Using rds from within ASP on Server 2003

Doug Pickering

unread,

Nov 10, 2003, 3:02:24 PM11/10/03

to

Hi,

Just to recap on my RDS on Server 2003 problem, I am using
IIS 6 on Windows 2003. I am using a simple piece of
script in ASP:
01--> set rds = createobject("RDS.Dataspace")
02--> set p = rds.createobject
("Test.Data","http://ntserver/testsite")
03--> response.write p.testmethod()

At line 03 the process just 'hangs' and evetually times
out with page not found or similar. Often the Internet
Explorer process that opened the page needs to be
terminated prior to the page being re-opened.

This same piece of code works as expected as an ASP page
on NT and Server 2000 and in vbscript in excel 97, 2000
plus many compiled VB apps.

I have investigated the problem and established that it
due to NT Authentication being turned on on the ntserver.
If I allow anonymous access, all is well. When anonymouse
is turned off I see an entry in IIS log on ntserver to
indicate that the a 401 was returned for an anonymous
access from the Windows 2003 server. After this there is
nothing and the process on the Windows 2003 server appears
to have hung.

I really need to have authentication turned on.

I have two questions:
1) Is what I am seeing expected behaviour? It would be
better if an error was returned.
2) How can I get the process running under IIS to
authenticate with the ntserver as a known identity?

Many Thanks,

Doug Pickering
nos...@ayrtonmail.net

Kevin Yu [MSFT]

unread,

Nov 11, 2003, 1:36:32 AM11/11/03

to

Hi Doug,

I'm not quite sure why this happens. Here's a KB article of HOWTO: Create
and Distribute an ActiveX Document with Remote Data Services (RDS). Please
try the method on it, and see if it works.

http://support.microsoft.com/default.aspx?scid=kb;en-us;184630

Kevin Yu
=======
"This posting is provided "AS IS" with no warranties, and confers no
rights."

Doug Pickering

unread,

Nov 11, 2003, 2:40:36 AM11/11/03

to

Kevin,

Thanks for the reply.

I am certain that the KB you have specified will work as I
have tried a VB app talking to the RDS service in question
and all is OK. If the code from the example were modified
to run from ASP as follows:

<%
Dim rs
Dim ds
Dim df

Set ds = server.CreateObject("RDS.DataSpace")

Set df = ds.CreateObject
("RDSServer.DataFactory", "http://<Server>")

'This query returns a recordset over HTTP.
Dim strCn
dim strSQL
strCn = "dsn=asystemdsn"
strSQL = "Select * from Products"
Set rs = df.Query(strCn, strSQL)
response.write rs(0) 'Print 1 to MsgBox
%>

And run under IIS 6 then it work work initially. If you
then went and removed anonymour access from <Server> (at
least the /msadc directory) then in IIS6 it will not.

Are you able to reproduce this?

Thanks,

Doug Pickering

Scot Rose [MSFT]

unread,

Nov 12, 2003, 9:13:41 AM11/12/03

to

RDS May just not work on a Windows 2003 server, it is a depricated technology that had several security issues so it may never have been tested on windows 2003 servers(and
may not be supportable). Are you using Handlers? What exactly are you trying to accomplish? Perhaps there is a more security concious choice (Web services?) that may be a
better option than a no longer supported technology. If you are intent on using it, I would suggest running Regmon and filemon (www.sysinternals .com) and look for any Access
Denied entries in the logs. This will tell you if there are registry keys or file folders (Temp files and such) that need permissions to be accessed, However it is not reccomended for
as you do risk opening your server up to security problems.

Scot Rose, MCSD
Microsoft Visual Basic Developer Support
Email : sc...@online.microsoft.com <Remove word online. from address>

This posting is provided “AS IS”, with no warranties, and confers no rights.

Get Secure!
http://www.microsoft.com/security
http://www.microsoft.com/protect

--------------------
>Content-Class: urn:content-classes:message
>From: "Doug Pickering" <nos...@ayrtonmail.net>
>Sender: "Doug Pickering" <nos...@ayrtonmail.net>

>References: <014c01c3a7c5$8f06a880$a501...@phx.gbl> <Vluio4B...@cpmsftngxa06.phx.gbl>
>Subject: RE: Using rds from within ASP on Server 2003
>Date: Mon, 10 Nov 2003 23:40:36 -0800
>Lines: 53
>Message-ID: <069e01c3a827$187927d0$a601...@phx.gbl>

>MIME-Version: 1.0
>Content-Type: text/plain;
> charset="iso-8859-1"
>Content-Transfer-Encoding: 7bit
>X-Newsreader: Microsoft CDO for Windows 2000

>X-MimeOLE: Produced By Microsoft MimeOLE V5.50.4910.0300

>Thread-Index: AcOoJxh5aW9S0MHzQoCvjf5JYmHeNQ==
>Newsgroups: microsoft.public.data.ado.rds
>Path: cpmsftngxa06.phx.gbl
>Xref: cpmsftngxa06.phx.gbl microsoft.public.data.ado.rds:12156
>NNTP-Posting-Host: TK2MSFTNGXA14 10.40.1.166
>X-Tomcat-NG: microsoft.public.data.ado.rds

Doug Pickering

unread,

Nov 12, 2003, 9:32:17 AM11/12/03

to

Scot,

Thanks for your response. The server in question are on a
network isolated from the internet on a network that is
well defended. The NT server which hosts the service
through which data is accessed through RDS is outside of
our direct control and works perfectly well on other
operating systems/language combinations.

I work as a consultant for the company concerned so access
to experiment is not easy. They have now decided to
replace the 2003 server with a 2000 server to ensure that
this issue does not hold up a critical project. I would
like to assure them that they would be able to move
forward at some point in the future so I am still
progressing with this issue.

I have been trying to simulate a similar environment to
track process activity using filemon and regmon in exactly
the method you suggest. This is taking time and I have
not yet created the entire environment yet.

When I did use filemon whilst I had the issue (before I
found that removing authentication would be a workaround)
I was able to ascertain that the process failed shortly
after some access to 'temporary interent files' folder.
In an interactove session that would not be authorised
this would be the point at which internet explorer would
prompt for a username and password. I was going to see if
I could establish whether a similar (and obviously fatally
flawed) action was occuring.

I'll let you know how I get on and please let me know if
you can shed any new light or have any theories.

Thanks,

Doug Pickering

Scot Rose [MSFT]

unread,

Nov 13, 2003, 9:12:25 AM11/13/03

to

About the only light I can shed I have already done, It is a depricated technology, which means that any bugs will not be fixed and no further development is being done on it. And it
probably was not tested on WIn 2003. My main advice is open only as many doors as you have too to get it to work and no more. Since you are on a closed network it may not be
a major concern, however if at any point this network is opened up it may very well become one.

Scot Rose, MCSD
Microsoft Visual Basic Developer Support
Email : sc...@online.microsoft.com <Remove word online. from address>

This posting is provided “AS IS”, with no warranties, and confers no rights.

Get Secure!
http://www.microsoft.com/security
http://www.microsoft.com/protect

--------------------
>Content-Class: urn:content-classes:message
>From: "Doug Pickering" <nos...@ayrtonmail.net>
>Sender: "Doug Pickering" <nos...@ayrtonmail.net>

>References: <014c01c3a7c5$8f06a880$a501...@phx.gbl> <Vluio4B...@cpmsftngxa06.phx.gbl> <069e01c3a827$187927d0$a601...@phx.gbl>
<FMZPxcSq...@cpmsftngxa06.phx.gbl>

>Subject: RE: Using rds from within ASP on Server 2003

>Date: Wed, 12 Nov 2003 06:32:17 -0800
>Lines: 39
>Message-ID: <05b501c3a929$c6289ed0$a001...@phx.gbl>

>MIME-Version: 1.0
>Content-Type: text/plain;
> charset="iso-8859-1"
>Content-Transfer-Encoding: 7bit
>X-Newsreader: Microsoft CDO for Windows 2000

>Thread-Index: AcOpKcYoorsLSKALTQO1+ZwTIosQEA==

>X-MimeOLE: Produced By Microsoft MimeOLE V5.50.4910.0300

>Newsgroups: microsoft.public.data.ado.rds
>Path: cpmsftngxa06.phx.gbl
>Xref: cpmsftngxa06.phx.gbl microsoft.public.data.ado.rds:12166
>NNTP-Posting-Host: TK2MSFTNGXA08 10.40.1.160
>X-Tomcat-NG: microsoft.public.data.ado.rds

anon...@discussions.microsoft.com

unread,

Nov 13, 2003, 2:20:06 PM11/13/03

to

Scot,

Thanks again for your replay and reminder on security.

I have recreated a simple example to show the failure in
Windows 2003 at: http://www.presentlists.com/rdstest/

I understand that you are saying that this is depricated
and I would not expect any new development on it but it is
included in MDAC 2.8 and I thought that meant it was
supported? Surely if a bug is found then it can be
fixed. Will it help if I raise a support issue on this?

I have tried opening up all I can and I will continue to
see if I can shed any more light using regmon and filemon.

Many thanks,

Doug Pickering

>.
>

Doug Pickering

unread,

Nov 13, 2003, 2:20:29 PM11/13/03

to

Scot,

Thanks again for your replay and reminder on security.

I have recreated a simple example to show the failure in
Windows 2003 at: http://www.presentlists.com/rdstest/

I understand that you are saying that this is depricated
and I would not expect any new development on it but it is
included in MDAC 2.8 and I thought that meant it was
supported? Surely if a bug is found then it can be
fixed. Will it help if I raise a support issue on this?

I have tried opening up all I can and I will continue to
see if I can shed any more light using regmon and filemon.

Many thanks,

Doug Pickering

>.
>

Scot Rose [MSFT]

unread,

Nov 14, 2003, 2:45:01 PM11/14/03

to

It is only there for backwards compatability but unless the bug was just a monster And affected a large number of users AND there
was no other workaround (Another technology which there is(Wegservices or ASP) then no it would not be addressed.

Note the documentation on the MSDN site for MDAC 2.8

http://msdn.microsoft.com/library/default.asp?url=/library/en-us/ado270/htm/ado_deprecated.asp

Scot Rose, MCSD
Microsoft Visual Basic Developer Support
Email : sc...@online.microsoft.com <Remove word online. from address>

This posting is provided “AS IS”, with no warranties, and confers no rights.

Get Secure!
http://www.microsoft.com/security
http://www.microsoft.com/protect

--------------------
>Content-Class: urn:content-classes:message
>From: "Doug Pickering" <nos...@ayrtonmail.net>
>Sender: "Doug Pickering" <nos...@ayrtonmail.net>
>References: <014c01c3a7c5$8f06a880$a501...@phx.gbl> <Vluio4B...@cpmsftngxa06.phx.gbl> <069e01c3a827$187927d0$a601...@phx.gbl>

<FMZPxcSq...@cpmsftngxa06.phx.gbl> <05b501c3a929$c6289ed0$a001...@phx.gbl> <YQdNtAfq...@cpmsftngxa06.phx.gbl>

>Subject: RE: Using rds from within ASP on Server 2003

>Date: Thu, 13 Nov 2003 11:20:29 -0800
>Lines: 123
>Message-ID: <00ef01c3aa1b$330943f0$a501...@phx.gbl>

>MIME-Version: 1.0
>Content-Type: text/plain;
> charset="iso-8859-1"
>Content-Transfer-Encoding: 7bit
>X-Newsreader: Microsoft CDO for Windows 2000

>X-MimeOLE: Produced By Microsoft MimeOLE V5.50.4910.0300

>Thread-Index: AcOqGzMGrKaa653bSveGcxYnhSSdSw==
>Newsgroups: microsoft.public.data.ado.rds
>Path: cpmsftngxa06.phx.gbl
>Xref: cpmsftngxa06.phx.gbl microsoft.public.data.ado.rds:12171

>NNTP-Posting-Host: TK2MSFTNGXA13 10.40.1.165
>X-Tomcat-NG: microsoft.public.data.ado.rds
>

Stuart Brudner

unread,

Nov 15, 2003, 12:49:57 PM11/15/03

to

Hey Scot,

I've been following this thread quite closely, as I have a site that I
support which makes significant use of RDS.

I'm a bit concerned about your last comment that the issue "would not be
addressed". If I follow the link you provide, it says quite clearly that
"While these components are still supported in this release of the Microsoft
Data Access Components (MDAC) ...".

How do you suggest that I reconcile this with your comments?

Stuart Brudner

"Scot Rose [MSFT]" <sc...@online.microsoft.com> wrote in message
news:%234Ejkfu...@cpmsftngxa06.phx.gbl...

Scot Rose [MSFT]

unread,

Nov 17, 2003, 9:58:17 AM11/17/03

to

Basically, while it is supported by PSS (I think they still even support VB4 16 bit) it is by Best effort... Like VB4, IF there is a bug, a workaround will be sought but since nothing further
is being done with the Code the likelyhood of a bug fix is low priority... Also, If you noted on that site, it may be dropped from the product so you would be well advised to make sure
that a future version of MDAC still contains the bits before installing it (It could be dropped in MDAC 2.9, it may be in there until MDAC 5.0 should such an animal ever be created) but
at the point it is dropped, your site may no longer work if you Upgrade, so before upgrading MDAC in the future it would be a good idea to make sure RDS is still in it... (As Doug
has found, it may not work well with Win 2003 or there may be new permission hurdles to clear), so you may need to stay at 2000 yourself, be sure to test before you upgrade your
servers.

Scot Rose, MCSD
Microsoft Visual Basic Developer Support
Email : sc...@online.microsoft.com <Remove word online. from address>

This posting is provided “AS IS”, with no warranties, and confers no rights.

Get Secure!
http://www.microsoft.com/security
http://www.microsoft.com/protect

--------------------
>From: "Stuart Brudner" <s...@adamax.net>
>Newsgroups: microsoft.public.data.ado.rds
>References: <014c01c3a7c5$8f06a880$a501...@phx.gbl> <Vluio4B...@cpmsftngxa06.phx.gbl> <069e01c3a827$187927d0$a601...@phx.gbl>
<FMZPxcSq...@cpmsftngxa06.phx.gbl> <05b501c3a929$c6289ed0$a001...@phx.gbl> <YQdNtAfq...@cpmsftngxa06.phx.gbl> <00ef01c3aa1b$330943f0
$a501...@phx.gbl> <#4Ejkfuq...@cpmsftngxa06.phx.gbl>
>Subject: Re: Using rds from within ASP on Server 2003
>Lines: 194
>X-Priority: 3
>X-MSMail-Priority: Normal
>X-Newsreader: Microsoft Outlook Express 6.00.2800.1158
>X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1165
>Message-ID: <9Httb.3730$j1d....@news04.bloor.is.net.cable.rogers.com>
>Date: Sat, 15 Nov 2003 17:49:57 GMT
>NNTP-Posting-Host: 67.60.178.104
>X-Complaints-To: ab...@rogers.com
>X-Trace: news04.bloor.is.net.cable.rogers.com 1068918597 67.60.178.104 (Sat, 15 Nov 2003 12:49:57 EST)
>NNTP-Posting-Date: Sat, 15 Nov 2003 12:49:57 EST
>Path: cpmsftngxa06.phx.gbl!TK2MSFTNGP08.phx.gbl!newsfeed00.sul.t-online.de!newsfeed01.sul.t-online.de!t-online.de!feed.news.nacamar.de!newsfeed.icl.net!
newsfeed.fjserv.net!newsfeed.cwix.com!cyclone01.bloor.is.net.cable.rogers.com!news04.bloor.is.net.cable.rogers.com.POSTED!not-for-mail
>Xref: cpmsftngxa06.phx.gbl microsoft.public.data.ado.rds:12175
>X-Tomcat-NG: microsoft.public.data.ado.rds

Doug Pickering

unread,

Nov 18, 2003, 12:17:03 PM11/18/03

to

Stuart,

I have logged a call on my issue and it is progressing
well. The problem I have has been reproduced and the
amount of effort being put in to help resolve the issue
to my satisfaction is substantial. We have not taken the
issue to its conclusion yet.

I will post details of the exact issue and potential
workarounds as soon as I have validated them.

Doug Pickering

Stuart Brudner

unread,

Nov 19, 2003, 6:33:14 AM11/19/03

to

Thanks for the update, Doug. I'm glad to hear you're getting appropriate
support. Keep posting, I'll be watching.

Stuart Brudner

"Doug Pickering" <nos...@ayrtonmail.net> wrote in message
news:093501c3adf7$c8d7f770$a601...@phx.gbl...

Doug Pickering

unread,

Nov 22, 2003, 6:12:39 AM11/22/03

to

Hi All,

Just to keep anyone that is interested updated;

The hang I have is 'unexpected behaviour'. The
anticipated expected behaviour would be an appropriate
error message.

The symptoms are present for me when the RDS components
on the W2K3 IIS try to contact the NT4 server and the NT4
server has any form of authentication on. So far this
has been partially recreated.

Techniques that I so far have tested successfully are;

a) Allow anonymous access on the NT server
b) Connect to the NT server with the username and
password included, i.e. http://username:password@ntserver/

Both the above have drawbacks and not ideal the latter is
a possibility in my situation.

I'll keep posting any further news.

Doug

Doug Pickering

unread,

Nov 28, 2003, 1:20:47 PM11/28/03

to

Update:

The reason for the failure is that RDS is using
wininet.dll. This dll is not safe for use in IIS. Under
the circumstances described previously the rds call
cannot authenticate to the ntserver as the policy does
not allow for the users' credentials to be passed. Under
these circumstances wininet opens a dialog box to prompt
for user input. This is clearly not going to work well
in a server side dll.

As well as the previous work-around, it is also possible
to create an application pool that runs as a specified
user, assign this application pool to the web site and
make sure that the user treats the ntserver as local
intranet. You can do this by logging in as the specified
user and changing the internet explorer settings until a
connection can be made successfully.

I am now able to progress further by implementing one of
the workarounds.

All the best, and I hope this is helpful to someone.

Doug Pickering

Brian Muth

unread,

Nov 28, 2003, 2:12:23 PM11/28/03

to

This is a pearl of a post, Doug. Many thanks.

It's the occasional gem like this that keeps me hanging around this ng.

Brian

"Doug Pickering" <nos...@ayrtonmail.net> wrote in message

news:06d101c3b5dc$583a1560$a001...@phx.gbl...