajax-loading-duration **
LoadingElementId	data-ajax-loading
OnBegin	data-ajax-begin
OnComplete	data-ajax-complete
OnFailure	data-ajax-failure
OnSuccess	data-ajax-success
UpdateTargetId	data-ajax-update
Url	data-ajax-url

Again, remember - you can get the benefit of this by doing this manually in your form element, or simply continue using Ajax.BeginForm with unobtrusive javascsript enabled in the web.config and you will get the benefits of this new form syntax.

@using (Ajax.BeginForm("ControllerMethod", "ControllerName", new AjaxOptions() { LoadingElementId="loadingImage", OnSuccess = "success", OnFailure = "error", UpdateTargetId = "testDialog", InsertionMode = InsertionMode.Replace })){
<div id="testDialog">
</div>
}

A couple of extras - if you want to disable validation for a particular button you need to call


$("#myinput").rules("remove");

See
jQuery rules remove
for more details

Secondly, if you want to check via script if the form is valid you can check onsubmit (or other functions) easily as follows:


$(function () 
{
  $('#yourForm').submit(
        function () {
                 if(!$(this).valid()) {
                                       //form is not valid         
                                      }     
                     }); 
});

Enjoy - I love this new feature especially when trying to debug ajax partial views as it makes my life easier : )

Converting MVC 2.0 projects to MVC 3 (Razor)

2011-02-26T20:59:00.000-08:00

Microsoft has outlined the steps to convert a project from MVC 2 to 3 here:

Upgrading an ASP.NET MVC 2 Project to ASP.NET MVC 3

You also have the option of using a tool to do this, see
ASP.NET MVC 3 Application Upgrader

It may be easiest to simply import all your files into the new project and migrate each web.config section over. However - if you do decide to convert your projects over there are two additional things to keep in mind.

After upgrading you should
1. Be aware that keeping the existing binding redirect that exists in 2.0 projects to force all 1.x-2.0 System.Web.MVC libraries to bind to MVC 2.0 can cause your worker process to crash. This was in 2.0 projects by default. You MUST remove this (replace it with a binding to 3.0 and not 2.0)


<runtime>
    <assemblyBinding xmlns="urn:schemas-microsoft-com:asm.v1">
      <dependentAssembly>
        <assemblyIdentity name="System.Web.Mvc" publicKeyToken="31bf3856ad364e35" />
        <bindingRedirect oldVersion="2.0.0.0" newVersion="2.0.0.0" />
      </dependentAssembly>
    </assemblyBinding>
  </runtime>

You should _replace_ it with the following


<runtime>
    <assemblyBinding
  xmlns="urn:schemas-microsoft-com:asm.v1">
      <dependentAssembly>
        <assemblyIdentity
      name="System.Web.Mvc"

      publicKeyToken="31bf3856ad364e35"/>
        <bindingRedirect
      oldVersion="1.0.0.0-2.0.0.0" newVersion="3.0.0.0"/>
      </dependentAssembly>
    </assemblyBinding>
  </runtime>

2. Let's say all of my views use the MVCContrib grid and the Microsoft Futures or other features. Rather than having import statements on all of your razor views such as:


@using MvcContrib.UI.Grid;
@using Microsoft.Web.Mvc

You can simply include these imports in the web.config as you can with web forms projects, but the section to include them is different for mvc 3.

first add this to the <configuration><configSections> section


 <sectionGroup name="system.web.webPages.razor" type="System.Web.WebPages.Razor.Configuration.RazorWebSectionGroup, System.Web.WebPages.Razor, Version=1.0.0.0, Culture=neutral, PublicKeyToken=31BF3856AD364E35">
      <section name="host" type="System.Web.WebPages.Razor.Configuration.HostSection, System.Web.WebPages.Razor, Version=1.0.0.0, Culture=neutral, PublicKeyToken=31BF3856AD364E35" requirePermission="false" />
      <section name="pages" type="System.Web.WebPages.Razor.Configuration.RazorPagesSection, System.Web.WebPages.Razor, Version=1.0.0.0, Culture=neutral, PublicKeyToken=31BF3856AD364E35" requirePermission="false" />
    </sectionGroup>

Now add this section under your <configuration>


  <system.web.webPages.razor>
    <pages pageBaseType="System.Web.Mvc.WebViewPage">
      <namespaces>
        <add namespace="MvcContrib.UI.Grid" />
        <add namespace="Microsoft.Web.Mvc" />
      </namespaces>
    </pages>
  </system.web.webPages.razor>

See it all here:

Status Message Handling in MVC

2010-12-13T21:03:00.001-08:00

Here's a quick method I use to handle status messages in MVC. It uses an extension method. This means when you use Intellisense on TempData or ViewData, this method will appear as TempData.AddStatusMessage or ViewData.AddStatusMessage.

The problem to solve here is after we save a user, we want to display something like 'User Saved', but since good MVC design practices dictate using the PRG pattern (Post/Redirect/Get), GET requests do not lend themselves nicely to status messages and thus we have a problem.

Remember that we cannot simply set a label from a code behind as may be done in Asp.Net Web Forms. We need another way to accomplish this in the scope of MVC.

I go not recommend using a parameter as a status message as it gives a direct attack vector into your application from a security standpoint. A user can do something along the lines of
/Users/Index?status=

Yes - you can help prevent this by encoding the message before displaying, but why even open up the possibility when there are other ways to accomplish this.

So let's have these requirements:
1. Any code in a controller can add a status message (pages cannot add status messages via this mechanism in my design since the data for the view should already be formed. anything else can use conditional view logic on the page)
2. Status messages can be for the current request (for example, when a post request fails and needs to redisplay data immediately without a redirect)
3. Status messages can be for the next request (IE the GET portion of the Post/Redirect/Get pattern, for ex. 'User Saved Successfully'

To use this code, simply put the following code in your Site.Master (or any page the results should be rendered to)


<%= ViewData.GetMessageSummary()%><br />
<%= TempData.GetMessageSummary()%><br />

To add a message to tempdata, so it will show up on the next request only (as this is how TempData works)


TempData.AddStatusMessage("User Saved Successfully");

To add a message that is displayed when the current request is rendered


ViewData.AddStatusMessage("Please fix the errors below");

The code is as follows


    public static class ViewDataExtensions
    {
        /// <summary>
        /// Gets the status messages from TempData and ViewData.
        /// When this is called, the status messages are cleared.
        /// </summary>
        /// <param name="viewData"></param>
        /// <param name="message"></param>
        public static string GetMessageSummary(this IDictionary<string, object> viewData)
        {

            //</div>", 
            //<label style="background-color: <%:  ViewData["JobStatusMessageColor"] %>">
            //<%: ViewData["StatusMessage"]%></label>

            List<string> messageItems = (List<string>)viewData["StatusMessages"];
            if (messageItems != null)
            {
                StringBuilder sb = new StringBuilder();
                sb.Append("<br><div class=\"status-message\">\r\n<ul>");

                foreach (string item in messageItems)
                {
                    sb.Append(string.Format("<li>{0}</li>\r\n", item));
                }
                sb.Append("</ul>\r\n</div>");
                return sb.ToString();
            }
            //Im assuming internally this is thread safe since its ViewData or TempData being used. it could be false but going with that for now : )
            viewData.Remove("StatusMessages");
            return "";
        }


        /// <summary>
        /// Adds a status message to ViewData, meant to be displayed on the _current_ request
        /// </summary>
        /// <param name="viewData">Since this is an extension method, this operates on TempData.AddStatusMessage</param>
        /// <param name="message">The message to be added to the collection</param>
        public static void AddStatusMessage(this ViewDataDictionary viewData, string message)
        {
            AddStatusMessageToDictionary(viewData, message);
        }
        
        /// <summary>
        /// Adds a status message to TempDate, meant to be displayed on the very _next_ request.
        /// </summary>
        /// <param name="viewData">Since this is an extension method, this operates on TempData.AddStatusMessage</param>
        /// <param name="message">The message to be added to the collection</param>
        public static void AddStatusMessage(this TempDataDictionary viewData , string message)
        {
            AddStatusMessageToDictionary(viewData, message);
        }


        /// <summary>
        /// Adds a message to be displayed to the user. This works with ViewData and TempData
        /// </summary>
        /// <param name="viewData"></param>
        /// <param name="message"></param>
        private static void AddStatusMessageToDictionary(this IDictionary<string, object> viewData, string message)
        {
            List<string> messageItems;
            if (viewData.ContainsKey("StatusMessages"))
            {

                messageItems = (List<string>)viewData["StatusMessages"];
            }
            else
            {
                messageItems = new List<string>(5);
                viewData["StatusMessages"] = messageItems;
            }

            messageItems.Add(message);

        }


    }

Logging in and Authentication Providers in MVC

2010-10-27T20:08:00.000-07:00

First let me state there is no login control in an MVC application. You CAN use one - since you can use ASPX pages and controls in an MVC application. However, if you want to use 'pure' MVC and no Web Forms controls then you should do it the way the Visual Studio MVC template does it.

By default MVC creates a new web application that follows the following methods for logging a user on:
The master page contains a user control which if Request.IsAuthenticated, displays a logoff link, otherwise a login link.

The login view is rendered when the user clicks on the login link.
Upon filling out the details and clicking to submit the login page, the following actions happen:

1. We have a model containing a username, password, and 'remember me' being posted and passed to the LogOnMethod via this signature


public ActionResult LogOn(LogOnModel model, string returnUrl)

2. This model posts to the AccountController
3. The LogOn method validates the model: if (ModelState.IsValid)
4. The LogOn method checks the user against the profile provider: MembershipService.ValidateUser(model.UserName, model.Password)
5. The LogOn method then calls: FormsService.SignIn(model.UserName, model.RememberMe);

The same happens for 'Register'. If you do NOT want any user to be able to be registered, then REMOVE THE REGISTER METHOD or - add security to it such as a SystemAdministrators role:


[Authorize( Roles="SystemAdministrators")]
[HttpPost]
public ActionResult Register(RegisterModel model)
{}

Code Camp Slides and Code

2010-10-11T18:25:00.001-07:00

See the attached zip. Email me if you have any questions.
Some of the 'fixes' are already in place from the live demo so not all of the code is still 'broke', so please investigate. Please read the directions at the bottom of the first slide as to which virtual directories should go where.

Slides and Code (about 10mb)

Code Camp 2010 - Hack Proofing your ASP.Net and MVC Web Applications

2010-10-11T09:22:00.000-07:00

The event was a great day indeed at Devry. If you saw my presentation there.. please rate it at:

Evaluations

The evaluations are an important part of code camp. I hope you liked my presentation : )

I will be posting all of the code and slides very shortly, just converting my foot notes to make more sense to others.

Thanks!!!

ASP.NET/MVC/Entity Framework Error "Unable to load type....required for deserialization."

2010-09-05T22:10:00.001-07:00

Issue: Once you compile a change in your application and run it again you can receive this error, usually upon a post to a page:

Unable to load type System.Data.Entity.DynamicProxies.ClassName_A1398804A2AD2636A55B88C252D769E3468A12F2C5A773B1895C58D312108335 required for deserialization.

Or:

Unable to find assembly 'EntityFrameworkDynamicProxies-XXXX, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null'.

What is happening here is that you are likely using POCO objects for the Entity Framework. These objects have proxy classes automatically generated for them behind the scenes. Upon a first visit to the application they are compiled, however if they are used in a post (for instance when posting data to an MVC Action) and that type is used in serialization then they have not yet been created.

Your code may look like:
[HttpPost]
public ActionResult Edit(Job job, [Deserialize] List someClasses)

When you post to this, the framework will NOT create the proxies automatically. You must access the page via a normal manner (ie via HttpGet) and the proxies will all be created. If you must have this feature, then you may possibly be able to do something in Application_Start to reference an Entity class and thus all of them should be auto generated.

In short - this fix is simply refresh the page. If posting to the page requires deserializing POCO objects from the page, then you will need to implement some mechanism to use the POCO Entities before the method is attempted, possibly in Application_Start.

Changing log4net configuration parameters at runtime

2010-05-24T09:22:00.000-07:00

Since most of log4net configuration is specified in your application's configuration a question does come up on occasion how may I change this at runtime, depending on the user, etc.
Changing parameters at runtime for log4net is fairly simple - see the following code sample:


        /// 
        /// SMTP Appender custom configuration
        /// 

        public void InitializeLog4Net()
        {
            //We need access to the repositories for the loggers
            ILoggerRepository repository = LogManager.GetRepository();
            
            //Get only SmtpAppenders
            //can do it as such:
            //var appenders = repository.GetAppenders().Where(o => o is SmtpAppender).Select(o => (SmtpAppender)o);

            //Or a bit more readable
            var appenders= from o in repository.GetAppenders()
                      where o is SmtpAppender
                      select (SmtpAppender)o;

            foreach (SmtpAppender smtpAppender in appenders)
            {
                smtpAppender.To = "adam_tuliper@nowhere";
                //Make this config change active immediately
                smtpAppender.ActivateOptions();
            }
        }

Setting up RESTful services in Windows XP

2010-05-22T09:12:00.000-07:00

If you chance you haven't upgraded or your company still requires XP usage and skipped Vista and is waiting on Windows 7 - you may need to get WCF and RESTful services working together. **Really this applies to any dynamic routing required - it could be pure WCF as well and anything that uses a RouteTable class such as

RouteTable.Routes.Add(new ServiceRoute("YourFriendlyURLPortion", new WebServiceHostFactory(), typeof(CustomerSearch)));

Once you have your project you will need to do the following:
1. Configure IIS to use .net 4 - go into the properties of your virtual directory and then the ASP.Net tab.

2. Setup a global mapping so ALL files get routed to ASP.Net
Right Click on the virtual directory, go to properties, and then to the Virtual Directory tab. Then click on the Configuration button. You will need to map ALL files to your .net 4 isapi dll. Since IIS 5.1 does not have integrated pipeline for .net, ASP.Net sits on top of IIS via an isapi extension.
Select "All Verbs" (or whatever ones you require if you are limiting to say.. only GET/PUT although that violates RESTful design if you also need delete and update operations which require DELETE and PUT verbs)

I have my isapi dll set to:
C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\aspnet_isapi.dll
In the following image you will see the setup. You must specify .* for the extension (not *.*) otherwise your "OK" button will never enable.

Reset IIS then attempt to go to your service url/help and see if you get the nice new RESTFUL service web page.

Why don't I see my JSON RESTful response in the browser?

2010-05-22T06:48:00.001-07:00

When testing RESTful services, one common option is to use JSON (Javascript Object Notation) which can significantly decrease the size of the service response. As we
A quick note on unexpected behavior (at first) when request the SAME url through different means.
If I request to get customer 1:
http://localhost/CustomerSearch/1
GET /CustomerSearch/1 HTTP/1.1


Host: localhost.:1046
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.1.9) Gecko/20100315 Firefox/3.5.9 (.NET CLR 3.5.30729)
Accept: application/json, text/javascript, */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 300
Connection: keep-alive
Referer: http://localhost:2592/
Origin: http://localhost:2592

My response is indeed JSON


HTTP/1.1 200 OK
Server: ASP.NET Development Server/10.0.0.0
Date: Sat, 22 May 2010 06:12:06 GMT
X-AspNet-Version: 4.0.30319
Content-Length: 153
Cache-Control: private
Content-Type: application/json; charset=utf-8
Connection: Close

{"DateOfHire":"\/Date(1072933200000-0500)\/","EmployeeId":"dd98655a-8706-4b2f-b648-874079015295","FirstName":"Jane","LastName":"Doe","SSN":"123-45-6789"}

If my request url stays the same, but I change my Accept: header, I no longer get JSON back but instead xml:



GET /CustomerSearch/1 HTTP/1.1
Host: localhost.:1046
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.1.9) Gecko/20100315 Firefox/3.5.9 (.NET CLR 3.5.30729)
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 300
Connection: keep-alive
Cookie: ASP.NET_SessionId=yypfhriihodesh553qpmaam4


HTTP/1.1 200 OK
Server: ASP.NET Development Server/10.0.0.0
Date: Sat, 22 May 2010 06:12:06 GMT
X-AspNet-Version: 4.0.30319
Content-Length: 153
Cache-Control: private
Content-Type: application/json; charset=utf-8
Connection: Close

My response is indeed JSON
{"DateOfHire":"\/Date(1072933200000-0500)\/","EmployeeId":"dd98655a-8706-4b2f-b648-874079015295","FirstName":"Jane","LastName":"Doe","SSN":"123-45-6789"}

So what is going on here?
In one case Im request via the browser and I get xml back. In the other case I request via jQuery:
$.getJSON

which happily sends over

Accept: application/json, text/javascript, */*

Eliminating delegates in threading

2010-05-15T10:19:00.001-07:00

Just a quick note on threading. One way to start a new thread with parameters was the following:


Thread processingThread = new Thread(new ThreadStart(delegate { someClass.SomeMethod(); }));

processingThread.Start();

One can do the same thing with a lambda expression which in my opinion is a bit cleaner. Why? I don't know - personal preference - I seem to remember lambda syntax more often : )


               Thread workerThread = new Thread(
                ()=> someClass.SomeMethod()(employeeId)
                                       );
                workerThread.Start();

Or doing this inline with the start right away:


            (new Thread(() =>
            {
                someClass.SomeMethod()(employeeId)

            }
            )).Start();

That's all there is to it. Remember in Win32 API when creating threads, and security descriptors, etc? Its so nice and easy in the managed world.

Quick way to cross thread invoke

2010-04-26T18:28:00.000-07:00

In windows forms, everything is still single threaded. If you've ever tried to use multiple threads and various controls (form timers for example - the non thread safe kind) you will realize properties start disappearing because they all use TLS (Thread Local Storage) which of course - is thread specific. You must set properties and call events on the thread that created the control. You can cross post messages into another app's message queue (which interestingly enough was the source of the 'shatter' attack some years ago allowing attacking applications to take control of other apps by malformed wm_timer message) without a problem but that's a bit more rare now in managed code than it was in native code days.

If you need to set a property or call a method on a control from a worker thread in you needed to create a delegate. The syntax was sometimes a pain.

To easily call this without a 'outside' (ie in class declarations as was typical) setup of the delegates
simply call it directly by creating a delegate inline using an anonymous method or lambda expression. Either one works - it's your preference on syntax:


yourControl.Invoke((MethodInvoker)delegate() {  yourControl.Value=0; });

//Or

yourControl.Invoke((Action) ( () => yourControl.Value=0));

What does this save?
1. You don't have to create a separate method.
2. You don't have to declare a separate delegate.

So let's say you wanted to increase the count on a progess bar from a worker thread, you could simply do (off the top of my head.. I believe the invoke needs to be called on the container StatusStrip control) :


statusBar.Invoke((MethodInvoker)delegate() {  progressBar.Increment(1); });

Hope this helps - I use it quite frequently. Of course, please don't sprinkle the same line all over your code, wrap it in a method call in case you need to change it.

Animating the Visibility Property in Silverlight

2010-04-26T18:13:00.001-07:00

Problem
If you define an animation in silverlight and try to animate the Visibility property (IE to hide or show an element on animation with other effects) it does not work. You will fine when you set the Visibility property it stays the entire animation and doesn't change.

Cause
If you are animating your properties, chances are you are using a double animation, which handles, you guessed it - double values. Visibility is not a double value. Its a specific enumeration value that requires in XAML the text name of the enum value.

Resolutions
In your animation simply add


<Storyboard x:Name="closeControl">
<ObjectAnimationUsingKeyFrames BeginTime="00:00:00" Storyboard.TargetName="controlToAnimate" Storyboard.TargetProperty="(UIElement.Visibility)">
    <DiscreteObjectKeyFrame KeyTime="00:00:00">
        <DiscreteObjectKeyFrame.Value>
            <Visibility>Visible</Visibility>
        </DiscreteObjectKeyFrame.Value>
    </DiscreteObjectKeyFrame>
    <DiscreteObjectKeyFrame KeyTime="00:00:02">
        <DiscreteObjectKeyFrame.Value>
            <Visibility>Collapsed</Visibility>
        </DiscreteObjectKeyFrame.Value>
    </DiscreteObjectKeyFrame>
</ObjectAnimationUsingKeyFrames>
<DoubleAnimationUsingKeyFrames>
...
</DoubleAnimationUsingKeyFrames>
</Storyboard>

I included a placeholder there for a double animation to show this XAML simply goes on top of your existing DoubleAnimation.

The Dangers of Internet Explorer Mime-Type Sniffing

2010-04-23T11:57:00.000-07:00

Internet explorer 4+ has a unique feature called Mime-Type sniffing. It sometimes doesn't pay attention to the extension of your file, but instead wants to determine what kind of file it is for itself. This can be easily exploited via various sites that allow images to be uploaded and provide links to those images.

If the first few bytes of an image file are changed - say.. after bytes 12, to
<script>alert('bip');</script>
Internet Explorer now thinks this is content type text/html and not image/gif.
So if you were to click on a link to this image you would run whatever script was there in your browser.

Thanksfully, mime type detection for images has been disabled in IE8.
You can also turn off all Mime sniffing by doing:
Response.Headers.Add("X-Content-Type-Options", "nosniff");to get: X-Content-Type-Options: nosniff
to the client browser.

The lesson: never ever ever trust image uploads. You can actually check the mime type yourself upon file upload by using the following:


//goes in the beginning of your class
        [DllImport("urlmon.dll", CharSet = CharSet.Unicode, ExactSpelling = true, SetLastError = false)]
        static extern int FindMimeFromData(IntPtr pBC,
              [MarshalAs(UnmanagedType.LPWStr)] string pwzUrl,
             [MarshalAs(UnmanagedType.LPArray, ArraySubType = UnmanagedType.I1, SizeParamIndex = 3)] 
        byte[] pBuffer,
              int cbSize,
                 [MarshalAs(UnmanagedType.LPWStr)]  string pwzMimeProposed,
              int dwMimeFlags,
              out IntPtr ppwzMimeOut,
              int dwReserved);

//calling code would be like:
            string mimeType = GetMimeFromFile(txtFileName.Text);
            MessageBox.Show(mimeType);


//method to check would be:


        /// 
        /// Ensures that file exists and retrieves the content type 
        /// 

        /// 
        /// Returns for instance "images/jpeg" 
        public static string GetMimeFromFile(string file)
        {
            IntPtr mimeout;
            if (!System.IO.File.Exists(file))
                throw new FileNotFoundException(file + " not found");

            int MaxContent = (int)new FileInfo(file).Length;
            if (MaxContent > 4096) MaxContent = 4096;
            FileStream fs = File.OpenRead(file);


            byte[] buf = new byte[MaxContent];
            fs.Read(buf, 0, MaxContent);
            fs.Close();
            int result = FindMimeFromData(IntPtr.Zero, file, buf, MaxContent, null, 0, out mimeout, 0);

            if (result != 0)
                throw Marshal.GetExceptionForHR(result);
            string mime = Marshal.PtrToStringUni(mimeout);
            Marshal.FreeCoTaskMem(mimeout);
            return mime;
        }

Transitioning from non-ssl to ssl and back again for login

2010-04-20T20:46:00.001-07:00

Problem
You have a web site that needs to transition from non-ssl, to an ssl login page, back to non-ssl for the rest of the site navigation. This must use forms authentication

Details
Forms authentication has a method FormsAuthentication.RedirectFromLoginPage()
However the url is passed over the querystring as login.aspx?RedirectUrl=somepage.aspx
This is all automatic and you cannot specify an absolute url here. Even if you make it an absolte url such as
login.aspx?RedirectUrl=http://www.mysite.com/somepage.aspx (of course this would need to be url encoded) this wont work.
Also an oddity in my testing if you specify an absolute url for the login page, forms authentication - even with a valid login- redirects you right back to the login page.
For example: If my web.config contains:
<forms loginUrl="http://localhost/secure/Login.aspx"
Or SSL
<forms loginUrl="https://localhost/secure/Login.aspx"

Both of these cause forms authentication to send out a redirect NOT to the RedirectUrl, but right back to the login page!

If you are currently surfing a non-http site and need the login page to go SSL there doesn't seem to be an easy way to do this considering the problem above (at least on my laptop Im using for testing) . Even if you set the flag <forms requireSsl=true it just errors out if you are not using an ssl connection but it does not redirect to ssl.

Solution
1. For your login url in forms authentication you can specify the full https:// url. OR you can use
<forms loginUrl="~/secure/Login.aspx"
On your login.aspx page


if (!Request.IsSecureConnection)
{
  Response.Redirect( --form your https url here or read from config);
}

OR you can use
<forms loginUrl="https://localhost/secure/Login.aspx"
and then in your login page, use a login control. Hook into the Logged_In method.



        protected void Login1_LoggedIn(object sender, EventArgs e)
        {
            //see below for code on GetNonSslRedirectUrl
            Response.Redirect(GetNonSslRedirectUrl(""));

        }

If you are not using a login control, then simply do something like such:


if (Authenticate(userName, password))
{
    string redirectUrl = GetNonSslRedirectUrl(userName);
    FormsAuthentication.SetAuthCookie(userName, false);
    Response.Redirect(redirectUrl);
}




/// 
/// Returns an http url (not https) to redirecto to a non-secure page
/// after being at a secure login page.
/// 

/// The username attempting the login.
/// The http://... url
private string GetNonSslRedirectUrl(string userName)
{
    string redirectUrl = FormsAuthentication.GetRedirectUrl(userName, false);
    //if its ssl, make non ssl.
    if (redirectUrl.Contains("https://"))
    {
        redirectUrl = redirectUrl.Replace("https://", "http://");
    }
    //if it doesnt contain http:// then its a relative path. append http and the host to it.
    if (!redirectUrl.Contains("http://"))
    {
        if (redirectUrl.StartsWith("/"))
        {
            redirectUrl = string.Format("http://{0}{1}", Request.Url.Host, redirectUrl);
        }
        else
        {
            //it needs a / in it.  url is just 'something.aspx' - not sure if this can happen, its a failsafe
            redirectUrl = string.Format("http://{0}/{1}", Request.Url.Host, redirectUrl);
        }
    }
    return redirectUrl;
}

Determining a user's permissions on sql objects

2010-04-17T09:18:00.000-07:00

I use a variant of this for auditing user permissions for security checks. My preference is a user should only have execute access to a stored procedure and thats it. This will find tables the user has select access on (to return all permissions simply remove the: where permission_name='select' and subentity_name ='' )

This will work for users who receive permissions as part of role membership as well as direct permissions on an object.


--this WILL work for role based permissions as well.
select b.name + '.' + a.name, permissions.permission_name from sys.tables a 
inner join sys.schemas b on a.schema_id=b.schema_id
cross apply (select * From fn_my_permissions(b.name + '.' + a.name, 'object') where permission_name='select' and subentity_name ='') as permissions
where a.type='u'

--should only have execute
select b.name + '.' + a.name, permissions.permission_name from sys.procedures  a 
inner join sys.schemas b on a.schema_id=b.schema_id
cross apply (select * From fn_my_permissions(b.name + '.' + a.name, 'object') ) as permissions

Hasing Passwords

2010-04-06T06:46:00.000-07:00

I think some people aren't sure the best way to implement password hashing for storing in a database or config file. Its super fast and super easy.

Simply open snippet compiler an essential tool at ( ) and add a reference to system.web
then add:
using System.Web.Security;

and the code is simply:


string hashedText = System.Web.Security.FormsAuthentication.HashPasswordForStoringInConfigFile("test", "SHA1");
Console.WriteLine(hashedText);

if you want the full class to use in snippet compiler for copying and pasting it is simply


using System;
using System.Collections.Generic;
using System.Web.Security;
public class HashPassword
{
 public static void RunSnippet()
 {
  string hashedText = System.Web.Security.FormsAuthentication.HashPasswordForStoringInConfigFile("test", "SHA1");
  Console.WriteLine(hashedText);
 }
 
 #region Helper methods
 
 public static void Main()
 {
  try
  {
   RunSnippet();
  }
  catch (Exception e)
  {
   string error = string.Format("---\nThe following error occurred while executing the snippet:\n{0}\n---", e.ToString());
   Console.WriteLine(error);
  }
  finally
  {
   Console.Write("Press any key to continue...");
   Console.ReadKey();
  }
 }

 private static void WL(object text, params object[] args)
 {
  Console.WriteLine(text.ToString(), args); 
 }
 
 private static void RL()
 {
  Console.ReadLine(); 
 }
 
 private static void Break() 
 {
  System.Diagnostics.Debugger.Break();
 }

 #endregion
}

Using LINQ to query dataset for Distinct

2010-03-28T19:06:00.000-07:00

I just wanted to query (quickly) a dataset to get a distinct pair of values.
Heres a quick way of doing it


var distinctValues = (from row in dataSet.Tables[0].AsEnumerable()
           select new
                      {
                          SomeColumn1 = row["SomeColumn1"],
                          SomeColumn2 = row["SomeColumn2"]
                      }).Distinct().OrderBy(o=>o.SomeSolumn1).ToArray();

Quick way to query /script foreign key constraints

2009-12-27T19:08:00.000-08:00

I needed to constantly query foreign key constraints as I was adding many new ones to a database for testing and removing:

select name, object_name(parent_obj) from sysobjects where xtype='f'
or if you want to use sys.objects instead:

select name, OBJECT_NAME(parent_object_id) from sys.objects where type='f'

F = foreign key constraint

using this you can create a script to drop constraints:

SELECT 'ALTER TABLE [dbo].[' +OBJECT_NAME(parent_object_id) +'] DROP CONSTRAINT [' + OBJECT_NAME(OBJECT_ID) + ']'
FROM sys.objects
WHERE type='f'

or I can add them. In this case I want to add a field called CompanyId to every table, and add a constraint to every table to reference this field.

SELECT
'ALTER TABLE [dbo].[' +name +'] add [CompanyId] [int] NOT NULL CONSTRAINT [DF_' + name + '_CompanyId] DEFAULT ((1))',
'ALTER TABLE [dbo].[' +name +'] WITH CHECK ADD CONSTRAINT [FK_' + name + '_Company] FOREIGN KEY([CompanyId]) REFERENCES [dbo].[Company] ([CompanyId])'
FROM sysobjects where type='u'

Caution with using asp.net session timeout and FormsAuthentication timeout together

2009-12-20T21:26:00.000-08:00

Problem: You've set your session timeout to 20 minutes and forms authentication timeout to 20 minutes. However you notice sometimes your session is not valid and yet people are still logged on. how can this be you ask!?!?!

So we have our session timeout as:


<sessionState timeout="1000">

and the forms authentication timeout as:


<forms timeout="1000" loginUrl="Login.aspx" name=".ASPXFORMSAUTH">

Unfortunately session timeouts and forms authentication timeouts work completely different. Session timeouts are just that - the amount of time from the last request is when it will timeout. IE upon every request.. the 'timer' is reset to 20 minutes.

In forms authentication - it is not reset upon every request. For 'performance enhancement' reasons so new cookies don't have to get created/encrypted on every single request, this value only gets update when approximately half of the time remains. IE if the timeout is 20 minutes, for the first 10 minutes of requests.. the timer still 'ticks away' on the ticket even if you request every second. It isn't until after 10 minutes have passed AND you request a page again that the ticket is updated. Secondly.. IIS resets do not reset forms authentication tickets, yet they reset sessions.

So here is a scenario that 'breaks' this:
Request a page at 1:00 PM.
IIS Resets at 1:05 - the session is now invalid, however the forms authentication ticket is still VALID.

The user requests a page and their session is gone, and all sorts of errors start occuring.

How to prevent this:
In global.asax.cs define a method that gets called at the beginning of every request. This method will check to make sure that we have a session if the ticket is valid, otherwise it logs the user out.


        protected void Application_PreRequestHandlerExecute(object sender, EventArgs e)
        {
            //Only access session state if it is available
            if (Context.Handler is IRequiresSessionState || Context.Handler is IReadOnlySessionState)
            {
                //If we are authenticated AND we dont have a session here.. redirect to login page.
                HttpCookie authenticationCookie = Request.Cookies[FormsAuthentication.FormsCookieName];
                if (authenticationCookie != null)
                {
                    FormsAuthenticationTicket authenticationTicket = FormsAuthentication.Decrypt(authenticationCookie.Value);
                    if (!authenticationTicket.Expired)
                    {
//of course.. replace ANYKNOWNVALUEHERETOCHECK with "UserId" or something you set on the login that you can check here to see if its empty.
                        if (Session[ANYKNOWNVALUEHERETOCHECK] == null)
                        {
                            //This means for some reason the session expired before the authentication ticket. Force a login.
                            FormsAuthentication.SignOut();
                            Response.Redirect(FormsAuthentication.LoginUrl, true);
                            return;
                        }
                    }
                }
            }
        }

Regular Expression to fix exception handling

2009-12-18T23:29:00.000-08:00

I was doing a code review and saw a common mistake throughout the code:


try
{
}
catch(Exception ex)
{
   throw ex;
}

this is incorrect. When you rethrow an exception like this, you reset the call stack and hose the good error information.

The correct method is:


try
{
}
catch(Exception ex)
{
   throw;
}

I came up with a quick regular expression you can use in visual studio to fix these. Press control-shift-f and check the box "use " where it says "regular expressions"

In the "Find What" section enter in:


{catch[:Wh]*\{[:Wh]*throw}{ ex}{;[:Wh]*\}}

In the "Replace with" enter:
\1\3

What does this do? In visual studio regular expressions the groupings are done by {} so the first place I have {} is \1, the second place is \2, etc

so this expression: {catch[:Wh]*\{[:Wh]*throw}{ ex}{;[:Wh]*\}}
breaks down to:
{catch[:Wh]*\{[:Wh]*throw} =\1
{ ex} =\2
{;[:Wh]*\}} =\3
so by replacing with \1\3 I simply exclude the " ex"

Click "replace" or "replace all" - by clicking replace you can preview one at a time.

Adding permissions to add items to the gac for other user accounts

2009-12-17T21:29:00.000-08:00

Trying to have a user add an assembly to the gac you receive:

Failure adding assembly to the cache: Access denied. You might not have administrative credentials to perform this task.

or you may receive this error:
Failed to execute the request because the ASP.NET process identity does not have read permissions to the global assembly cache. Error: 0x80070005 Access is denied.
(This error message sometimes _lies_ btw...if aspnet (xp) or network service (above windows xp) doesn't have permissions to your app folder you can receive this message.)

In our case the account we used to run our cruise control build process (ccnet) that then called off to nant scripts which in turn added assemblies to the gac was failing.
One solution is to add your user to the administrators group. You may not want to do this though. If we look at the permissions on the folder (you must use a command line utility or change the shell options.. we'll stick with command line option cacls.exe here)



C:\>cacls c:\windows\assembly
c:\windows\assembly BUILTIN\Users:R
                    BUILTIN\Users:(OI)(CI)(IO)(special access:)
                                              GENERIC_READ
                                              GENERIC_EXECUTE

                    BUILTIN\Power Users:C
                    BUILTIN\Power Users:(OI)(CI)(IO)C
                    BUILTIN\Administrators:F
                    BUILTIN\Administrators:(OI)(CI)(IO)F
                    NT AUTHORITY\SYSTEM:F
                    NT AUTHORITY\SYSTEM:(OI)(CI)(IO)F
                    MyLocalMachine\Administrator:F
                    CREATOR OWNER:(OI)(CI)(IO)F

You can see Administrators and System have Full Control (F).
Users have read, so web applications have no problem accessing the gac.
Running a web app therefore can access the gac (read only) because of the
BUILTIN\Users:(OI)(CI)(IO)(special access:)
GENERIC_READ
GENERIC_EXECUTE

To add the user to the ACL for the gac run
(you can use %WINDIR% in place of c:\windows so you can use %WINDIR%\assembly)



CACLS c:\windows\assembly /e /t /p user@domain:F

or

CACLS c:\windows\assembly /e /t /p username:F

This is not always enough though depending on your inheritance permissions. since the gac install is a two phase install process and the temp and tmp folders may be used you may also at times need the following commands, but first try without.
Also note where I have "username" that of course means replace with the username to add permissions for.



CACLS c:\windows\assembly\temp /e /t /p username:F

CACLS c:\windows\assembly\tmp /e /t /p username:F

If this still doesn't resolve, Microsoft has a posting that deals with some other causes:
http://support.microsoft.com/default.aspx?kbid=811320

If you want to edit the permissions in explorer.. you can do this by first disabling the 'gac' view in windows explorer and make it a normal folder again:


regsvr32 -u C:\WINNT\Microsoft.NET\Framework\v2.0.50727\shfusion.dll

and to register the shell view again (IE make c:\windows\assembly the 'gac' view rather than just a normal folder) run:
<


C:\>regsvr32 C:\WINNT\Microsoft.NET\Framework\v2.0.50727\shfusion.dll

Adding PresentationHost and PresentationUI (Microsoft WPF) assemblies to Sql Server

2009-12-08T19:11:00.001-08:00

We received various errors when trying to install an assembly of ours that uses CSLA. CSLA uses WPF items rather than System.Windows.Forms. Unfortunately we do not want to make the widespread changes that would need ot occur to CSLA. In the end we actually decided to move anything csla related into another assembly that would not be loaded, however meanwhile I did find a fix which I will describe below.
When adding them we received several errors, one of them being:

"The assembly returned from the host store has a different strong name signature than the corresponding one in GAC"

The following reference paths are in different locations and BOTH refer to each other... so you are stuck with a chicken/egg problem here in running:

CREATE ASSEMBLY [PresentationFramework] AUTHORIZATION dbo FROM 'C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\PresentationFramework.dll' WITH permission_set = unsafe

It will then try to find PresentationUI which is in a different folder, specifically C:\Windows\Microsoft.NET\Framework\v3.0\WPF\PresentationUI.dll
If you try to add that assembly you will get an error it cannot find PresentationFramework (since PresentationFramework is in a different folder)

CREATE ASSEMBLY [PresentationUI] AUTHORIZATION dbo FROM 'C:\Windows\Microsoft.NET\Framework\v3.0\WPF\PresentationUI.dll' WITH permission_set = unsafe

What I did however incorrect it may be (although it works) is to temporarily copy the PresentationUI.dll to the "Reference Assemblies" location (IE the same folder PresentationFramework.dll is located in).

Then when you run
CREATE ASSEMBLY [PresentationFramework] AUTHORIZATION dbo FROM 'C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\PresentationFramework.dll' WITH permission_set = unsafe

it will look in the current folder for presentationui.dll now in
C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\PresentationUI.dll
and add the assembly. Once sql server imports it, you can remove the copied file.

This is not the only dll required in our case, in fact there is another blog entry out there that describes a bunch of the libraries required at:

http://weblogs.asp.net/albertpascual/archive/2009/07/27/sql-2008-clr-triggers-use-a-net-class-library-in-sql-using-wpf.aspx

Note: Once you add an assembly that references another assembly, sql server will automatically add that referenced assembly for you.

We ended up using this list:

CREATE ASSEMBLY [SMDiagnostics] FROM 'C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMDiagnostics.dll' WITH permission_set = unsafe

CREATE ASSEMBLY [System.Runtime.Serialization] AUTHORIZATION dbo FROM 'C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\System.Runtime.Serialization.dll' WITH permission_set = unsafe

CREATE ASSEMBLY [System.Data.Linq] AUTHORIZATION dbo FROM 'C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.Data.Linq.dll' WITH permission_set = unsafe

CREATE ASSEMBLY [System.Core] AUTHORIZATION dbo FROM 'C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\system.core.dll' WITH permission_set = unsafe
CREATE ASSEMBLY [WindowsBase] AUTHORIZATION dbo FROM 'C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\windowsbase.dll' WITH permission_set = unsafe
CREATE ASSEMBLY [PresentationCFFRasterizer] AUTHORIZATION dbo FROM 'C:\Windows\Microsoft.NET\Framework\v3.0\WPF\PresentationCFFRasterizer.dll' WITH permission_set = unsafe
CREATE ASSEMBLY [System.Drawing] AUTHORIZATION dbo FROM 'C:\Windows\Microsoft.NET\Framework\v2.0.50727\System.Drawing.dll' WITH permission_set = unsafe
CREATE ASSEMBLY [PresentationCore] AUTHORIZATION dbo FROM 'C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\PresentationCore.dll' WITH permission_set = unsafe
CREATE ASSEMBLY [PresentationHost] AUTHORIZATION dbo FROM 'C:\Windows\Microsoft.NET\Framework\v3.0\WPF\PresentationHostDLL.dll' WITH permission_set = unsafe
CREATE ASSEMBLY [System.Windows.Forms] AUTHORIZATION dbo FROM 'C:\Windows\Microsoft.NET\Framework\v2.0.50727\System.Windows.Forms.dll' WITH permission_set = unsafe
CREATE ASSEMBLY [System.DirectoryServices] AUTHORIZATION dbo FROM 'C:\Windows\Microsoft.NET\Framework\v2.0.50727\System.DirectoryServices.dll' WITH permission_set = unsafe
CREATE ASSEMBLY [PresentationUI] AUTHORIZATION dbo FROM 'C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\PresentationUI.dll' WITH permission_set = unsafe
CREATE ASSEMBLY [PresentationFramework] AUTHORIZATION dbo FROM 'C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\PresentationFramework.dll' WITH permission_set = unsafe
--CREATE ASSEMBLY [PresentationUI] AUTHORIZATION dbo FROM 'C:\Windows\Microsoft.NET\Framework\v3.0\WPF\PresentationUI.dll' WITH permission_set = unsafe
CREATE ASSEMBLY [System.Web] AUTHORIZATION dbo FROM 'C:\Windows\Microsoft.NET\Framework\v2.0.50727\System.Web.dll' WITH permission_set = unsafe
CREATE ASSEMBLY [System.Messaging] AUTHORIZATION dbo FROM 'C:\Windows\Microsoft.NET\Framework\v2.0.50727\System.Messaging.dll' WITH permission_set = unsafe
CREATE ASSEMBLY [System.IdentityModel] AUTHORIZATION dbo FROM 'C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\System.IdentityModel.dll' WITH permission_set = unsafe
CREATE ASSEMBLY [System.IdentityModel.Selectors] AUTHORIZATION dbo FROM 'C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\System.IdentityModel.Selectors.dll' WITH permission_set = unsafe
CREATE ASSEMBLY [Microsoft.Transactions.Bridge] AUTHORIZATION dbo FROM 'C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\Microsoft.Transactions.Bridge.dll' WITH permission_set = unsafe
CREATE ASSEMBLY [System.ServiceModel] AUTHORIZATION dbo FROM 'C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\System.ServiceModel.dll' WITH permission_set = unsafe
CREATE ASSEMBLY [System.Web.Extensions] AUTHORIZATION dbo FROM 'C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.Web.Extensions.dll' WITH permission_set = unsafe

CREATE ASSEMBLY[System.Web] from'C:\WINDOWS\Microsoft.NET\Framework64\v2.0.50727\System.Web.dll' with permission_set = UNSAFE
CREATE ASSEMBLY [System.Design] AUTHORIZATION dbo FROM 'C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\System.Design.dll' WITH permission_set = unsafe

CREATE ASSEMBLY [Microsoft.Build.Utilities] AUTHORIZATION dbo FROM 'C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft.Build.Utilities.dll' WITH permission_set = unsafe

CREATE ASSEMBLY [Microsoft.Build.Tasks] AUTHORIZATION dbo FROM 'C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft.Build.Tasks.dll' WITH permission_set = unsafe

CREATE ASSEMBLY [System.Workflow.Runtime] AUTHORIZATION dbo FROM 'C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\System.Workflow.Runtime.dll' WITH permission_set = unsafe

Debugging in the GAC - All ways to accomplish this

2009-11-02T14:02:00.000-08:00

I'm writing this post as a result of a recent discussion with some coworkers and realizing again there is a common misconception in regards to several things with the gac.

This is a bit of a long post but hopefully will give you a more detailed understanding of PDB fies and the GAC and the various method to debug assemblies in the GAC.

Since this post is about debugging, Im assuming you have a debug build. There are other builds that use PDB files, read about them
Determining if an assembly is compiled in release or debug mode

1. How Visual studio handles adding references to an assembly in the gac
2. How is the PDB used and can one debug with an assembly in the gac? I have a local pdb sitting next to my reference file, do I need to actually put the pdb in the gac? Isn't there another way? (quick answer, there is another way but some choose the gac)

The easiest method is defined at the very bottom of this article.

How Visual studio handles adding references to an assembly in the gacWhen you click "Add Reference" to a project and get the resulting window.

These results ARE NOT from the GAC. Visual Studio has these folders stored at:
HKLM\Software\Microsoft\VisualStudio\X.X\AssemblyFolders
where X.X is a version number.
Here you can see how Infragistics shows up in the list because of the folder added under AssemblyFolders

There is another key which contains more information as well located under HKLM\Software\Microsoft\.NETFramework\AssemblyFolders as shown here:

Again, the references window is _not_ looking at the gac, this is fully registry (and hence path, not gac) based. If you want to add your own folders simply follow the directions by ms to update the registry keys as outlined here:

So if you need to add a reference to your own assembly that is in the GAC you can either browse for assembly or add a project reference.

There is something very important to realize here. When you select your item, Visual Studio does check if the assembly you are selecting is ALSO in the GAC. You must have another local copy of that file to reference. What if you don't have it? I lost my file! My dog ate it! This may never ever happen to you but more to increase understanding on this in theory you can go to a command line and make a local copy of this library in most cases.


Follow these steps:
1. open a command line and go to c:\windows\assembly
2. run dir *assemblyname* /s
(that will find the folder in your assembly, or course replacing assemblyname with some portion of your assembly name or just type your whole assembly name)
3. when the results come up go all the way into the assemblyname and then the version folder - you must do this at the command line, there is shell integration with the GAC so you cannot view this folder through explorer.
4. Run the copy command to copy the dll out for instance copy *.* c:\temp
5. Add your reference from the temp folder

How is the PDB used and can one debug with an assembly in the GAC? I have a local PDB sitting next to my reference file, do I need to actually put the PDB in the GAC? Isn't there another way?
You can indeed debug an assembly in the gac and its quite easy. There are several ways to do it, and it depends on your version of Visual Studio and how you want to do this.

First what is the GAC - the GAC is a place for shared libraries. If you develop a component and five applications use it, the GAC is a great place to house that component. You only need to ever update one location - the GAC.

Whats inside the gac?
If you navigate to c:\windows\assembly you will find in explorer you cannot get there in a regular file view because of the shell integration. So, you must view this folder at the command line: dir c:\windows\assembly

Note the results:


GAC Folders
GAC - .net 1.x asemblies
GAC_32 - 32 bit assemblies. If you are on a 64 bit machine you will see a GAC_64 as well. This was new to .net 2
GAC_MSIL  - Images that can run in either 32 or 64 bit
NativeImages* - These are ngen'd images running as native compiled code (rather than intermediate language)
temp/tmp  tmp is used for gac installation and temp is used for the uninstall. At times these folders will contain files that upon a reboot will clean up. Sometimes failed install will leave files here as well.
See more on this subject at:
GAC Assemblies: Install and Uninstall

In order to debug, you need a PDB (program database file) You cannot install a pdb into the gac via gacutil.exe, you can only install an assembly with gacutil. You have two choice here. There are problems with this method which I will describe below

A. Put the pdb in the GAC manually. This will work. I did see a posting that claimed it did not work, it does indeed work, I've done it quite a few times in the past. You can copy it from a command line by something like the following at a command line:


1. cd c:\windows\assembly\gac_msil
2. cd *aPartOfYourAssemblyName*     then using that path:
3. cd C:\WINDOWS\assembly\GAC_MSIL\MyAssembly\1.0.0.0__121ade23gaef410
now copy it into the gac folder by:
4. copy c:\source\MyAssembly\bin\debug\MyAssembly.pdb .

Restart your application and attach the debugger.

Secondly, you can also simply set your build "output path" in visual studio on your project properties -> Build tab to be the specific gac folder. IE instead of doing the manual copy above, just set that gac folder as the build output folder. You will need to install your assembly into the gac first to get the proper folder name, and you want to make sure the version of your assembly isn't changing with each build or.. this just won't work.. so the technique isn't the best.. but it's possible.

There is another problem with this method. If something has your pdb loaded (ie visual studio/w3wp/aspnet) and your assembly is part of a solution that deploys it into the gac using gacutil, you may fail the compile. The reason is, your GAC folder is removed when you update it. If there is a PDB file with a reference to it, fusion cannot remove it when doing the install process.

Then there is the method where you don't need to copy the pdb file.
Configure Visual Studio (versions 2005 and up), to debug code besides "just my code" which is an option under tools->options->debugging->Enable Just My Code. Uncheck this option
Visual Studio will then search the path you gave it to reference your gac library and look for a pdb file. Set the path of your PDB file on the Tools->Options->Debugging->Symbols tab.

What is 'just my code'? Basically this is code that falls under the following criteria:
Not optimized
No Symbols
Assembly has the DebuggerNonUserCodeAttribute
(info from: Sarah Ford: Did you know… what is just your code

Also make sure you have "Suppress JIT Optimizations on module load" to help prevent issues determining "just my code" (ie if its optimized then it will be determined to be not your code)
This can be set on : Tools–>Options->Debugging–>General->Suppress JIT optimization on module load (Managed only)

C. Configure Visual Studio to look to a symbol server. This is a strong method - as you can publish your symbols to a symbol server or to a folder and always have the required version available. For instance, if you need to setup remote debugging against a production release, the proper version pdb files will automatically load once you pull down the required source code. This way requires you to deploy the symbols for a specific version to the symbol server. I will add more steps to this hopefully in the future.

Who hangs onto the pdb? Visual studio and aspnet_wp.exe or w3wp.exe (iis 6+) both will use the pdb. Why aspnet_wp/w3wp you ask? If you've ever seen an error on a webpage with a fill callstack and source code information, then understand these processes will use the .pdb file to properly determine this information.This is only made possible by having a pdb available.

The easiest method available is to simply start debugging and tell visual studio where to find the pdb file.

Select Debug->Windows->Modules once you start debugging (for example attach to aspnet_wp.exe or w3wp.exe)
Here you can see "Symbol Status" shows that it cannot find the symbols. Since this is a Microsoft assembly, I can simply get the symbols from Microsoft by right clicking and selecting "Load Symbols From->Microsoft Symbol Servers"

Here we see Visual Studio contacting Microsoft for the symbols

Once the symbols have loaded you can select "Symbol Load Information" (actually you can do this on any item and you will see the search it did to try to find the symbols, very helpful sometimes in determining why your symbols didn't get loaded)

The results:

If we click on "Symbol Settings" in the above dialog we see a temporary folder has automatically been chosen to download thhe symbols from Microsoft into:

Now if we look at the modules window, it is very clear our symbols have been loaded.

so how do we use this for non-Microsoft assemblies? Very easy. You right click, select 'Load Symbols From->Symbol Path' and enter in the path to your .pdb file. Thats it, and its dynamic so may be the easiest solution for you.

Executing many scripts at once in Sql Mangement Studio

2009-10-22T07:52:00.000-07:00

I have 110 stored procedures to execute. I can use a tool such as Red Gate's Sql Toolbelt to script the differences, however I'm setting up a new database. I have several choices:
1. create one large script file.
2. script differences
3. run each script in management studio one by one
4. call osql.exe for each and every script
5. load all scripts (drag and drop) into management studio without being prompted every time (quickest method)

scenario 1 - I have to put everything into one hugggeee query file. This will take time to run and execute.

scenario 2 - I can script changes, however this doesn't guarantee we have current changes in our source control system. Quite often changes can get into a database that aren't properly scripted. I'm a fan of this, but it is always good to establish a baseline with your scripts to make sure they are correct (if your environment is source control and script based). The issue is in the database Im about to compare, there are many many other changes that are not required for the application functionality I'm working on.

scenario 3 - last time I tried opening 110 files in management studio, it crashed. Also it prompts for _every_ connection and there is no auto-connect option in the application's interface.

scenario 4 - this requires writing a script, which is generally trivial to enumerate a folder and run osql, however this requires combing through the output for errors and running queries with issues again.

scenario 5 - If I can only get management studio to not prompt me, I can run a script and see the output and continue. By default, management studio will prompt you on each and every query you open. However, if you launch a command line with a list of files, or a single INVALID file, it will retain the connection info, and all new items you drag and drop will automatically be opened with this connection.

so simply run the command:

sqlwb -s ServerName -d DatabaseName -u UserName -p Password -e fakefilename.txt

(im assuming sql authentication here for this example not integrated).
Now drag and drop all of your scripts here and they will open with a connection, and without prompting you.

You will still have to press f5 for every script, but for me it took two minutes to process 110 files pressing f5 to execute each one and clicking the x to close each one after there were no errors.

This saved me a little bit of time : )

Determining if an assembly is compiled in release or debug mode

2009-07-15T08:40:00.000-07:00

To determine if an assembly was compiled in debug mode, look for the following Debuggable attribute at the assembly level. You will need to look at the flags set on it which have the following values:

Default = int32(1)
DisableOptimizations = int32(0x100)
EnableEditAndContinue = int32(4)
IgnoreSymbolStoreSequencePoints = int32(2)
None = int32(0)

If the attribute is there, it does not mean it is or is not a debug/release build. What is important to check is the flag values, and what you are looking for. You can have a release build, and still generate PDB information. This pdb information is more limited, since optimizations are still enabled you will not be able to debug this program at a source level.

How do you find this attribute on a compiled assembly?
1. Open the assembly in reflector
2. Click on the assembly at the base level (ie do not click on any classes underneath the root level, make sure the assembly name is highlighted in reflector)
3. Hit the spacebar to make sure you can view the disassembly on the right hand side.
4. Look at the output for the Debuggable attribute.

The scenarios here show:
1. Default Debug release (So no optimizations set and full debug info being generated)
2. Default Release (Enable Optimizations checked off and pdb-only option set)
3. Release mode with no pdb info being generated
4. Release mode with full pdb info being generated
5. Release with optimizations unchecked and full pdb info being generated

Where are the mentioned settings?
In Visual Studio 2008 go into the project properties and then the build section. There is a checkbox there for "Optimize Code". The second option is under the "Advanced" button at the bottom of the screen. The setting is "Debug Info" and the options are "none, pdb-only, full"

Scenario 1
Default debug release the assembly shows the following (other attributes removed)
We see the value is 107, so look at the enum values to figure out the options:
DisableOptimizations (100)
EnableEditAndContinue (4)
IgnoreSymbolStoreSequencePoints (2)
Default (1)
We OR these bits all together (IE add them) and we come up with 107

.assembly DebuggableTest
{
.custom instance void [mscorlib]System.Diagnostics.DebuggableAttribute::.ctor(valuetype 

[mscorlib]System.Diagnostics.DebuggableAttribute/DebuggingModes) = { int32(0x107) }
}

Scenario 2
Release mode:

Options set:
IgnoreSymbolStoreSequencePoints

.assembly DebuggableTest
{
.custom instance void [mscorlib]System.Diagnostics.DebuggableAttribute::.ctor(valuetype [mscorlib]System.Diagnostics.DebuggableAttribute/DebuggingModes) = { int32(2) }
}

Scenario 3
Release mode with no pdb info being generated (ie debug info set to "none" in the advanced options)
Notice there is no Debuggable attribute set in this option
Options set:
NONE

.assembly DebuggableTest
{

}

Scenario 4
Release mode with the "full" option set for debug info (ie full pdb info being generated )
Options set:
IgnoreSymbolStoreSequencePoints
Default

.assembly DebuggableTest
{
.custom instance void [mscorlib]System.Diagnostics.DebuggableAttribute::.ctor(valuetype [mscorlib]System.Diagnostics.DebuggableAttribute/DebuggingModes) = { int32(3) }
}

Scenario 5
Release mode with optimizations unchecked and full pdb info being generated. In theory this is the same as a debug build. Lets check:
Options set:
DisableOptimizations (100)
EnableEditAndContinue (4)
IgnoreSymbolStoreSequencePoints (2)
Default (1)

.assembly DebuggableTest
{
.custom instance void [mscorlib]System.Diagnostics.DebuggableAttribute::.ctor(valuetype [mscorlib]System.Diagnostics.DebuggableAttribute/DebuggingModes) = { int32(0x107) }
}

To do this in code - I got this I believe from:
http://www.jamesewelch.com/2007/08/30/how-to-tell-if-a-net-assembly-is-debug-or-release/

Assembly assemb = Assembly.LoadFile(Path.GetFullPath(fileName));
bool isDebug = false;
foreach (object attribute in assemb.GetCustomAttributes(false))
{
     if (attribute is DebuggableAttribute)
     {
          isDebug = ((DebuggableAttribute)attribute ).IsJITTrackingEnabled;
     }
}

if(isDebug)
{
  //'got me some debug code!
}

Hope this helps!

Quick way to determine row count from index

2009-06-22T20:14:00.000-07:00

I use the following query for two reasons:
1. as a quick way to determine row count. Rather than doing select count(columnname) which touches every single row, this looks up the row count from the index.

2. When I want to clear information out of a large test database for local use - this allows me to see what tables have the most information so I know which tables to work on clearing some information out of first.

SELECT rows ,OBJECT_NAME(id), * FROM sysindexes WHERE indid < 2 ORDER BY [rowcnt] DESC

Multiple host headers, ssl, and WCF failures

2009-06-06T09:54:00.000-07:00

Came across an interesting scenario in deploying a wcf service that used transport security (ssl).

Symptoms:

Navigating to your WCF service in the browser shows you the wrong internal address.
You are trying to access your site as www.PublicAddress.com/MyService.svc and the page coming back tells you to run

svcutil.exe http://www.PrivateMachineName/MyService.svc

NOOooo you say. That's not what I want! Luckily the solution isn't that difficult but you do have several choices in increasing difficulty.

Solutions:
1. Set host header
This method is the quickest but you have to be aware of a couple situations.
a. You are not using ssl - Simply go into IIS (Im assuming 6 for this posting) and right click on your site, then click "advanced" to add the host headers. Typical scenarios have it configured as "All unassigned addresses" to port 80. Or a specific IP address assigned to port 80, with no host header listed. If either of these fit your case, just click "edit" and add your host name such as www.PublicSite.com
NOTE: If you already have a host header listed or need two host headers, which is very common for sites (such as www.publicsite.com and publicsite.com) WCF will fail when you try to run your service with:
This collection already contains an address with scheme http. There can be at most one address per scheme in this collection.

You CANNOT by default start a wcf service with multiple host names bound to an address. Doh! If you must add multiple hosts to your site, then you cannot use this method. In that case it may make sense to create another site in IIS that responds to a different host header. Such as services.publicsite.com and you can add your host header to iis for that new site, update your web.config if necessary to fit the new address (if you have specified an identity in your web.config then change it, if not then your service will figure out what the proper identity is). For example you only need to update your config if the following case fits or you need ssl on your site and need to modify the element


<!-- 
Upon deployment, the following identity element should be removed or replaced to reflect the 
identity under which the deployed service runs.  If removed, WCF will infer an appropriate identity 
automatically.
-->
<identity>
      <dns value="www.publicsite.com"/>
</identity>

Now, if you are using ssl it becomes a tiny bit trickier. You see adding the host header to port 80 binding in iis like we did above does not apply to ssl. You must specifically add the host header for ssl using the adsutil.vbs script usually located at c:\inetpub\adminscripts
if it is not there and it was possibly removed and you don't feel like installing it sometimes it can be found on a server at %SYSTEMROOT%\ServicePackFiles\i386

You can add host headers for port 80 here as well, so lets go over both.

1. If you are running more than one site on the machine verify the site id to use in the scripts by running at a command prompt:
cscript.exe adsutil.vbs ENUM /P W3SVC

Shows:
Microsoft (R) Windows Script Host Version 5.6
Copyright (C) Microsoft Corporation 1996-2001. All rights reserved.

[/W3SVC/1]
[/W3SVC/439224544]
[/W3SVC/AppPools]
[/W3SVC/Filters]
[/W3SVC/Info]

Take note in this case I have two sites setup. The first site is /1, the second is a random number.

Check the server bindings
a. Cscript.exe adsutil.vbs GET W3SVC/1/ServerBindings this will return something like the following, note no host header listed after port 80
ServerBindings : (LIST) (1 Items)
"23.16.44.11:80: "

b. If this is not the site you want, you need to look up the site id by running this command, and substitute the /1/ above with the actual site id returned from the ENUM command above.

c. Add the binding for non-ssl and ssl
Cscript.exe adsutil.vbs set W3SVC/1/ServerBindings ":80:www.mysite.com"
Cscript.exe adsutil.vbs set W3SVC/1/SecureBindings ":443:www.mysite.com"

Note if you want to have just mysite.com, you will run into a problem because of multiple host headers since you will have www.mysite.com and mysite.com

You can verify changes by running these commands, and you should now see the beta.drtms.net listed for each item.
d. Cscript.exe adsutil.vbs GET W3SVC/1/ServerBindings
e. Cscript.exe adsutil.vbs GET W3SVC/1/SecureBindings

For e. above, yes it true, just because you have a host header assigned in iis does not mean ssl inherits it. You must explicitly set this via the script here to work with WCF. Once done, reset iis (run iisreset as a command line) and that should do it for you.

2. Try binding filters (I'll edit this post shortly on this item)
3. Implement a custom factory to tell ServiceHost which uris to bind to.
4. Avoid the whole problem and use restful services. This involves changing a bit of your code so will consider it not as easy as the main solution here.
5. Implement with web services and let IIS fully handle ssl without worrying about multiple bindings. If you required authentication use basic authentication over ssl configured in IIS. If you don't want to use windows accounts for basic authentication you can implement a custom basic auth provider, such as shown here on codeplex: http://www.codeplex.com/CustomBasicAuth

Multiple host headers / ssl / incorrect wsdl addresses using local machine

2009-06-02T20:24:00.000-07:00


<!-- 
Upon deployment, the following identity element should be removed or replaced to reflect the 
identity under which the deployed service runs.  If removed, WCF will infer an appropriate identity 
automatically.
-->
<identity>
      <dns value="www.publicsite.com"/>
</identity>

Using nUnit AND Mstest (Visual Studio Unit Testing) together in perfect harmony

2009-05-27T11:16:00.001-07:00

I like mstest. I like the integration. I like right clicking on a method and adding a unit test SNAP done.
It works great for me. nUnit is 'ok' to me. Integration is poor without third party tools. You have to change things around to get it to work. Sometimes I get strange errors I just dont get using mstest.
You have to set config files up to be named the same as the project. Not intuitive at first since nothing actually tells you this - you expect to be able to tell it your assembly and voila. Now.. you can use a different sequence of events to prevent this, such as add assembly before creating a project in nUnit, but thats not obvious to anyone first using it.

however.. to use nUnit on a build server I dont need to install Visual Studio. In order to use Microsoft's unit testing, you need to either install Visual Studio on the build server or go through a hack to get the components on there. Its not pretty. So nUnit shines here. But.. why not use mstest in the IDE and nUnit on your build server? They have different namespaces - but you can change the aliases around to do this successfully.

At the top of your classes in your unit test projects define the following to default to microsoft testing unless a build constant is defined called NUNIT


#if !NUNIT
using Microsoft.VisualStudio.TestTools.UnitTesting;
using Category = Microsoft.VisualStudio.TestTools.UnitTesting.DescriptionAttribute;
#else
using NUnit.Framework;
using TestInitialize = NUnit.Framework.SetUpAttribute;
using TestContext = System.Object;
using TestProperty = NUnit.Framework.PropertyAttribute;
using TestClass = NUnit.Framework.TestFixtureAttribute;
using TestMethod = NUnit.Framework.TestAttribute;
using TestCleanup = NUnit.Framework.TearDownAttribute;
#endif

Go into Visual Studio, choose the Build menu and select "Configuration Manager"
Select "new" and name this build Nunit (or mstest or whatever you want to NOT be your debug/release build). Personally.. I use a build name called MsTest since my debug builds are what get automatically tested every night with cruisecontrol.net/nant/nUnit so I want my default builds to compile with nUnit, but when I want to add/debug unit tests in the IDE I simply change my build to MsTest.

Once you create a new build name, go into each of your projects once you select the build, and go to prokect properties. In the Build tab under "Conditional Compilation Symbols" type in MSTEST or NUNIT.
Use NUNIT if you call your build nUnit and use the code above. This will assume you want your default debug/release build to default to Microsoft. Case DOES matter for the conditional compilation constants.. make sure you use all uppercase.. its easier.

If you want to create a separate build configuration for testing Microsoft unit tets, but want to keep the default debug/release for nUnit then your headers would look like this:


#if MSTEST
using Microsoft.VisualStudio.TestTools.UnitTesting;
using Category = Microsoft.VisualStudio.TestTools.UnitTesting.DescriptionAttribute;
#else
using NUnit.Framework;
using TestInitialize = NUnit.Framework.SetUpAttribute;
using TestContext = System.Object;
using TestProperty = NUnit.Framework.PropertyAttribute;
using TestClass = NUnit.Framework.TestFixtureAttribute;
using TestMethod = NUnit.Framework.TestAttribute;
using TestCleanup = NUnit.Framework.TearDownAttribute;
#endif

hope this helps : )

An easier way to track parameters in unit testing for Visual Studio (mstext.exe)

2009-05-26T11:51:00.000-07:00

One downside in unit testing is having an easy way view and use the test parameters. Sure you can put them in the code, but its hard to see how it varies from method to method. Ok.. maybe 'hard' isn't it, but 'not as clean as having all test parameters in one spot' I'll say. So I wrote a quick routine to extract the parameters. note:

I created a method called SetPropsToAttributes() and also GetAttributeValue().

For SetPropsToAttributes, Pass in an object and based on the TestProperty() attributes, it will find the matching property (not case sensitive) and set its value. So you can pass in an object and any attributes that are named the same as the object's properties, will have the values set to whatever are in the attributes. So all test information is kept then at the top of the method.

For GetAttributeValue, the idea here is an easier way to get a single value:
If I have this method:


[TestMethod]
[TestProperty("UserName","Adam Tuliper")]
[TestProperty("Password","nobodyknows")]
public void TestLogin()
{
   LoginHandler handler = new LoginHandler();
   handler.Login((string)("UserName"), (string)GetAttributeValue("Password"));
}

You can see here I easily get the parameters. I don't have to look through code to get test information. Every method has it at the top. This also makes it easy to copy and paste information into a test script for documentation purposes.

On the helper methods below I use [MethodImpl(MethodImplOptions.NoInlining)] because this is meant for debug code only in your _test program_ (not in the actual bytes being unit tested) which you would have during a unit test. The stack frame tracking and debug information is different (debug information is missing unless you do a release build with the pdbonly advanced option selected - this should work in that scenario but I haven't tried it) depending on options selected) in a release build. When you compile a release build, there are optimizations performed and the compiler may decide to inline the method calls, thus breaking the way this routine finds the method that called it. Read again: this will break in release builds - it is for debug code only, but then again thats the whole purpose of this posting : )

One more note - Do not call SetPropsToAttributes and GetAttribute from more than one level up.. Ie dont do this: Method1() - > Method2() -> GetAttribute(for memthod1)
as the code only looks up one stack frame on top of GetAttribute to determine the calling method.

So we
1. Create method based
2. Declare TestProperty attributes with our test data. null, int, strings, etc
3. Pass in the object we are going to unit test and values get assigned in the method SetPropsToAttribValues
4. Run test
5. Assert return codes



/// <summary>
/// A unit test method providing a sample way to automatically assign
/// test attributes to Properties in an object
///</summary>
[TestMethod()]
[TestProperty("TestProperty1", "Something")]
[TestProperty("TestProperty2", "SomethingElse")]
public void SomeUnitTestMethod
{
    SomeCustomObject testObject = new SomeCustomObject();
    //This call will automatically set testObject.TestProperty1 to "Something" for ex.
    SetPropsToAttribValues (testObject);
    int retVal = testObject.SomeMethod();

    Assert.IsTrue(retVal==0, "Return value was unexpected:" + retVal.ToString());

}


/// <summary>
/// Uses reflection to look at the calling method's TestProperty attributes
/// and will set values on properties matching those attribute names with the attribute values.
/// Property names are not case sensitive for this implementation to help avoid unit test typos.
/// </summary>
/// <param name="obj"></param>
[MethodImpl(MethodImplOptions.NoInlining)]
private void SetPropsToAttribValues(object obj)
{
    //Get name of attribute. if it exists and value != null set it. 
    Type t = GetType();
    Type attributeType = typeof(TestPropertyAttribute);
    //hop up the stack frame to the caller so we can get its attributes
    object[] attributes = new System.Diagnostics.StackFrame(1, false).GetMethod().GetCustomAttributes(attributeType, false);

    for (int i = 0; i <= attributes.GetUpperBound(0); i++)
    {
        string propertyName = ((TestPropertyAttribute)attributes[i]).Name.ToLower();

        PropertyInfo[] properties = obj.GetType().GetProperties();
        foreach (PropertyInfo pi in properties)
        {
//Made to be not case sensitive to help avoid test script typos.
            if (pi.Name.ToLower() == propertyName)
            {
                pi.SetValue(obj, ((TestPropertyAttribute)attributes[i]).Value, null);
            }
        }
    }
}

/// <summary>
/// Looks up attribute values for a particular method. They are used here for sending in values for the test cases.
/// This reads all [TestProperty] attribute values
/// </summary>
/// <param name="attributeName"></param>
/// <returns>attribute value as specified in [TestProperty] attribute, throws an exception if not found.</returns>
[MethodImpl(MethodImplOptions.NoInlining)]
private object GetAttributeValue(string attributeName)
{

    Type t = GetType();
    Type attributeType = typeof(TestPropertyAttribute);
    //hop up the stack frame to the caller so we can get its attributes
    object[] attributes = new System.Diagnostics.StackFrame(1, false).GetMethod().GetCustomAttributes(attributeType, false);

    for (int i = 0; i <= attributes.GetUpperBound(0); i++)
    {
        if (((TestPropertyAttribute)attributes[i]).Name.ToLower() == attributeName.ToLower())
        {
            return ((TestPropertyAttribute)attributes[i]).Value;
        }
    }
    throw new Exception("Could not find attribute " + attributeName);
}

The Nagle algorithm - speeding up tcp, changing protocols, rewriting your app, or just dealing with it?

2009-05-18T21:23:00.000-07:00

First - what is the nagle algorithm and its purpose?

The Nagle algorithm's basic idea is to queue up smaller amounts data and do not send it if there is current sent data waiting to be confirmed. If we are sending a large packet, then there is no effect. The idea is to prevent small packets and the header information on each packet from clogging the network if we can queue some of that data (since we're waiting for a send acknowledgment anyways) and send it once the pending send has been confirmed.

More details can be found at:

http://en.wikipedia.org/wiki/Nagle%27s_algorithm

The magic value here is MSS - Maximum Segment Size and this specifies the maximum size that can be transmitted. Upon establishing

There's a simple way to test the effects of Nagle and how it compares between using sockets and remoting. Remoting can wrap your data in headers, thus
RFC896
http://www.ietf.org/rfc/rfc0896.txt?number=896

I find myself at times saying "Nagle is bad in X scenario, RDP for instance where a user expects near real time response", so at times it does make sense to turn it off.

There is a great article on this subject at:

http://msmvps.com/blogs/alunj/archive/2006/05/08/94038.aspx

In it, Alun Jones makes a great point. Basically if you have gains because Nagle is turned off either your application is broke or the protocol is broke. Take RDP for example. A user expects a real time response. Since we are currently in a TCP/IP connected world, TCP/IP is basically a must for a remote connection. Therefore, the protocol is broke (for our required use.. although I hesitate to use the word broke, rather than unfitting)

A simple test to see the effects can be duplicated by the following scenario.

1. Use .Net remoting and make a simple method call that takes a string, but does nothing with it. (remoting in Singleton mode so you have one instance of the class responding to requests)
2. Simple socket call to send a small string (less than 20
bytes) to a method.

The remoting call is significantly faster (107 compared to
the sockets 58 requests per second in one test)

Sockets are simple on the receive end (and the send):

Socket ss = new
Socket(AddressFamily.InterNetwork,SocketType.Stream,
ProtocolType.Tcp);
ss.Bind(EndPoint);
ss.Listen(100); //100 in the backlog connection queue
while(true)
{
Socket sock = ss.Accept();
byte[] read = new byte[1024];
int bytes = sock.Receive(read, 1024, 0);
//Ideally you would spawn off another thread here to handle .. results are similiar, this is done here for simplicity
string messagefromclient = System.Text.Encoding.ASCII.GetString(read,0,bytes);
sock.Close();
}

Lets say in this scenario this is a mission critical authentication application that requires high throughput. The login packet may be extremely small. Having Nagle enabled can slow this down incredibly. Certain applications may say this is acceptable - for instance game development. A small movement on the screen usually equates to a small packet of data to be sent. Waiting for the maximum segment size to be reached before transmitting means data can just be queued up if a current acknowledgment is pending. In the fast paced realm of gaming where near instantaneous response is required, Nagle can slow the game down significantly. In this case it seems Alun Jones would say the protocol is broken, as disabling Nagle yields a good benefit. One could argue here then why even use TCP? Why not just use UDP? UDP after all doesn't concern us with packet size issues. It just sends. Theres no concept of connection, it just goes there. But.. will it arrive? Possibly. Do you know that you receive packets in order? NO!

You have to write something into your system to handle these issues, that's the tradeoffs with UDP, and mostly I'd say this pertains to games.

There is an excellent article on this for those that are interested in reading more (including more info on sequencing packets)
http://gafferongames.com/networking-for-game-programmers/udp-vs-tcp/

With all this said, if you have to have data integrity, order, and connections, then stay with tcp. If you cannot accept the performance hit, then either switch protocols or accept the performance hit you will take to guarantee your data's order (without writing your own management routines with udp as outlines in the above url)

Cant use temp tables in stored procs with Sql Reporting Services 2005 Report Wizard

2009-02-08T19:48:00.000-08:00

You receive something like:
Invalid object name '#Temp'

The wizard sets "SET FMTONLY ON" before running your procedure - which tells sql server to run the query without processing the results, and just sent over the data format (ie columns, types)

You can add "SET FMTONLY OFF" to the top of your procedure to bypass the wizard check.
http://msdn.microsoft.com/en-us/library/ms173839.aspx

After you do the wizard, you can remove this change.

Select Top X from Grouped Results

2009-02-08T17:46:00.000-08:00

Every now and then because of a particular design I need to get top X number from grouped results.

In this particular case, each record has a status history with it and the status changes are tracked in a related history table.
In this case we'll call it
Job
JobStatusHistory

I want the most recent status from the JobStatusHistory, but there can be many status changes per record. Luckily the solution is easy (there are others including cursor based ways, but this is a fairly elegant solution)

We can use the little known row_number over(parition by XX) t-sql command
It provides great functionality but you really don't see it too much.

This gets me all results plus a field named 'rownum' (you can call it anything since I'm just aliasing it here as another field)

select id,row_number()over(partition by jobid order by createddate desc) rownum
from jobstatushistory

So having numbered results, we can use this as a where clause to get each result.

select jobid,newstatus from(
select jobid,newstatus,row_number()over(partition by jobid order by createddate desc) row_num
from jobstatushistory) t
where row_num=1

This will number the rows and get only the first one from each group (in this case 'grouped' is ordered by created date, rather than an actual 'group by' clause.

more sql 2k5 items

2009-02-07T14:32:00.001-08:00

While messing around with authentication options I receieved:

Server Error in '/Reports' Application.
Object reference not set to an instance of an object.
Description: An unhandled exception occurred during the execution of the current web request. Please review the stack trace for more information about the error and where it originated in the code.

Exception Details: System.NullReferenceException: Object reference not set to an instance of an object.

Source Error:

An unhandled exception was generated during the execution of the current web request. Information regarding the origin and location of the exception can be identified using the exception stack trace below.

Stack Trace:

[NullReferenceException: Object reference not set to an instance of an object.]
Microsoft.ReportingServices.UI.GlobalApp.Application_AuthenticateRequest(Object sender, EventArgs e) +73
System.Web.SyncEventExecutionStep.System.Web.HttpApplication.IExecutionStep.Execute() +79
System.Web.HttpApplication.ExecuteStep(IExecutionStep step, Boolean& completedSynchronously) +176

Version Information: Microsoft .NET Framework Version:2.0.50727.1433; ASP.NET Version:2.0.50727.1433

To solve this: Change the asp.net configuration to be windows authentication rather than none on the reportmanager virtual directory (asp.net tab - edit configuration and change auth there).
This was my own fault but in case anyone else does the same thing while playing around with authentication options in reporting services this may help : )

Sql Reporting Services 2005 - The current action cannot be completed because the user data source credentials that are required to execute this report

2009-02-07T14:29:00.000-08:00

Received: The current action cannot be completed because the user data source credentials that are required to execute this report are not stored in the report server database. (rsInvalidDataSourceCredentialSetting)

This occured when using a report with an expression based connect string to connect to sql server.
The report data source is embedded and set to "No Credentials"
It works locally on my Vista machine/IIS 7 but on Windows 2003 R2 IIS 6 it does not.
So as per Microsoft on:
http://msdn.microsoft.com/en-us/library/ms160330.aspx

You can configure a data source connection to use no credentials. Microsoft recommends that you always use credentials to access a data sources; using no credentials is not advised. However, you may choose to run a report with no credentials in the following cases:

* The remote data source does not require credentials.
* The credentials are passed in the connection string (recommended only for secure connections).
* The report is a subreport that uses the credentials of the parent report.

Under these conditions, the report server connects to a remote data source using the unattended execution account that you must define in advance. Because the report server does not connect to a remote server using its service credentials, you must specify an account that the report server can use to make the connection. For more information about creating this account, see Configuring the Unattended Execution Account.

So go into the reporting services config tool and set an execution account, this worked for me.

Sql Reporting Services 2005 - The request failed with HTTP status 401: Unauthorized.

2009-01-31T00:13:00.000-08:00

When calling a render method for a report ala:

result = ws.Render(report, format, historyid, devinfo, parameters, credentials, showhide, out encoding, out mimetype, out reporthistoryparams,
out warnings, out streamid);

you receive:

The request failed with HTTP status 401: Unauthorized.

[WebException: The request failed with HTTP status 401: Unauthorized.]
System.Web.Services.Protocols.SoapHttpClientProtocol.ReadResponse(SoapClientMessage message, WebResponse response, Stream responseStream, Boolean asyncCall) +551137
System.Web.Services.Protocols.SoapHttpClientProtocol.Invoke(String methodName, Object[] parameters) +204
TestReportingServices.localhost.ReportingService.Render(String Report, String Format, String HistoryID, String DeviceInfo, ParameterValue[] Parameters, DataSourceCredentials[] Credentials, String ShowHideToggle, String& Encoding, String& MimeType, ParameterValue[]& ParametersUsed, Warning[]& Warnings, String[]& StreamIds) in c:\Projects\BidTrackerReporting\TestReportingServices\Web References\localhost\Reference.cs:1426
TestReportingServices._Default.btnGenerateReport_Click(Object sender, EventArgs e) in c:\Projects\BidTrackerReporting\TestReportingServices\Default.aspx.cs:80
System.Web.UI.WebControls.Button.OnClick(EventArgs e) +105
System.Web.UI.WebControls.Button.RaisePostBackEvent(String eventArgument) +107
System.Web.UI.WebControls.Button.System.Web.UI.IPostBackEventHandler.RaisePostBackEvent(String eventArgument) +7
System.Web.UI.Page.RaisePostBackEvent(IPostBackEventHandler sourceControl, String eventArgument) +11
System.Web.UI.Page.RaisePostBackEvent(NameValueCollection postData) +33
System.Web.UI.Page.ProcessRequestMain(Boolean includeStagesBeforeAsyncPoint, Boolean includeStagesAfterAsyncPoint) +1746

Line 1424: [return: System.Xml.Serialization.XmlElementAttribute("Result", DataType="base64Binary")]
Line 1425: public byte[] Render(string Report, string Format, string HistoryID, string DeviceInfo, ParameterValue[] Parameters, DataSourceCredentials[] Credentials, string ShowHideToggle, out string Encoding, out string MimeType, out ParameterValue[] ParametersUsed, out Warning[] Warnings, out string[] StreamIds) {
Line 1426: object[] results = this.Invoke("Render", new object[] {
Line 1427: Report,
Line 1428: Format,

The wrong (or none) credentials are specified to connect to the PHYSICAL files on your system (not the database). If using a console application (or windows form) this may work ok for you, but switching to asp.net it may fail. Your current credentials will be passed over in the interactive console or windows form application so you may not have a problem there, but in asp.net will be running under the identity of either the app pool, network service, or IUSR_MachineName and thus won't have enough permissions. Thankfully, the solution is easy though. I've seen all sorts of articles for using custom permissions, but it's straight forward, just add new network credentials to the proxy class that is generated for the webservice
/reportserver/reportservice.asmx

just add this to an instance of your proxy class (of course filling in your details:
ws.Credentials = new System.Net.NetworkCredential("your login", "your password", "your domain");

Now, there is another way around this. In IIS (I'll use IIS 7 here since that is what is on my box) you can just enable permissions for a particular user on the files. In one case, you can make it generic, and add permissions for the IUSR account for read access to the reportserver folder.
Set these permissions on C:\Program Files\Microsoft SQL Server\MSSQL.4\Reporting Services\ReportServer (or whatever folder it is on your system)

Then in IIS, enable anonymous access for the folder.
I tried setting "physical path credentials" in IIS 7 as well, then the application wouldn't have to pass them in, however then you still have the ability for users to view /reportserver, but it didn't work as would be expected - ie access still denied.

so as for allowing all IUSR - I DONT RECOMMEND THIS.

Why?

1. if you do not disable the reportserver for outside access then ANYONE can view at least some details about your reports by simply navigating to https://yourserver/reportserver (although they may not be able to run your reports if you require prompting for credentials or dont store any credendtials and expect them to be passed in as part of the app)
2. Why not just include the account in the code your application uses to access the reports?
3. Who wants the risk when dealing with reports?

but if you really want to try this and enable it only for local access (this may be just fine for your environment if you are running this system on a separate network that a webserver in a dmz accesses and the report server is not accessible to the outside world. Although if the web server is compromised then an attacker could access the report server. As of now in Vista's IIS 7 UI, you cannot set the ip restriction - they left the UI element for it out. If you want to set this in Vista, you need to install IIS 7 Admin Pack. You MUST FIRST INSTALL SP1 for Vista otherwise you can cause the admin console to fail. There's a nice blog about the pack at:
http://blogs.msdn.com/carlosag/archive/2008/03/24/IISAdminPackRequestFiltering.aspx
The module in question is IpRestrictionModule
for the admin pack see:
http://www.iis.net/downloads
http://www.iis.net/downloads/default.aspx?tabid=34&g=6&i=1682

If you want to limit to a particular address in IIS see:
--------------------------------
http://technet.microsoft.com/en-us/library/cc730889.aspx
--------------------------------
To configure an IPv4 address restriction for the management service
Open IIS Manager. For information about opening IIS Manager, see IIS 7.0: Open IIS Manager.

In the Connections pane, click the server node in the tree.

In Features View, double-click Management Service.

On the Management Service page, in the Actions pane, click Stop to stop the management service.

Select the Enable remote connections box.

Under IPv4 Address Restrictions, use one of the following procedures:

Click Allow to allow an IPv4 address or range of IPv4 addresses to connect to the management service.

Click Deny to deny an IPv4 address or range of IPv4 addresses from connecting to the management service.

In the Add Allow Connection Rule dialog box or Add Deny Connection Rule dialog box, use one of the following procedures, and then click OK:

To allow or deny a specific IP address, click Specific IPv4 address, and then type the IPv4 address in the box.

To allow or deny a range of IP addresses, click IPv4 address range, type an IPv4 address in the box, and then type a subnet mask in the Subnet mask box.

In the Actions pane, click Apply and then click Start.

---------------------------------------------

Now for the better solution, try the following code.
This was just from some local testing, but should work:

byte[] result;
string report = "/SomeCustomReportFolder/SomeReport";
localhost.DataSourceCredentials[] credentials = null;
string showHide = null;
string encoding="";
string mimeType="";
string format = "PDF";
string historyId = null;
string devinfo = "";
localhost.Warning[] warnings = null;
localhost.ParameterValue[] reportHistoryParams = null;
string[] streamId = null;
localhost.SessionHeader sh = new localhost.SessionHeader();

localhost.ReportingService ws = new TestReportingServices.localhost.ReportingService();
ws.SessionHeaderValue = sh;
ws.Credentials = new System.Net.NetworkCredential("your login", "your password", "your domain");

localhost.ParameterValue[] parameters = { new TestReportingServices.localhost.ParameterValue() };
parameters[0].Name = "parameter name"; //Case SENSITIVE!!!
parameters[0].Value = "parameter value";
result = ws.Render(report, format, historyid, devinfo, parameters, credentials, showhide, out encoding, out mimetype, out reporthistoryparams,
out warnings, out streamid);

enjoy : )

Fixing Sql Reporting Services for FireFox

2009-01-27T18:17:00.000-08:00

Sql Reporting Services has an issue with firefox in which reports will show about one inch tall in the report viewer. There is an easy fix for this, but it seems to depend on the version of firefox.
It seems to be the support of attributes on IFrame in firefox.
I'm running on 3.05 and the following works for me:

Load
C:\Program Files\Microsoft SQL Server\MSSQL.3\Reporting Services\ReportServer\Pages\reportviewer.aspx

make sure this is in the body tag (prob is by default):

<body style="margin: 0px; overflow: auto">

and the report viewer line should have this added to it: style="display:table;"
so:
<RS:ReportViewerHost style="display:table;" ID="ReportViewerControl" runat="server" />

Some say add one of the following to the ReportingServices.css, however that did not work for me. The above fix did however.

.DocMapAndReportFrame
{
min-height: 660px;
min-width: 1280px;
}
.MenuBarBkGnd
{
min-width:1000px;
}

Making sure you don't process page_load code when doing ajax

2009-01-25T02:46:00.001-08:00

When you perform an async call using ajax, you will cause page_load to fire.
There are two ways around this I use.

During ajax, we are having a postback, so Page.IsPostBack is true, and also ScriptManager.IsInAsyncPostBack is true as well. These two items generally point to ajax.
if (!Page.IsPostBack && !ScriptManager.IsInAsyncPostBack)

If you want to be certain - then you can name your controls with a particular prefix, for example "ajax" so a button could be ajaxLoadDynamicData.

In your Page_Load:

Control ctl = PostBackInformation.GetPostBackControl(this.Page);
if ((ctl != null) && (ctl.ID.IndexOf("ajax", 0, StringComparison.InvariantCultureIgnoreCase) > -1))
{
return;
}

PostBackInformation.GetPostBackControl is not built in - I don't recall where I got it or customized it from (there are several references to it on the net)

public static System.Web.UI.Control GetPostBackControl(System.Web.UI.Page page)
{
Control control = null;
string ctrlName = page.Request.Params["__EVENTTARGET"];
if (ctrlName != null && ctrlName != String.Empty)
{
control = page.FindControl(ctrlName);
}
// if __EVENTTARGET is null, the control is a button type and we need to
// iterate over the form collection to find it
else
{
string ctrlStr = String.Empty;
Control c = null;
foreach (string ctl in page.Request.Form)
{
// handle ImageButton controls ...
if (ctl.EndsWith(".x") ctl.EndsWith(".y"))
{
ctrlStr = ctl.Substring(0, ctl.Length - 2);
c = page.FindControl(ctrlStr);
}
else
{
c = page.FindControl(ctl);
}
if (c is System.Web.UI.WebControls.Button
c is System.Web.UI.WebControls.ImageButton)
{
control = c;
break;
}
}
}
return control;
}

so depending on your scenario you can detect when doing a postback from an ajax (or any) control and ignore processing.

Generating 'Wait' Images

2009-01-24T00:38:00.000-08:00

Ever want a neat image on your page to display during some wait operation (ie ajax)?

Go to:
http://www.ajaxload.info

and you can generate one for free. nice!

Enabling POP3/IMAP in Exchange Server 2007

2009-01-22T22:36:00.000-08:00

There are plenty of articles on the net for this, but these are my notes, mostly for my own reference.. and if someone else runs into the same issues I do.

Scenario: Exchange 2007 currently only used via OWA (outlook web access). Users outside of the network want to use the full functionality of Exchange.

error: Exchange 2007 POP3 "Connection not valid in this state"

1. Start the microsoft exchange pop3 and imap service. set the service state to automatic. This can be done in the exchange shell, or just load it up in services.msc and set the service there. Start them both.
Make sure the ports are set (should be by default) in the Exchange Management Console
server configuration - client access - pop3 and imap4

2. Make sure IMap and/or Pop3 its set on the user's account. In Exhange System Manager, you can set a user's avaialble access (OWA/IMAP/POP3, etc)
3. Test it out via a telnet session. As of this point - it will fail since by default plain text passwords is not allowed. you must use ssl,tls.
The error you will receive when you try a telnet session is: "Command is not valid in this state"
So: enable plain text and test through telnet.

from an exchange command shell run: get-PopSettings

UnencryptedOrTLSBindings SSLBindings LoginType X509CertificateName
------------------------ ----------- --------- -------------------
{0000:0000:0000:0000:0... {0000:0000... SecureLogin lois

Note the LoginType us SecureLogin. In this simple configuration we will allow plain text login.
Run this command in the Exchange Shell:
Set-PopSettings -LoginType PlainTextLogin
If you don't do this, you will
Restart the exchange pop3 service. You can do the same for imap - set the login and restart the service.

Then try something like this (for pop3):
telnet localhost 110

type these commands (replace with your info)
user test
pass sometestpwd
stat
list

+OK QPOP (version 2.53) at myserver.local.com starting.
user test
+OK Password required for test.
pass sometestpwd
+OK testhas 2 messages (784 octets).
stat
+OK 2 784
list
+OK 2 messages (784 octets)

ok - good. pop3 is working.

4. enable firewall port 110 to allow remote clients in and test remotely via a setup in outlook.

No problem so far.. it is all working ok. I then try to use ssl, tls, secure password authentication (spa) and even with ports open it fails. I did get a message about the cert on the server and accepted it:

After that I could not make a valid connection. I am still investigating that one.
Similiar errors receives are:
Log onto incoming mail server (IMAP): General authentication failed. None of the authentication methods supported by your IMAP server (if any) are supported on this computer.

More issues with Sql Reporting Services - The underlying connection was closed: Could not establish trust relationship for the SSL/TLS secure channel

2009-01-19T23:34:00.000-08:00

Problem: Installed on a new server, and cannot go to:

https://localhost/reports

I receive: The underlying connection was closed: Could not establish trust relationship for the SSL/TLS secure channel.

Odd, as ssl is ok (and the root ca authority which is the server itself has been added as a trusted root on the system).

This is interesting in my case, the web service identity wasn't set and it wouldn't allow me to set it to the "ReportServer" app pool, I received an error

ReportServicesConfigUI.WMIProvider.WMIProviderException: A virtual directory must first be created before performing this operation.
at ReportServicesConfigUI.WMIProvider.RSReportServerAdmin.SetWebServiceIdentity(String applicationPool)

I tried to apply default settings and received:

System.Runtime.InteropServices.COMException (0x80004005) at System.Runtime.InteropServices.Marshal.ThrowExceptionForHRInternal(Int32 errorCode, IntPtr errorInfo) at System.Management.ManagementObject.InvokeMethod(String methodName, ManagementBaseObject inParameters, InvokeMethodOptions options) at ReportServicesConfigUI.WMIProvider.RSReportServerAdmin.ResetVirtualDirectoryMappings()

awesome.

Since this is a shared server, I tried to create a new virtual directory so I could use a specific virtual dir and app pool I'd create. Upon giving a name to create, the config tool crashed.

most awesome.

Upon loading the tool and trying to set web service identity again, it let me do it for the Report Server, but failed for the Report Manager with:

ReportServicesConfigUI.WMIProvider.WMIProviderException: A virtual directory must first be created before performing this operation.
at ReportServicesConfigUI.WMIProvider.RSReportManagerAdmin.SetReportManagerIdentity(String applicationPool)

yes, a virtual directory indeed exists and somehow it doesn't recognize it.

ok.. lets go back a bit. Im not sure when sp2 was installed on this machine and I have seen issues with sp2 having to be installed again, but thats usually a different error along the lines of:

Sql errorystem.Data.SqlClient.SqlException: Could not find stored procedure 'GetDBVersion'. at System.Data.SqlClient.SqlConnection.OnError(SqlException exception, Boolean breakConnection)

So I just deleted the virtual directories from IIS for ReportServer and Reports, recreated them in the config tool, and chi was restored to the universe.

installed the certificate to:

Enterprise Trust\Local Computer and verified it was trusted root authority.

same issue.

Turning of ssl for that folder and trying with http://localhost/reports

same issue.

In Reporting services configuration manager -> Report server virtual directory -> Certificate name, nothing is specified (plus thats the /ReportServer url)

Based on some readings, I reset IIS since some people had an issue unchecking ssl until they restarted IIS. No go for me.

I checked everything with the certificate. The server's certificate is from Exchange 2007 - IE auto generated when it was installed. I checked in trusted root certification authorities and the server's root ca certificate was in there.
I checked in IIS - the certificate was OK, not expired and showing up as OK as well.

since I was trying to connect to localhost/reports I used the system name:
http://lois/reports

same problem.

so at this point, ssl is off from the sql server reporting services configuration tool, and I've unchecked it from the virtual directory in IIS.

So whats the solution?
In the file notepad d:\Program Files\Microsoft SQL Server\MSSQL.2\Reporting Services\ReportManager\RSWebApplication.config
there are two items which need addressing

1. ReportServerUrl, which in my case was blank and ReportServerVirtualDirectory which was set to Reports

According to MS, they are mutually exclusive, IE you can only set one or the other. So I removed the virtual directory entry and set the report server url, and saved it and voila.. it worked:

<reportserverurl>http://lois/reportserver</reportserverurl>
<reportservervirtualdirectory></reportservervirtualdirectory>

another note: if you have generated your own certificate, the system you are deploying from won't be able to deploy to the target server as well. You will receive the same error in addition (in visual studio) viewing the extended error information you may see:
"The underlying connection was closed: Could not establish trust relationship for the SSL/TLS secure channel. "
"The remote certificate is invalid according to the validation procedure. (System)"

So, navigate from your system to the report server. View the certificate and import it into the trusted root certification authorities, and then on the certificate path tab (right click on the document and choose properties) check to make sure there are no Xs on the certificate issuer. If there is - import it from there into the same store - trsuted root certification authorities.

OH but wait!
I can see all the report definitions, but when I attempt to run them I receive:
The request failed with HTTP status 401: Unauthorized.

hmm. I tried all different auth options, and removing ssl.

nothing.
If I turned off integrated auth and turned on anonymous access, I'd receive
The permissions granted to user 'ABBSATT\reportuser' are insufficient for performing this operation.

now.. if I used the url to go to the report server using ssl directly, it worked just fine. That was the clue I wasn't using the correct url in the rswebapplication.config

So, I went into the reporting services config tool, and did the "Apply Default Settings" on each so I could start from scratch.

Again (as expected) I was back to:
The underlying connection was closed: Could not establish trust relationship for the SSL/TLS secure channel.

I went into rswebapplication.config and changed the url I modified above to https://......
instead of http, and voila. it worked. all good... in all scenarios.

Network provider issues and Sql Server Reporting Services

2009-01-19T23:25:00.001-08:00

I installed reporting services on my new laptop.
I tried running it, and it hung for a long time and came back with an error:

Logon failed. (rsLogonFailed)Could not load file or assembly 'BCMLogon, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null' or one of its dependencies. Failed to grant minimum permission requests. (Exception from HRESULT: 0x80131417)Required permissions cannot be acquired.

hmm. why is a library made by broadcom being an issue just connecting to sql reporting services on a local machine. I changed some settings in IIS for authentication to allow everything same as the actual report server which I could get in to configure items, just not run a report.

Finally the light went off - this library is:
"BcmLogon: Provides credential information (user name, password, domain) used by wireless management software for login to wireless networks. Optionally enables wireless login at startup for SSO environments.Dell Wireless WLAN Card Logon Provider"

As such inthe system its a network provider. A quick search of the registry for BCMLogon shows:

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\NetworkProvider]
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\NetworkProvider\HwOrder]"ProviderOrder"="LanmanWorkstation,RDPNP,webclient,BCMLogon"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\NetworkProvider\Order]"ProviderOrder"="LanmanWorkstation,RDPNP,webclient,BCMLogon"

Hey.. its last in the chain here (and you can verify by going into your network connections, advanced menu, and then advanced settings, and then provider order.
Dell Wireless WLAN Card Logon Provider is indeed the last one.

now in my case, I dont need it.. so the fix is simple. I renamed the dll in c:\windows\system32. I can still acess my wireless network just fine.

I did try configuring this assembly, permissions were ok on the file itself, and it should be full trust, so not sure where is was breaking down, but the fix worked for me.. for now and its late anyways : )