Microsoft®
Web Admin Tool 1.0 Sample Web-based Provisioning
Tool |
Table of Contents Installation of Web Admin web pages Office 2000 on Terminal Server |
This
document lists critical issues that can potentially impede you from
successfully installing or deploying the Web Admin Tool in your environment.
Web Admin is a tool to enable users and administrators to
manage their respective resources via Internet Explorer. Web Admin is a great example of how Windows
2000 and Active Directory can be easily leveraged and utilized.
Users, groups, and organizational units can be created,
modified, and deleted in a similar fashion to the Active Directory Users and
Computers MMC snap-in.
Web Admin is not a replacement to the Active Directory
Users and Computers MMC snap-in, but it does provide a great example of how to
utilize the Active Directory. This tool
should provide a good starting point for the creation of a web based
administration utility.
Web Admin was developed in Visual Interdev 6.0 using
Active Server Pages, Visual Basic Script, Active Directory Service Interface
(ADSI), Internet Explorer 5.0 (IE5), and Windows Management Instrumentation
(WMI).
The following bullets point out the main goals for the Web
Admin development effort:
It is also necessary to point out what Web Admin doesn’t
achieve with this first release of the tool:
Overall, the Web Admin tool will provide you with a great
place to start. This is especially true
for understanding how to effectively utilize and leverage the power of Active
Directory and ADSI.
The
Web Admin tool is a Sample tool that is not meant to be used in a production
environment. The tool has not been
regression tested for use in a production environment. It is also important to note that the Web
Admin is not supported by the Microsoft Corporation. Please read the EULA.htm
file also located in the Web Admin Zip File for more details.
Below is a list of items that need to be decided on prior
to installing the Web Admin.
The list below indemnifies the clients that are able to
access Web Admin.
Web Admin functions without the need for hard coding your
domain, server, or any other name. It does this by recognizing what
domain the server that is serving up the web pages for the Web Admin is a
member. So, for it to function properly, the following requirements ALL
need to be satisfied:
The AdsType.dll was created for the ViewAcl.asp page. The ViewAcl.asp page allows an administrator
to see all of the Access Control Entries for a given object. ADsType.dll serves one purpose ---and that's given the cn (common
name) of a schema class or attribute, fetch the corresponding schemaIDGUID
attribute, convert it to a string using the StringFromGUID2 Win32 API, and
return the string to the calling script. The issue is that the schemaIDGUID
attribute is stored in the schemaNamingContext as an OctetString.
Unfortunately, VBScript cannot read OctetStrings ---much less convert an
OctetString to a string as required by the IADsAccessControlEntry::ObjectType
and InheritedObjectType properties. So in order to initialize an ACE's
ObjectType and/or InheritedObjectType properties for delegation purposes, one
must find a way to convert the schemaIDGUID from an OctetString to a string if
they're using VBScript. There are a few possible solutions:
1.
Develop an ActiveX component to perform the conversion ---that's what is done
with ADsType.dll.
2.
Hardcode the schemaIDGUID's in your script or the like. You can find the
string-i-fied representation of the schemaIDGUID in the Active Directory
Developer's Reference Library ---see Volume 5, Active Directory Schema.
3.
Finally, you can use something other than VBScript, e.g. Perl. You can convert
OctetStrings to anything you like using Perl's unpack function.
In
order to use the AdsType.dll, it will need to be registered. This is done by using the regsvr32.exe which
part of the Windows operating system and is available at the command prompt.
Note: In order to secure the Web Admin tool authentication,
it is recommended that you enable Secure Sockets Layer (SSL) on the IIS
server. Please refer to the IIS
documentation for details on how to configure SSL. This is VERY
important, because authentication between the client browser and the web server
is done via basic/clear text.
After
completing the Wizard, it would be best to turn off the link to the Wizard.
This can be done by editing the Config.asp page, which is located
in the “<build number>\ HTML\Lib” Web Admin Tool source tree
directory. Open the config.asp with
notepad and search for the constant variable Hide_Setup_Wizard and set
this variable to equal True. Note: A refresh within Internet Explorer will be necessary for
this change to take affect.
For the Web Admin to function properly with
Exchange, Exchange must be installed on the Web Server the Web Admin is running
on. This is necessary because of the
Application Programmers Interface’s (API) that are called from the Web Admin
when performing Exchange 2000 specific functions. The full installation of exchange is not necessary for the Web
Admin to function properly.
During the Installation of Exchange, and Component
Selection screen will appear. This
section will allow you to chose what major functionality of Exchange 2000 you
want installed on the server. As far as
the Web Admin goes, it only needs Microsoft Exchange System Management
Tools. This will give you the bare
minimum to use the Web Admin with Exchange 2000 provisioning.
There is a catch though. There is one other object that is needed for the Web Admin to
function properly. The Microsoft CDO
1.21 Library Object is also needed for the Web Admin to function properly. This object is located on the Exchange 2000
CD (Setup\I386\Exchange\Bin\CDO.dll).
Copy the DLL and paste it in the WinNT\System32\ folder on the
server. Then register the DLL using
regsvr32.exe: regsvr32.exe <path to
the CDO.dll>\CDO.dll
The CDO.dll can also be found for download at: http://www.microsoft.com/exchange/downloads/CDO.htm
This is a bit of a hack, but it keeps you from having
to install the entire installation of Exchange 2000 on the Web Server.
If you also chose as a part of the installation for
Exchange 2000, “Microsoft Exchange Messaging and Collaboration Services” you do
not have to manually register the Microsoft CDO 1.21 Library
If using Exchange Front End Servers for Outlook Web
Access, installing the Web Admin on one of these servers is preferred. Now all you have to do is install the Web
Admin and the Web Admin Exchange DLL on that server.
The Web Admin now has the capability to create a
new DNS Zone and record for a given service.
By default, DNS Services are not enabled. This is due to the fact that it takes
additional steps to configure this. In
the Extras\DNS WMI folder there is another zip filed named, “dnsprov.zip.” Unzip that file to the local hard drive and
follow the installation instructions.
Then enable DNS Services for the Web Admin.
Below is a subset of the DNS Installation
instructions:
To
install the dns provider,
1.
Copy dnsschema.mof and dnsprov.dll to
<winntdir>\system32\wbem.
2.
Run "mofcomp dnsschema.mof" to register the
class information.
3.
Run "regsvr32 dnsprov.dll" to register the dll.
Steps
1-3 must be done on all servers that the Web Admin is being ran from. Only Setup 2 is necessary on the target DNS
Server. The DNS Server must also be at
least a member server of the domain in which the Web Admin is
administering. This is because the DNS
WMI Provider functions off of the current users security context that was given
during logon to the Web Admin.
To
enable DNS Services for the Web Admin:
1.
To make this setting permanent, open the Global.ASA file
and set the Enable_Service_DNS to True
2.
To make this setting take affect immediately, but
temporary, Click on Manage Organization and then click on the Config link on
the Web Admin toolbar. Set the Enable
DNS to True, and then click the Set button.
There
are multiple methods of logging that the Web Admin is capable of doing. Below is list of the types of logging the
Web Admin can do and the values that are used by the Constant LOGGING_TYPE that
determine which type of logging the Web Admin will use.
1
= No Logging -No events will be logged.
2
= File System -Stored in a text file on the local Web Server
3
= Event Log -Store in the Application Event Log
4
= SQL Database -Store in a SQL/MSDE Database - Follow Direction below
The
Constant LOGGING_TYPE can be found at
\html\Lib\config.asp.
If
you Choose SQL Logging, you must first do the following steps.
1.
Run the Web Admin SQL Setup Script: SQL\SetupLogDB.sql on
your SQL 2000 Server.
2.
Edit the file, “\html\Global.asa” and edit the Constant
LOGGING_SQL_PROVIDER to reflect the proper settings for Server, Database, User
Id, and Password.
3.
Uncomment all fields in the Global.asa that are properly
marked for SQL Logging. ( Read the
embedded comments in the Global.asa, they will give further directions)
4.
Save Global.ASA
5.
Set the Constant LOGGING_TYPE to 4 (this is in the
Lib\Config.asp file)
By
Default, LOGGING_TYPE is set to 2 for File System Logging on the C drive.
When
SQL based logging is enabled, reporting is also enabled. If the logged on user to the Web Admin is an
Organizational Administrator or higher, they are able to see a link named,
“Special” while managing an Organizational Unit. By Clicking on that link, the user will see other selections that
are special, to include Reporting. For Beta 3, only RAW Reporting is enabled.
By
Default, the Web Admin will add a profile path to each new user that is
created. This will be the location of
the roaming profile for the user. To
set the proper location for your environment, open the Global.ASA file and
modify the SET_USER_PROFILE and DEFAULT_PROFILE_PATH attributes to the settings
of your choice.
The
Web Admin is very flexible when it comes to branding. For a Service
Provider to brand the Web Admin with their own top and side bar navigation,
they would only need to modify two files: : Header.asp and Home.asp. Neither
of these files may be directly overwritten or erased, but they can be heavily
modified. There are two html comment tags in each file that points out
what can and can't be modified or erased.
The
Web Admin gives the Service Provider the ability to determine how the Web Admin
will function with some simple modifications. Config.asp is the file in
which the Service Provider can make these functional changes. The file is located in the <path to
WebAdminTool>\build 8\lib folder. This file contains a number of
constant variables that function as "switches." The function of
a switch is to allow for the Service Provider to turn certain features on and
off. Within the file, Each switch has its own description of what it does. Note: The Web Admin is a web
application that can be put on many different servers. To maximize
consistency, make sure that all of the switches are set identically on all
servers.
To
do any type of provisioning of services for a particular organization or user,
you must be a direct member of the Domain Administrators or Enterprise
Administrators Group for that specific domain. If you are a member of a
group that is a nested in one of the two groups mentioned above, you would not
be able to provision any services.
The
Web Admin allows for fast, easy, and consistent management of the Active
Directory. It does it in such a way that it allows for Service Providers
to create a new organization and a single user in that organization with
organizational administrative rights. An organizational administrator has
the ability to create and manage all users, groups, organizational units, and
services within their respective organization.
Administration
Roles
There
are 4 roles that the Web Admin takes into account. These roles are used by the Web Admin to determine what
information should be show to the user and what actions that user can
make. Active Directory Security is used
to enforce what a user can and cannot do.
Domain Administrators: Domain Administrators are at the
top of the food chain. To be a member
of this role, a user must be a direct member of either the Domain
Administrators group or the Enterprise Administrators Group.
Multi Organizational Administrator: Multi Organizational Administrators are
allowed to create New Organizations and administer only the Organization that
they created. The only way to become a
Multi Organizational Administrator is to:
1.
Logon to the Web Admin as a Domain Administrator or Enterprise
Administrator.
2.
Create a New Organization, but before clicking on the
Create button, make sure the check box next to, “Multi Org Management” is
checked.
3.
Click the Create Button
4.
Create a new User
5.
Select the Mutli Org Adminstrator Checkbox
6.
Click Create
Now
the new user that was created above can create and manage other
organizations. Even though the Mulit
Org Administrator has full rights to the Organizations that it created, the
user must still be appointed as an Organizational Administrator to administer
its own Organization.
Organizational Administrator: The Organizational Administrator can
administer all of the users, groups, and computers that lye within their
Organization. This includes Creating
and Managing New User/Group/Organizational Units, Reset Passwords, Edit Users
Information, etc. If enabled, the
Organizational Administrator may also provision Exchange 2000 mailboxes to
their own users.
End User: End Users
are at the bottom of the Management food chain, but they are the most important,
because they are the reason why all of this is done. End Users can manage their own information as well as search for
other users and view their information.
The
Web Admin has the ability to provision Office 2000 installed on Windows 2000
servers utilizing Terminal Services.
However, the Web Admin is unable to setup the environment needed to
allow for that service to work properly.
There
is another toolkit with scripts and documentation that explains how to enable
that service. Once the service is enabled, the Web Admin can provision
the service for an organization and the users within them.
In
Config.asp set the following Constants to False if you are not going to
provide Office 2000 via Terminal Server as one of your services.
To
Enable the Service for a particular Organization, let's
assume that you already created an Organization called,
"CompanyB.com” This new Organization also has a user name Mark Smith
that was been named as an Organizational Administrator.
Now
to enable Service for Mark Smith:
The
Web Admin allows for the provisioning of Exchange 2000.
In
this release of the Web Admin, the provisioning of Exchange is not very clean
nor scalable for a large service. It is however, a good step in the write
direction. It does, in the release, show how Exchange can be a service
that is both appealing to customers and provisioned via the web.
In
Config.asp set the following Constants to False if you are not going to
provide Exchange 2000 as one of your services.
To
Enable Exchange for an Organization:
Create
a New Mailbox for an existing user:
§
Example: <domain>\administrator
Items to Check:
§
Is the Directory in Native Mode? For the Web Admin to function proplerly in a Service Provider
type of environment (which it’s in by default), the directory needs to be in
Native Mode. This is due to Group in
Group Nesting required for efficient security settings. Please reference the Microsoft Active
Directory Application Service Kit (ADASK) http://www.microsoft.com/ISN/whitepapers/active_directory_ASP_Kit.asp?A=0
§
Is the server that the Web Admin installed on (the web
server) a domain controller? By
default, only Domain Admins can log onto a domain controller. Please read item 1 in the Known Issues
section above for more details.
§
Check the Event Logs for other information.
There is no support provided by Microsoft for the Web
Admin Tool. Please Reference the
END-USER LICENSE AGREEMENT FOR MICROSOFT SOFTWARE provided for more information
on the license agreement.
There is a growing community surrounding the Web Admin.
v
Websites:
Ø
Official Microsoft Website: http://www.microsoft.com/ISN/WebAdmin/
v
Newsgroups:
Ø
Microsoft : Please visit the site above for more
information.
v
E-mail: (Please only send Comments, Feedback, or Bugs Reports ONLY.)