ASP.NET Question/Answer Set-2

2.1 Describe the security authentication flow and process in ASP.NET? 

When a user requests a web page, there exists a process of security too, so that every anonymous user is checked for authentication before gaining access to the webpage. The following points are followed in the sequence for authentication when a client attempts a page request:

* A .aspx web page residing on an IIS web server is requested by an end user
* IIS checks for the user's credentials
* Authentication is done by IIS. If authenticated, a token is passed to the ASP.NET worker process along with the request
* Based on the authentication token from IIS, and on the web.config settings for the requested resource, ASP.NET impersonates the end user to the request thread. For impersonation, the web.config impersonate attribute's value is checked. 
2.2 What is the Website Administrative Tool in ASP.NET 2.0 ? 
In ASP.NET 2.0, while using Visual Studio 2005 Express Edition or above, the development IDE provides an interface for editing the web.config rather than manually editing the web.config. 

In the IDE, click on "Website" and then on "ASP.NET Configuration". This shall open the Website configuration tool. Note that the Web Site Administration Tool is a set of prebuilt ASP.NET 2.0 webpages and resources that are located within the C:\Inetpub\wwwroot\aspnet_webadmin\2_0_40607 directory. 

2.3 What is Authentication? What are the different types of Authentication? 
In a client-server environment, there are plenty of cases where the server has to interact and identify the client that sends a request to the server. Authentication is the process of determining and confirming the identity of the client. 

If a client is not successfully identified, it is said to be anonymous. 
Types of Authentication
Windows Authentication
Forms Authentication
Passport Authentication

Essentially the Windows Authentication and Forms Authentication are the famous ones, as Passport Authentication is related to a few websites (like microsoft.com, hotmail.com, msn.com etc. only).

Windows Authentication is implemented mostly in Intranet scenarios. When a browser (client) sends a Request to a server where in windows authentication has been implemented, the initial request is anonymous in nature. The server sends back a Response with a message in HTTP Header. This Prompts a Window to display a Modal Dialog Box on the browser, where the end user may enter the "User name" and "Password". 

The end user enters the credentials, which are then validated against the User Store on the Windows server. Note that each user who access the Web Application in a Windows Authentication environment needs to have a Windows Account in the company network. 

2.4 How to avoid or disable the modal dialog box in a Windows Authentication environment? 

By enabling the Windows Integrated Authentication checkbox for the web application through settings in IIS. 

Forms Authentication is used in Internet based scenarios, where its not practical to provide a Windows based account to each and every user to the Web Server. In a Forms Authentication environment, the user enters credentials, usually a User Name and a corresponding Password, which is validated against a User Information Store, ideally a database table. 

Forms Authentication Ticket is the cookie stored on the user's computer, when a user is authenticated. This helps in automatically logging in a user when he/she re-visits the website. When a Forms Authentication ticket is created, when a user re-visits a website, the Forms Authentication Ticket information is sent to the Web Server along with the HTTP Request. 

2.5 What is Authorization in ASP.NET? 

Authorization, in simple words means "which user can access which resource on a web server". Authentication of users may be set in the web.config file. See web.config snippet below... 

Based on the user and the role, access to different folders across the website may be controlled using the authorization feature of ASP.NET 

2.6 What is IIS Metabase? How to edit IIS metabase? How to backup IIS metabase file? 
IIS Metabase - sounds like geek stuff right! What is IIS Metabase??? In the simplest words, IIS metabase is the repository of the configuration values that are set in the Internet Information Server (IIS). The IIS metabase in an XML file. It may be controlled through program or manually too. 

In order to edit IIS metabase entries, the user needs to have administrative rights on the system. To do this, in run window, type "inetmgr". Browse to "Local Computer" and right click it. Click on "Properties". Select the "Enable Direct Metabase Edit" check box.

Many times, due to the existence of multiple versions of .NET framework, some settings in the IIS metabase may get affected and cause your program not to run. For such scenarios, you may take a backup of the IIS metabase XML file and recover it. To create a portable backup, open run window and type "inetmgr". Next browse to "Local Computer" and go to "All Tasks". Next, click on Backup/Restore Configuration. Next, click on "Create Backup". In the textbod box for Configuration Backup name, type a name for your backup file. Also select the encrypt backup option and type a password. To finish the process, click "OK". 

Search for Metabase.xml file on your IIS Web Server.

2.7 What is mixed mode authentication in ASP.NET? 
Mixed mode authentication in an asp.net web application has the ability to feature both Forms Authentication and Windows Authentication to the end user.

In such a web application, the website user is identified based on whether the user is accessing the site from within the local domain or an external domain. When the user is from within the domain, Windows Authentication is applied and thus, the user can be configured to have higher authorization rights. The users logging into the web application from an external domain access the site using Forms authentication. 

But this is tricky!!! For such an application to work, there needs to be 2 virtual directories setup for the web application on the IIS. This is because an asp.net web application cannot be set to two different authentication modes. 
So if someone asks Can an ASP.NET application support 2 authentication modes at the same time??? 
the answer is TECHNICALLY NO!, but there is a workaround!!! ... there are always workarounds for everything in ASP.NET... its so powerful! 
The windows authentication site's authentication information is basically used to get information about the intranet users and this is passed to the web application for Forms authentication. In such a scenario, the windows authentication information from the windows authentication site in IIS is passed to the Forms Authentication and thus user role is verified

ASP.NET Question/Answer Set-1

ASP.NET
1.1 Whats the difference between Classic ASP and ASP.NET? 

Major difference: Classic ASP is Interpreted. ASP.NET is Compiled. If code is changed, ASP.NET recompiles, otherwise does'nt.
Other differences: ASP works with VB as the language. ASP.NET works with VB.NET & C# as the languages (Also supported by other languages that run on the .NET Framework). 
ASP.NET is the web technology that comes with the Microsoft .NET Framework. The main process in ASP.NET is called aspnet_wp.exe that accesses system resources. ASP.NET was launched in 2002 with version 1.0. Subsequent versions are 1.1 and version 2.0. ASP.NET is built up using thousands of objects, ordered in the System namespace. When an ASP.NET class is compiled, its called an assembly. 
In Classic ASP, complex functionalities are achieved using COM components, that are nothing but component objects created using VB 6, C++ etc, and are usually in a DLL format. These components provide an exposed interface to methods in them, to the objects that reference these components. Last version of classic ASP is version 3.0. ASP has 7 main objects - Application, ASPError, ObjectContext, Request, Response, Server, Session. 

1.2 How to redirect a page to another page? 

The Response object has a famous Redirect method that is used most widely to transfer a web page visitor from one page to another page. 
Syntax of Response.Redirect ...

Response.Redirect("DestinationPage.aspx") 
There is another famous method called Transfer method of the Server object. 
Syntax of Server.Transfer ...

Server.Transfer("DestinationPage.aspx") 

1.3 How to pass values between pages? 

There are several methods to pass values from one page to another page. Described below are few methods to pass values between pages:

QueryString - The QueryString method of passing values between web pages is one of the oldest methods of passing values between pages. A variable value is properly encoded before it is placed on a querystring. This is to make sure that characters that cause problems (like symbols and spaces) are encoded correctly. See the code below to see how QueryString functionality works.
//Code in InitialPage.aspx
String sString;
sString = Server.UrlEncode("string in InitialPage.aspx");
Response.Redirect("DestinationPage.aspx?Value=" & sString);

//Code in DestinationPage.aspx reads the QueryString
String sString;
sString = Request.QueryString("Value");
Response.Write("Your name is " & sString);

The data in the DestinationPage.aspx in the URL looks like this...

http://www.dotnetuncle.com/DestinationPage.aspx?Value=dotnetUncle 
Context - The context object is used to send values between pages. Its similar to the session object, the difference being that, the Context object goes out of scope when the page is sent to a browser. Example code below shows how to use Context object. 
'InitialPage.aspx stores value in context before sending it
Context.Items("MyData") = "dotnetuncle";
Server.Transfer("DestinationPage.aspx");

'DestinationPage.aspx retrieves the value from InitialPage.aspx's context
String sString;
sString = Context.Items("MyDate").ToString;
Response.Write("The data is as follows: " & sString);
Session - The session object is used to persist data across a user session during the user's visit to a website. It is almost same as the Context object. When we use Response.Redirect, it causes the Context object to go away, so rather the Session object is used in such a scenario. Session object uses more of server memory than a context object. Example code below shows how to use Session object. 
'InitialPage.aspx stores value in session before sending it
Session.Items("MyData") = "dotnetuncle";
Response.Redirect("DestinationPage.aspx");

'DestinationPage.aspx retrieves the value from InitialPage.aspx's session
String sString;
sString = Session.Items("MyDate").ToString;
Response.Write("The data is as follows: " & sString);
You may notice above, I have used Response.Redirect with session object, and server.transfer with a context object.

How do you turn off SessionState in the web.config file? 
In the system.web section of web.config, you should locate the httpmodule tag and you simply disable session by doing a remove tag with attribute name set to session.






1.4 How to sort the contents of a GridView control? 

The ASP.NET 2.0 GridView control is a powerful control, the enables sorting of the rows based on a column, all this possible, without writing code. Well thats what we call power! 

The GridView control relies on the underlying data source control to whom this is bound for the sorting capability. The GridView needs to have an AccessDataSource or an SQlDataSource or an ObjectDataSource (if the SortParameterName property is set to a value allowed. 

The AllowSorting property of the GridView control, when set to true, enables sorting of the GridView. A sortable GridView has the Header column represented as a LinkButton control. When this Link Button is clicked, the Sorting event of the GridView is raised server-side, which causes a postback and in turn, sorts the GridView control's records. 

1.29 What does the Hotspot class in .NET do? What is an ImageMap in ASP.NET?

An ImageMap is an ASP.NET control that allows clicks inside a polygon like (called Hotspot) region in a webpage. Well, that actually means you may create a star-shaped or diamond shaped button. Wow! 

There are several pre-defined shapes allowed inside an ImageMap for which templates may be used. For example, for a rectangle, an asp:RectangularHotSpot may be used. For a circle, an asp:CircleHotSpot may be used. And for creating stars & diamonds, an asp:PolygonHotSpot may be used. An image may also be put in an ImageMap which may be specified by its ImageUrl property. 

In order to invoke an event, the HotSpotMode property needs to be set to PostBack. Further, if several HotSpots are placed inside an ImageMap, the event of the ImageMap may be passed a value using the PostBackValue property. 
Code below shows how to create a Polygon HotSpot using an ImageMap.


ImageUrl="Photo.gif" OnClick="SomeEvent"
AlternateText="Click Here"
HotSpotMode="Navigate">


AlternateText="Click Here Too!"
Coordinates="100,150, 250,350, 210,290, 90,350, 60,240"
NavigateUrl="http://www.asp.net"
Target="_blank"/>

1.30 How do we update and delete data in a gridview? Datakeynames property in .NET? 
The best way to Update or Delete a record in a GridView control is to include a CheckBox column and a Submit Button. 

The GridView has its own Delete and Edit functionality. If the GridView is populated with data using an SqlDataSource, checkout the wizard that comes along with the SqlDataSource. It may be used to automatically create an SQL Delete command and specify the delete parameters. 

The DataKeyNames property of the GridView is set to a field name of the Table. 
1.31 How to add gridview/datagrid columns manually? Autogenerate in .NET? 
The datagrid (of ASP.NET 1.1) and gridview (of ASP.NET 2.0) has a property called AutoGenerateColumns. This property is set to false. After this, columns may be set manually. Sample source below... 

SelectCommand="SELECT [au_id], [au_lname], [au_fname], [phone], [address] FROM [authors]"
ConnectionString="" />