User1848877749 posted
I posted this as a response to
another thread on the General Forum, but thought I'd copy it here in hopes it might generate a little more search engine love for those folks that have been as frustrated as I have trying to find guidance on how to enable RDS.Dataspace objects
on IIS 7 web servers.
Disclaimer - I know that the use of RDS.Dataspace business objects is likely to generate some mild cardiac events in network admin types, but when you are faced with legacy applications that still rely on it, and cannot be modified to apply modern web
services techniques, little choice remains if you are wanting to upgrade your server platforms. What follows are the steps I used to enable RDS on IIS 7 (both x86 and x64 versions). My own interest was for providing remote RDS-based desktop clients
with access to the middle-tier business objects they require, but the same steps should also work for classic ASP apps that need to invoke COM+ objects in a similar fashion.
----------------------------------
I will attempt to list the steps I followed to get it enabled on my servers in hopes that it might reduce the amount of frustration folks have been having trying to find information
on how to get this working (based on my own futile efforts to find similar content on the interweb thing).
Note: I think the biggest tip I can suggest is to attempt this on a fresh W2K8 server install with the Application Server and Web Server roles enabled (get RDS working first prior
to attempting to add websites or applications that rely on it). Hopefully you all have access to a snapshot of a baseline virtual server image that you can easily revert to in the event something goes haywire (I have to say that Hyper-v has saved my butt a
number of times in my efforts to get this working – it simply ROCKS!). There are a couple of tricks involved here – this is especially true in 64-bit land. If you do not have this luxury, I’m afraid that YMMV with regard to the steps outlined in this guide.
Steps to provide MSADC /RDS Dataspace support in IIS 7:
1.
Login with credentials that provide local admin permissions
2.
Open IIS Manager and connect to the local computer
3.
Double-click the “ISAPI and CGI Restrictions” icon in the IIS section of the “Home” pane
4.
Select “Add” from the Actions pane
5.
Set the “ISAPI or CGI path” by navigating to the location of msadcs.dll
a.
On 32-bit machines the default location is found at “C:\Program Files\Common Files\System\msadc\msadcs.dll”
b.
On 64-bit machines, you will also want to be using the 32-bit version of msadcs.dll (this is the only version I could get to work at any rate), so make sure you direct the path to point at the proper bits found
in “C:\Program Files (x86)\Common Files\System\msadc\msadcs.dll”
6.
Provide any description you like – I chose “RDS ISAPI Library”
7.
Check “Allow extension path to execute” and click the OK button to dismiss the dialog
8.
Highlight the newly created entry in the ISAPI and CGI Restrictions pane and click “Edit Feature Settings…” link in the Actions pane. Check the “Allow unspecified ISAPI modules” checkbox. Click the OK button
to dismiss the dialog
9.
Click on the local computer name in the “Connections” pane again and then double click the “Handler Mappings” icon found in the “Home” pane
10.
Double-click “ISAPI-Dll” in the Features View pane (don’t worry that it appears grayed out, you will enable it in a later step)
11.
Accept the defaults for the “Request Path” and “Module.”
Use the “…” button to browse to the msadcs.dll (don’t forget that you want the 32-bit version if you are configuring a 64-bit server)and set the “Executable” value. Click the “Request
Restrictions” button.
12.
On the “Mapping” tab, check that “Invoke handler only if request is mapped to: File” is selected
13.
On the “Access” tab, check that “Execute” is selected, then click the OK button to dismiss the dialog
14.
You will then receive a prompt asking if you want to allow this ISAPI extension – well duh, click the Yes button.
15.
Highlight the “ISAPI-dll” entry from the “Handler Mappings” pane and click the “Edit Feature Permissions” link in the “Action” pane. Enable all 3 permissions (Read, Script, and Execute). Click the OK button
– the ISAPI-dll handler should now move to the “Enabled” category.
16.
64-bit users only – Since RDS is now configured to run in 32-bit address space, you will need to either create a new 32-bit enabled application pool or modify the existing default app
pool (I’d recommend creating a new one unless you don’t mind forcing all of your default web apps to run in the 32-bit mode).
a.
Click on Application Pools in the Connections pane and click the Add Application Pool link in the Actions pane.
b.
Give your new App pool
a descriptive name (i.e. “32 bit App Pool”), set it to use the .NET 2.0 Framework, and run in Integrated managed Pipeline Mode. Click OK.
c.
Highlight the new 32 bit App Pool and click the Advanced Settings link from the Actions pane
d.
Set the General->Enable 32-bit Applications value to True. Click OK
17.
So far so good – about all we need to do in order to complete the IIS 7 RDS configuration tasks is add an MSADC application to the default web site. Expand the “Sites” under the local computer name in the “Connections”
pane and select the “Default Web Site” Icon. Click the “View Applications” link in the “Actions” pane
18.
Click the “Add Application…” link in the “Actions” pane. Enter “MSADC” as the “Alias”, select an appropriate Application pool (the Default App Pool for x86 machines or the new 32 bit App Pool created for x64
servers), and navigate to the appropriate 32-bit version of the “msadc” folder to set the “Physical path” value.
19.
In order for RDS to be used to invoke COM+ Business Objects, the MSADC Application needs to impersonate the same identity used by the COM+ applications servicing the targeted business objects. Before dismissing
the “Add Application” dialog, click on the “Connect as…” button
20.
Under “Path Credentials” select the “Specific user” and click the “Set” button
21.
Supply the appropriate service account credentials that match the COM+ Application Identity in the spaces provided. Note: The “User name” field needs to be entered in the
domain_name\user_name format (i.e. “MyDomain\MyCOMServiceAccount”). Click the OK buttons until you’ve dismissed all dialogs.
22.
Restart IIS by clicking on the local computer name in the “Connections” pane and clicking on the “Restart” link in the “Actions” pane
23.
If all went according to plan, IIS 7 is now configured to support RDS.Dataspace object creation from remote clients or ASP pages. But you are not quite ready to use it yet – you still need to create the appropriate
ADCLaunch registry entries to expose your COM+ business objects for consumption by RDS clients.
a.
Open regedit.exe
b.
Navigate to: HKLM\SYSTEM\CurrentControlSet\Services\W3SVC\Parameters\ADCLaunch
(where “HKLM” = HKEY_LOCAL_MACHINE)
c.
Right click on the ADCLaunch key and select New + Key
d.
Enter the Prog ID for the COM+ object you are wishing to expose (i.e. “MyServer.TestObject”)
e.
Lather, rinse, and repeat for each additional COM+ object you wish to serve from RDS (each object gets its own key).
24.
Congratulations! You have just stepped back in time about 10 years and have enabled RDS to provide IIS 7 web access to COM+ business objects hosted on a Windows Server 2008 machine.
25.
[Optional] - While you have the registry editor open you might want to make some additional changes in the interest of better securing your server from the known vulnerabilities that exist
in the RDSServer.DataFactory components of the MDAC stack (if you are not using them, that is). The simplest way to prevent malicious users from hijacking these components is to delete the “AdvancedDataFactory” and “RDSServer.DataFactory” keys from the registry.
You will probably encounter errors when you try this because for some unknown reason, Microsoft has not granted full control permissions to these keys to the local administrators group. The fix is pretty simple though.
a.
Right click on the AdvancedDataFactory key and select Permissions
b.
Click the Advanced button and select the Owner tab
c.
Highlight the Administrators group and click the OK button
d.
Assign full control permissions to the Administrators group and Click OK
e.
Delete the key
f.
Repeat for the RDSServer.DataFactory key
g.
Inform your network Gestapo that you have sealed this security hole so they can sleep better at night despite the knowledge that RDS is now enabled on their web farm
That’s really all there is to it…
;-P
If everything worked as anticipated you should be good to go – if not, well, I hope you followed my advice to have some manner of backup baseline image handy that you can
revert to and retry (some of these changes can be difficult to undo). Although my efforts have been limited to Windows 2008 Server, these same instructions should work for developers using Vista workstations with IIS 7 installed.
Hope this helps.
