ComReg - A Vertual Community Registration System

ComReg - A Virtual Community Registration System

Technical Manual

Design: | Transparent Systems Limited
Version: | 2.0
Last Updated on: | July 12, 2000


Table of Contents

Introduction
Feature list
System architecture
Installation of software
Software upgrade
Security
Anonymous logon
ComRegUsers

Home


Untitled

Introduction

The purpose of Register System is to register new users of a virtual community, like Geo Cities.
ComReg is a web application that allows people to upload web pages and interact via the Internet.
A person living in ComReg is called citizen.

A sample registration database is present in the form of an MS Access 97 database. You can import the MS Access database into MS SQL Server or any other ODBC compliant database. ComReg can handle any ODBC compliant database.
The security of the registration process is completely integrated with Windows NT.
After registration in the register database:,br>

  • A user account is added to SAM
  • A directory is created on the Windows 2000 server
  • Several groups, users and permissions are assigned to the directory
  • A home page is created on the directory
  • An email is send to the citizen.
The registration is performed instantly by some COM+ components on the server.

Registering a user consists of the following:

  • add user to user table
  • add address to Zone address
  • update link in user table to its new address
The functions performed by the Check program are:
  • Frequently check if there is a new citizen
  • Add user account to SAM
  • Add user to group
  • Create directory using address of user in database.
  • Set directory permissions
  • Store authorization information in the register database
The whole system is parameter driven. These parameters are stored in the parm table.


Feature list

  1. N-tier architecture with ASP, COM+ running on Windows 2000 Server.
    On the web server runs IIS 5.0 with ASP pages and COM+
  2. System is parameter driven and can be tuned to specific requirements.
  3. Extremely secure, because all permission can be set by the web master for the COM+ components.
  4. Creates user and zone address in ODBC register database
    Example MS Access database is delivered with ComReg.
  5. Creates a Windows NT user account on web server or primary domain controller
  6. Assigns a user account to a group
  7. Creates a directory for the user
  8. Sets specific directory permissions for user account and several other accounts
  9. Creates a personalized home page
  10. Sends an error report by email to support of the Virtual Community
  11. Sends a confirmation message by email to the user
  12. Logging of events in Windows application event log.


System architecture

System scheme
System description

Table of Contents Next


System architecture: System scheme

The scheme does not show the web pages invoking the programs or confirmation pages.


System architecture: System description

General
Security
ASP Pages
COM+ components
Files

Table of Contents System architecture Next


System architecture: System description: General

The register system is based on a n-tier architecture.
The client part consists of Active Server Pages available via a web server.
The server part runs as COM+ components on a web server.
This system provides security that is seamlessly integrated in Windows NT security.
The components required to run the system are:
  • Windows 2000 Server
  • IIS 5.0
  • ADO 2.5 installed
  • Setup
    This a 2 stage process.
    The first part installs Vb components.
    Thereafter a selfextracting file will copy all web files and COM+ components


System architecture: System description: Security

System architecture: System descripiont: Security

The n-tier architecture of Register System isolates the security of the web server from the Internet.
The web master assign paermissions to a COM+ component. This ensures maximum security.
This is different from the CGI way of handling server requests.
If a CGI program assigns a user account, this is done under the anonymous logon user.
In that way the security of your web server is open to the whole world.
It is rather simple to retrieve the anonymous logon user on a web server. The next step is the password.
This can be done using automated tools. Thereafter a hacker can take complete control of the web server.

Table of Contents System architecture System description Next


System architecture: System description: ASP Pages

The main ASP pages from an user/web master point of view are.

Register.asp
This is the start page for end-user registration

UpdateUser.asp
Handles updates to user data.

UpdatePassword.asp
To change your password

DeleteUser.asp
To delete a user.
This will delete user and all other data stored on the web server from this user.
A user can delete themselves.
An admin can delete any user except themselves.
An admin is a user who belongs to the admin group.
The sample database has the following admin:
UserId = Admin
Password = Admin


System architecture: System description: COM+ components

TSComreg.dll
The purpose of TSComreg.dll is to register or deregister a user.
The program performs the following functions when registering a user:
  • Add user account to ComReg group
    The group name is derived from the global.asa file
  • Create directory for user
  • Set the following permissions
    Adminstrators Full Control (All) (All)
    Everyone Read (RX) (RX)
    Change (RWXD) (RWXD)
    Change (RWXD) (RWXD) In this is:
    • the Anonymous Logon account
    • is the username of the citizen.
  • Confirm authorization in the register database
  • In case of a fatal error log a message in the event log
  • In case of a fatal error send email to support
  • Send email to user.
When a user is removed from ComReg all previous actions are reversed.

Whenever a user registers TSComreg.dll performs all actions required.
A new user account is than added to the Windows NT SAM file. The user account is added to the ComReg Users group. A directory is made from the zone address as derived from the register database. Then the user account is assigned change permission to the directory.
The permissions of IUSR are set to enable writing files to the directory via a web browser. For example Web Maker can create a complete personalized web site in a directory without uploading of web pages.
WebMaker is an other product of Transparent Systems.

If anything goes wrong during the security processing an error message will appear in the application event log.
Both the email to the user and to support will contains the exact error that occurred during registration.


System architecture: System description: Files

System architecture: System descriptions: Files

Register_db.mdb
Example database with user, zone and zone address.
Can be replaced by MS SQL Server or any other ODBC database.

Global.asa
This is where the system settings can be entered by the web master.

Example of global.asa

<SCRIPT LANGUAGE='VBScript' RUNAT='Server'>

'You can add special event handlers in this file that will get run automatically when
'special Active Server Pages events occur. To create these handlers, just create a
'subroutine with a name from the list below that corresponds to the event you want to
'use. For example, to create an event handler for Session_OnStart, you would put the
'following code into this file (without the comments):

'Sub Session_OnStart
'**Put your code here **
'End Sub

'EventName              Description
'Session_OnStart        Runs the first time a user runs any page in your application
'Session_OnEnd          Runs when a user's session times out or quits your application
'Application_OnStart    Runs once when the first page of your application is run for the
first time by any user
'Application_OnEnd      Runs once when the web server shuts down

</SCRIPT>
<SCRIPT LANGUAGE=VBScript RUNAT=Server>
Sub Application_OnStart
    '==Visual InterDev Generated - startspan==
    '--Project Data Connection
        Application("RegisterDSN_ConnectionString") = "Provider=MSDASQL.1;Persist
Security Info=False;Extended
Properties=""DBQ=D:\InetPub\wwwroot\ComReg\db\register_db.mdb;DefaultDir=D:\InetPub\wwwro
ot\ComReg\db;Driver={Microsoft Access Driver (*.mdb)};DriverId=25;FIL=MS
Access;FILEDSN=C:\Program Files\Common Files\ODBC\Data
Sources\RegisterDSN.dsn;MaxBufferSize=2048;MaxScanRows=8;PageTimeout=5;SafeTransactions=0
;Threads=3;UID=admin;UserCommitSync=Yes;"";"
        Application("RegisterDSN_ConnectionTimeout") = 15
        Application("RegisterDSN_CommandTimeout") = 30
        Application("RegisterDSN_CursorLocation") = 3
        Application("RegisterDSN_RuntimeUserName") = "admin"
        Application("RegisterDSN_RuntimePassword") = ""
    '-- Project Data Environment
        'Set DE = Server.CreateObject("DERuntime.DERuntime")
        'Application("DE") = DE.Load(Server.MapPath("Global.ASA"),
"_private/DataEnvironment/DataEnvironment.asa")
    '==Visual InterDev Generated - endspan==

    'Dir where zones are located, relative to root, (i.e. if your dir for zones is
"Zones", enter /zones)
    Application("ZonesURL") = "/comreg/zones"

    'Standard user description you would like to appear in your User Manager (i.e.
Community users)
    Application("UserDescription") = "ComReg User"

    'Name of the group you want these users to belong to (the group name you list here
will be automatically created).
    Application("GroupName") = "ComReg Users"

    'Group description
    Application("GroupDescription") = "ComReg group with 'log on locally' user rights"

    'Name of your default page template - we recommend leaving as named.
    Application("DefaultTemplate") = "default_template.htm"

    'Email address where you want registration errors to go to
    Application("ComRegSupport_EmailTo") = "support@transparent.co.nz"

    'Email address you want confirmations sent from
    Application("EmailFrom") = "info@transparent.co.nz"

    'Enter email address where you want registration errors to go to, for example
support@cynet7.com
    Application("Support_EmailTo") = "support@transparent.co.nz"

    'Enter the Email Subject for all new registration confirmations
    Application("EmailUserSubject") = "ComReg User Confirmation"

    'Enter the email address you want confirmations sent from (i.e. info@cynet7.com)
    Application("EmailFrom") = "info@transparent.co.nz"

    'Do not remove error codes below this line. You can add additional error codes if
applicable.
End Sub
</SCRIPT>

Explanation
The only parameters you have to change are:

Database name.
Change "D:\InetPub\wwwroot\ComReg\db\register_db.mdb" to the path of your database.
Test the system first with the sample database.
When you decide to use a MS SQL database, you setup a Data Source Name (DSN) for the database, like "RegisterDSN" and replace replace the complete connections string by "RegisterDSN"

Email adress
Replace email to domain @transparent.co.nz to @yourdomain.co.nz

All other settings are self-explaining and can stay as they are.


Installation of software

Refer to install.txt for the latest installation instructions.
TSComReg.exe is a self extracting file.
After extracting the files and folders you will find setup.exe. In addition setup.exe will install ..\Comreg\comreg.exe
Run comreg.exe to install all web files.

After installation of the software, files and database test drive the systems by:

  • Adding a user via /comreg/register/register.asp
  • Update a user by /comreg/register/updateuser.asp
  • Update password by /comreg/register/updateupassword.asp
  • Delete a user by /comreg/register/deleteuser.asp


Software upgrade

The system administrator can simply copy the files over existing files after receiving software upgrade.
Refer to installation of software.

Table of Contents Next


Security

The security of directories and files on the Internet server has to be set by the system administrator

Table of Contents Next


Anonymous logon

The following table shows the permissions to be set for the Anonymous Logon user
By default this user is mapped on IUSR_
For example IUSR_NT1
Any browser gets all permissions and right of the Anonymous Logon user

Filename | Read | Write | Execute
‹webroot›/cgi-bin | X |  | X
‹webroot› | X |  |
‹webroot›/db/ | X | X |

Permissions for each address will be set automatically by the Check program

The permissions have to be set for group "ComReg Users" (refer to parm table)


ComRegUsers

The group ComReg users is set in the parm table.
Any new member is added to group ComRegUsers by the Check program.
This group can be given read access to /zone/zone as this would allow any user to overwrite files of other users.

Filename | Read | Write | Execute
‹webroot›/zone | X |  |

Select Icon form


ComRegUsers: Select Icon form

Within a registration session a user can select an icon. The registration program can determine which user is selecting an icon and will update the graphic field in the register table.
Between sessions, this is not true.
In order to enable users to change their icon (or any other user field) after the initial registration a logon procedure is required.
After a user successfully logs on the remote IP address will be stored. During that session the system knows who is logged on.

Table of Contents


Table of Contents

Introduction
Feature list
System architecture
System scheme
System description
Installation of software
Software upgrade
Security
Anonymous logon
ComRegUsers

Home


Table of Contents

Introduction
Feature list
System architecture
Installation of software
Software upgrade
Security
Anonymous logon
ComRegUsers
Select Icon Form

Home


Table of Contents

Introduction
Feature list
System architecture
System scheme
System description
General
Security
ASP Pages
COM+ components
Files
Installation of software
Software upgrade
Security
Anonymous logon
ComRegUsers

Home