Members

Technology Zones

Articles

Hosted By

MaximumASP

Info

Rated
Read 25,991 times

Contents

Downloads

Related Categories

Securing ASP Data Access - Preparing the Metabase

Preparing the Metabase

We want to create three data types, which I have chosen to call ODBCDataSource, ODBCUserName, and ODBCPassword. The data stored in these values will be used to replace the text strings in that awful ADODB command at the beginning of this article. If you want to use DSN-less connections, you can extend this list further to include a server and database name as well. You can do the same kind of thing to add other types of connection information for WinNT, Active Directory, LDAP, or whatever you like.

What you don't want to do its take forever to get this part done. After all, we're not even at the useful bits yet. So, I've included a VBScript file called MetaSchema.vbs that you can use to extend the metabase schema, so that it includes these data types. Simply put the script on the desired server, open your command prompt, navigate to it, and then type its name to execute it. You'll need to run it using an account with Administrator level access.

Our sample script does four things. First it creates a class for the new data types. I chose to name this class DataAccessMethods. Next, it creates the three data types we described, then adds the data types to the class. Finally, it creates a class for the container that will hold each of our DataAccessMethods instances, called DataAccessStorage.

In this example, all the data types are strings with default settings for inheritance and security. Also, be aware that the error detection is very rudimentary. If the script detects an error, it will simply stop working. In many cases it will skip the remaining code without even reporting the error. As an advanced exercise you can add these features later. However, for the purpose of illustrating our point, this script will run fine as it is.

Now, here's a little more detail about what is going on in this script. If you've done programming using ADSI before, this code will seem very basic to you. You may have been exposed to this through Windows 2000 or Microsoft Site Server. Regardless of whether you are familiar with ADSI or not, this code should be reasonably self-explanatory, and you should be able to familiarize yourself with the syntax by comparing the path names you see in the code to the paths visible when using MetaEdit.

The first thing it does after defining some constants is bind to the IIS metabase schema.

' Bind to the Schema container object.

Set SchemaObj = GetObject ("IIS://" & MachineName & "/Schema")

This is done by using the machine name, in this case "localhost", to create the metabase path. This path is then passed to the GetObject function, which is part of the ADSI component model. The remainder of the script uses the schema object to perform various functions.

I have been working in IT since 1993. I founded CarpeDiem Business Internet Systems in 1995. In 2000 we incroporated and took on two partners. Its really a grat lot of fun, and I enjoy working on the high-end and cutting-edge stuff from Microsoft. I'm pretty hard up for work lately, because of the attacks in New York and DC, so if anyone has any leads, they'd really help out a lot. Come check out our web site!

This article is Copyright (c) 2001 by Thomas Carpe and CarpeDiem Business Internet Systems, Inc. Published by permission. If you would like to publish articles by myself and our staff on this or other topics, please contact us.

Comments

  • Wow!

    Posted by kruelintent on 18 Mar 2004

    Very impressive.

    Having been battling with ASP database security it is nice to know the solution is out there although it is still quite worrying that database security is quite so vunerable withou...

  • Wow!

    Posted by kruelintent on 18 Mar 2004

    Very impressive.

    Having been battling with ASP database security it is nice to know the solution is out there although it is still quite worrying that database security is quite so vunerable withou...

  • The End?

    Posted by caster_troy on 23 Jul 2002

    Is this the end of the article?