config tool and policy for REMOTE server

Thread view:

Enable EMail Alerts

Start New Thread

Thread rating:

Julie Lerman - 27 Sep 2004 00:10 GMT

My Webservices are on a remote server, not localhost.

Is the WSE2 config tool designed ONLY to work with localhost when creating
policies?

I am running into the very annoying problem with a webservice that is on a
remote web server.

When I open up the config tool and go to policy and click enable policy, I
get an error message that says that the Policy Specified is not in the local
machine.

Does that mean I have to hand code my policy file if it's on a remote
server?

I haven't found any info via google etc.

:-(

Julie Lerman

Reply to this Message

Hervey Wilson [MSFT] - 27 Sep 2004 07:09 GMT

> My Webservices are on a remote server, not localhost.
>
[quoted text clipped - 16 lines]
>
> Julie Lerman

Generally, the tools in WSE2 are locked to editing files on the local
machine; in the case the trace files these are locked so that you cannot
write them to a network drive. Most of this lockdown was to close out
potential threats against installations, but it's possible that this may
be overly draconian in some cases, particularly for developer scenarios;
for example, if you're using the settings tool from within Visual Studio.

I will raise a bug for this to be re-evaluated for Service Pack 2, but I
cannot make any promises as to whether it will be changed before the
next release.

Does this mean that you need to code the policy by hand? No, it just
means that you need to edit it locally and test, and then deploy it to
your live web server as a separate step.

Signature

This posting is provided "AS IS", with no warranties, and confers no rights.

Reply to this Message

Julie Lerman - 27 Sep 2004 14:16 GMT

Hey there Hervey!

Thanks for the info. Now I won't waste any more time assuming that I was
doing something wrong... :-)

Well, unfortunately I don't have a localhost on my main development machine,
so that wasn't an option. Instead I created a policy file for a service on
another machine that does have local host and recreated it.

You should check my blog post on this. There are other problems created by
trying to use a remote server.
http://www.thedatafarm.com/blog/PermaLink.aspx?guid=939acb8e-aa21-4599-b67d-6e19
c6bef287

Basically, once I have added this in and modifed my web.config, if I go back
into the wse setup tool for any other reason to make changes and save those
changes, the <cache name....> element gets removed from my web.config.

So I think it's a much bigger problem. Your workaround suggests that one
would need to do all of their development and testing on localhost which is,
in my opinion, a bad position. I have a remote web server and I have always
done all of my asp and asp.net development on that.

Granted I'm not always going to use the config tool to write my policy files
since that only gives me access to a few options, but I certainly will want
to use the tool for some of the other settings and in my environment I now
can't.

I'd be happy to talk with Becky about this if you want.

Thanks for the quick reply

Julie

> > My Webservices are on a remote server, not localhost.
> >
[quoted text clipped - 31 lines]
> means that you need to edit it locally and test, and then deploy it to
> your live web server as a separate step.

Reply to this Message

Hervey Wilson [MSFT] - 27 Sep 2004 16:19 GMT

> Hey there Hervey!
>
[quoted text clipped - 78 lines]
>
> rights.

Julie, I looked at your blog, this is simply a manifestation of the
security blocking that is in the tool: if you don't have what the tool
defines as a valid file name for the policy file, it removes the policy
cache entry from the config; this is expected behaviour.

The larger question is whether the tool should allow editing of remote
files; I need to review the threat model for the product to understand
why this was disabled, have QA run some tests, and then determine
whether it was a reasonable decision.

Signature

This posting is provided "AS IS", with no warranties, and confers no rights.

Reply to this Message

Julie Lerman - 27 Sep 2004 17:15 GMT

assuming that the path is part of the file name validation, correct? And
that's what's messing me up here?

thanks again for the feedback.

I'll try to stay out of the config tool on my webservice...<g>

julie

> > Hey there Hervey!
> >
[quoted text clipped - 7 lines]
> > You should check my blog post on this. There are other problems created by
> > trying to use a remote server.

http://www.thedatafarm.com/blog/PermaLink.aspx?guid=939acb8e-aa21-4599-b67d-6e19
c6bef287

> > Basically, once I have added this in and modifed my web.config, if I go back
> > into the wse setup tool for any other reason to make changes and save those
[quoted text clipped - 75 lines]
> why this was disabled, have QA run some tests, and then determine
> whether it was a reasonable decision.

rights.

Reply to this Message

Hervey Wilson [MSFT] - 28 Sep 2004 06:48 GMT

> assuming that the path is part of the file name validation, correct? And
> that's what's messing me up here?
[quoted text clipped - 136 lines]
>
> rights.

I raised the bug today against WSE2 SP2, per previous I can't promise
that it will be fixed in that update, but it will be investigated.

Signature

This posting is provided "AS IS", with no warranties, and confers no rights.

Reply to this Message

config tool and policy for REMOTE server

Free Magazines