I want to build a page for end users to visit (in our MPLS Network) and it show the following information in regards to them:
Computer Name
OS
Disk Space
Memory
IP Address
Active Directory User Name
Password Expiration Time (As defined by Global Policy)
Maybe a few other things such as Trend Micro Office current version vs. their version, # of MS Updates needed (we utilize WSUS), and a few other things in the future.
My question is how would I pull this information from the user when they visit the page? What is the proper function for this? Anyone have examples they wish to share for me to learn by if possible?
You won't be able to show all of this using C#. C# is a server side language and therefore, only has access to that information relative to the server it's being hosted on. You might be able to access this information from a java applet that runs on the page in the user's browser, but I'm not sure. There are usually security restrictions involved.
If you allow your web page to gather all this information about your users, what's to stop some other web page from doing the same?
So it's in an intranet only? You could use the client computers IP address (as reported by the Request.UserHostAddress) and then query your domain controller for the information (via the DomainController class and the collections/methods it exposes).
Most of the information you're after will be available via the Domain Controller, and some of the others can be retrieved by using remote performance counters (for example, you could query for free disk space using the LogicalDisk\% Free Space counter).
You cannot do this without writing a browser plug-in or a java applet.
The information is not available through javascript, and it's not in the headers sent by the browser. This is by design, for security reasons.
Edit This answer only applies to public pages; I see from subsequent comments that it will be intranet-only.
You might want to look at XAML Browser Applications (XBAP). It's similar in a way to Silverlight except you get the advantages of the full .Net framework. To be able to access some local resources you would need to use the trust mode as explained below.
WPF XAML Browser Applications Overview
Creating a Full Trust .xbap Application
Related
I have a single solution with multiple C# ASP.NET Web Forms projects. I want a way to identify a given browser so that each website can identifier that same browser. I need to do this from the C# Code-Behind code (not with the client code, like JavaScript). I also cannot use the Session because it isn't shared across websites. I don't think cookies are either.
For example, if a user logs onto Website1 and then logs onto Website2 with the same browser on the same computer, I want to be able to identify that. But if a user logs onto Website1 with Chrome and then Website1 with FireFox (regardless of whether it's on the same computer or not), I want to detect that as well.
If it makes any difference, I am using Azure to publish my web projects. So all websites will have similar domains (eg website1.azurewebsites.net and website2.azurewebsites.net).
If you want to track someone using the same browser on the same computer then use a cookie. If the websites have different domains you'll need to be clever because modern browsers have a lot of protection against what they see as tracking cookies. One option is using a hidden interstitial page as described here.
Your second scenario, a user accessing same site with different browsers, I suggest storing the user agent string (one of the request headers) and adding this to a login audit so you can build up a collection of different user agents used by a given user. There are libraries available for parsing user agent strings and extracting name, version, engine etc.
Between these two techniques and a bit of business logic you should get what you need. If you would like me to clarify any of this, let me know and I'll provide more detail.
I want to put restriction like certain Regions, Cities and Countries should not be able to access my website. I came across some concept like GeoFencing, but I guess that can only be implemented on Windows Phones Or Windows 10. I came across few free APIs that would return me my client's location details.
I am working with Visual Studio 2015.
I also came across HTML5 GoeLocation, it is will ask user for permission to allow website to know his/her location; which is not good enough for me.
I want to know, what are other better choices or solutions we can look into?
Also, since I am using IIS server for deployment, can I use .htaccess in my case?
I have came across this IPSecurity configuration at server level. Is this a viable option? Has anyone tried it?
TIA
There are things you can try to do to find out the location of the user.
As you already found you can request their location from their browser, but that requires asking their permission, and it can be unreliable.
The location can be manually set, and in the case of desktop computers it's unlikely the computer has a GPS attached to provide a good location.
Another option is to look up thier IP in a geoip database: GeoIP2 City Database Demo
There does appear to be a GeoIP module for IIS 7+, but I haven't tried it personally: IIS7 Geoblock Module
But, these methods are unreliable and can give indeterminate, or even flat out wrong results.
The user can decline to provide their browser location, or the user can set their browser location to be the other side of the world.
And what IP is the user using? What about if they use a VPN? Now you have the geolocation for the VPNs IP.
The real answer is that you can't reliably find out where the end user is.
.htaccess
.htaccess is one of the ways Apache allows configuring security.
IIS uses different configuration methods.
Both IIS and Apache require 3rd party modules to restrict access based on geolocation, it's not something provided as standard.
We have a developer debugging tool to help manipulate security section of a database that our product depends on. This tool's purpose is to inject state into database to reduce time to create test scenarios. The database is not typical database that one can manipulate using sql. Rather it is a binary file that only our tool can manipulate. This is a C# application.
If this tool goes outside our company (say someone emailed it to a customer who shared it somewhere public), that could open lot of security issues.
We like to build intelligence into this tool so that it is usable within company or at partners network with whom we shared the tool. We have no knowledge of partner's network.
I am wondering what the suggested ways of implementing it?
Like:
Ping company active directory server or exchange server. Allow the tool usage if you can reach one of these servers.
Package a certificate with the tool that expires a month from build date. Always check if the cert expired or not before allowing usage of the tool.
Modification of (2). Make every user to request a key to unlock the tool after specific date.
Before we go implement a solution, I am wondering if there is already a library that does this.
Thanks
Assuming you host "file" inside your organization and all parties just access it somehow. If you give both data and tools to modify it to external partners there is nothing really to stop them to modify data as they pleased (short of legal/administrative actions but that is outside of SO scope).
There is also really not much you can do to protect code running on user's machine irrespective if it is C# or native compiled code. .Net code is a bit easier to modify/bypass protections but if you concerned about securing access to a file you need to protect files/servers rather than worry about client side code.
Usual solution to such problem - authentication and authorization: only allow authenticated users to access the file and only accept changes from authorized users.
If you use file based storage than inside your organization regular Windows domain accounts would work for authentication and regular file system permissions would work for authorization.
For outside partners you probably would need server to perform modification of the file(s) and authentication/authorization possibly using ADFS or Oauth.
Ok I know this is a probably a very basic question but I'm more of a winform person.
Question is simple.
If we Add System.IO to a Web Form . Can we then use a StreamWriter to write a log file to the end user Computer?
For example if page_Load use the following code:
StreamWriter sr=New StreamWriter("C:\abc.log)
sr.Write("ABC")
Then where this abc.log file is created? on webserver or on end user? If on websever then how can we write it on the end user machine?
I want to write a log file on the client machine. What are options? Is using a cookie an option?
No - that is not the way the web works...
You could present the Log as an download, that would be the cleanest solution.
As everyone in this thread has pointed out: this is simply not possible. Now depending on what you are trying to store you could leverage cookies to store some information on the users computer but this can be cumbersome and you are limited to 4K of information. That being said HTML5 offers the new JavaScript objects localStorage and sessionStorage which are basically a key/value dictionaries. localStorage would probably suit your needs best I think since it will persist information on the users PC after the browser is closed. For example:
function logSomeData(message) {
localStorage.logFile += message;
}
function showData() {
alert(localStorage.logFile);
}
If you run the logSomeData function in a browser, close the browser, then come back and run the showData() function the value you added to logFile will be persisted. This isn't a new concept, this is doing exactly what cookies do today except that localStorage is easier to work with (in my opinion) and it can store much more information (2MB to 10MB depending on the browser). It is worth pointing out that this is a new technology so older browsers like IE7 can't use localStorage.
Please let me know if you have any other questions!
As far my knowledge you can't write the client file using asp.net.
In your example you are writing the file where application is hosted.
Means the application server's c:\abc.log
All the code behind in asp.net runs on the server so the code you posted will write to the server machine.
Browsers don't allow interaction with the local machine file system for security reasons
You could use some other technology (e.g. an ActiveX control hosted in a web page)
why you want log file on client site ?
if you want to store some information on client site use cookies
If you're stuck to Internet Explorer 6, the only solution to be able to store client-side data, is to use userData Behavior. It well let you store up to 128kb.
I would recommend you to have a look at jStorage. Which is:
a cross-browser key-value store database to store data locally in the
browser - jStorage supports all major browsers, both in desktop (yes -
even Internet Explorer 6) and in mobile.
It's mainly based on HTML5 localstorage but it will switch to any available technology (like userData Behavior) when HTML5 is not supported.
You could download the text file of log to client machine if you flush the .txt file in the respose object i,e (response.write)
I'm currently writing an application in C# (Windows 8 Windows Store App, .Net 4.5), what would highly rely on one thing I never worked before: user management.
The application to be done has to access a Windows-based server, and parse the login information with that server, then display functions, profile information, etc., based on that user data. Right now I'm stuck at the really beginning, I have no clue how to solve a global user for the whole application (pretty much like the XBox application, it would be nice to have a small user representation on the top right corner in every screen).
About the platform: we use Windows solution for user management in the whole network (there's a Microsoft ActiveDirectory server running), supplying the information for the Exchange and SharePoint servers. What I want to do is to authenticate the user with the AD server, pull the information (full name, role, access, other user data), then using these information, first display the user profile on the top right corner (the XBox Win8 app style), and load the accessible functions (this will be based on role and other domains of the user, e.g. groups).
If anyone knew a tutorial or solution what can get me closer solving this very part of the problem, it would be great!
There are specific libraries included in the .NET Framework for handling active directory requests. Take a look here:
Generic Authentication Call to Active Directory in C#
http://support.microsoft.com/kb/316748