You receive an error message when you use SQL Server 2008 Reporting Services: “HTTP 401.1 – Unauthorized: Logon Failed”

Symptoms
Consider the following scenario that occurs when you use Microsoft SQL Server 2008 Reporting Services:You try to access Report Manager or Report Server by using a URL that resembles one of the following URLs:
http://name/reports
https://name/reportsNote The name placeholder is not the name of the computer on which Report Server and Report Manager are deployed.However, the DNS Client service, the computer’s hosts header files, or the computer’s Lmhosts files that are located in the C:\WINDOWS\system32\drivers\etc folder are configured to send requests to name back to the report server computer.You try to access Report Server directly by using one of the following URLs. When you do this, you experience no problems. Additionally, you can browse the Report Server namespace and view all reports by using the following URLs:
http://name/reportserver
https://name/reportserverThe ReportServerUrl element is specified in the Rsreportserver.config file and is set to resemble one of the following URLs:
http://name/reportserver
https://name/reportserverYou try toaccess Report Manager by using one of the following URLs:
http://name/reports
https://name/reportsIn this scenario, you receive what resembles the Report Manager user interface. However, where you expect to see a list of reports, you receive the following error message:

HTTP 401.1 – Unauthorized: Logon FailedNote If you use SharePoint Integrated mode, you receive the error message on the SharePoint Webpages. The symptoms in this scenario are most likely to occur when one of the following conditions is true: Reporting Services is deployed in a scale-out deployment.Reporting Services is accessed by using a user-friendly name that does not match the computer name.
Resolution
This problem occurs because Windows includes a loopback check security feature that helps prevent reflection attacks on your computer. Therefore, authentication fails if the FQDN or the custom host header that you use does not match the local computer name.

When you use a file handle for FileStream access in a SQL Server 2008 transaction, the transaction may randomly fail to commit in Windows Vista or in Windows Server 2008

Symptoms
On a computer that is running Windows Vista or Windows Server 2008, when you use the OpenSqlFilestream API or the .NET SqlFilestream class to obtain a file handle for FileStream access in a transaction in Microsoft SQL Server 2008, the transaction may randomly fail to commit. When this problem occurs, one of the following errors is logged in the SQL Server Errorlog file:3910 (Transaction context in use by another session)3981 (The transaction operation cannot be performed because there are pending requests working on this transaction)3922 (Cannot enlist in the transaction because the transaction does not exist)This problem occurs when the client computer is running an earlier Windows operating system. For example, the client computer is running Windows XP, Windows XP Professional x64 Edition, or Windows Server 2003.
The cause of this problem is not related to the FILESTREAM feature in SQL Server 2008. However, you typically encounter this problem when you use the FILESTREAM feature in SQL Server 2008.
Resolution
This problem occurs because of an error in the Server service. The Server service incorrectly delays the request of closing file handles. Therefore, the transactions cannot commit.

How to use Kerberos authentication in SQL Server

Symptoms
You can use Kerberos authentication with Microsoft SQL Server 2000. SQL Server 2000 supports this functionality as part of a typical Microsoft Windows 2000 or Microsoft Windows Server 2003 Active Directory domain installation. With Microsoft Windows 2000 Service Pack 3 (SP3) and Windows Server 2003, you can enable Kerberos authentication on server clusters.
For more information about this added functionality, click the following article number to view the article in the Microsoft Knowledge Base:
235529?(http://support.microsoft.com/kb/235529/) Kerberos support on Windows 2000-based server clusters
Note You can only use this functionality if you are running Windows 2000 SP3 or Windows Server 2003.
SQL Server 2000 failover clustering also uses this functionality. When the Network Name resource that SQL Server is dependent on is in a Windows 2000-based cluster, you can use Kerberos authentication on the resource after you upgrade the computer to Windows 2000 SP3 or to Windows Server 2003. To install SQL Server failover clustering, you must have Microsoft SQL Server 2000 Enterprise Edition or Developer Edition installed.
Note The concepts and discussions in this article that apply to SQL Server 2000 also apply to SQL Server 2005. For more information about this subject in SQL Server 2005, see the following topics in SQL Server 2005 Books Online:How to: Enable Kerberos Authentication Including SQL Server Virtual Servers on Server ClustersRegistration of Service Principal Name For more information about how to make sure that you are using Kerberos authenticationin SQL Server 2005, click the following article number to view the article in the Microsoft Knowledge Base:
909801?(http://support.microsoft.com/kb/909801/) How to make sure that you are using Kerberos authentication when you create a remote connection to an instance of SQL Server 2005
Resolution
SQL Server can use Kerberos authentication for server clusters. You can use Kerberos authentication with stand-alone computers that are running SQL Server, or with instances of SQL Server that are running on a virtual server.
Connect to a server that is running Microsoft Internet Information Services and make a Kerberos connection to SQL Server 2000 This section describes how to connect to a server that is running Microsoft Internet Information Services (IIS) to make a Kerberos connection to a server that is running SQL Server.
Note Before you perform the setup procedure, download the Kerbtray and the SetSPN utilities.
To download the Kerbtray utility, visit the following Microsoft Web site:
http://www.microsoft.com/downloads/details.aspx?FamilyID=4e3a58be-29f6-49f6-85be-e866af8e7a88&displaylang=en(http://www.microsoft.com/downloads/details.aspx?FamilyID=4e3a58be-29f6-49f6-85be-e866af8e7a88&displaylang=en) With Kerbtray.exe, you can easily verify or remove (or both) Kerberos tickets from any of the associated computers that are being used.
To download the SetSPN utility, visit the following Microsoft Web site:
http://www.microsoft.com/downloads/details.aspx?FamilyID=5fd831fd-ab77-46a3-9cfe-ff01d29e5c46&displaylang=en(http://www.microsoft.com/downloads/details.aspx?FamilyID=5fd831fd-ab77-46a3-9cfe-ff01d29e5c46&displaylang=en)
The following procedure provides an example of a setup sequence where you use Kerberos authentication through an IIS page to access a server that is running SQL Server.Step 1: Configure the domain controller On a domain controller, in Active Directory Users and Computers: Right-click the computer that you want to set up for delegation (IIS Services server), and then click to select Trust this computer for delegation. If the computer that is running SQL Server is what appears to be the last computer contacted but that computer has a linked server, it must also granted delegation permissions. If it is not the last computer in the chain, all the computers that are intermediaries must be trusted for delegation. Grant delegation permission to the SQL Server service account domain user account. You must have a domain user account for clustered SQL Server installations (this step is not required for computers that are running SQL Server that are using a local system account): In the Users folder, right-click the user account, and then click Properties.In the user account properties dialog box, click the Account tab.Under Account Options, click to select the Account is Trusted for Delegation check box. Make sure that the Account is sensitive and cannot be delegated check box is cleared for this account.
Note The ‘Account is trusted for delegation’ right is required for the SQL Server service account only when you are delegating credentials from the target SQL server to a remote SQL server such as in a double hop scenario like distributed queries (linked server queries) that use Windows authentication.Note These stepsapply only to Windows 2000 Server. If you are using Windows Server 2003, visit the following Microsoft Developer Network (MSDN) Web site:
http://technet2.microsoft.com/windowsserver/en/library/bef202b0-c8e9-4999-9af7-f56b991a4fd41033.mspx(http://technet2.microsoft.com/windowsserver/en/library/bef202b0-c8e9-4999-9af7-f56b991a4fd41033.mspx)Use the Kerbtray.exe utility to verify that Kerberos tickets were received from the domain controller and host: Right-click the Kerbtray icon in the notification area, and then click purge tickets. Wait for the green Kerbtray icon to change from green to yellow. As soon as this occurs, open a command prompt window and run this command:
net session * /d This will drop the existing sessions, and force a new session to be established and a Kerberos ticket received. Step 2: Configure the IIS services serverReplace the default Web site Wwwroot files with the sample .asp files. To create the sample .asp files, use the code that is provided in the “ASP test script for SQL Server data retrieval” section.Add the file to the Wwwroot folder. To do so, use the sample code in the “ASP Test Script for SQL Server Data Retrieval” section. Save the file as Default.asp.Re-configure the Web server to use Integrated Windows Authentication only: Right-click the default Web server, and then click the Security folder. In the Security folder, make the correct changes, and then click to clear anonymous access.From a command prompt, run this command:
cscript C:\Inetpub\Adminscripts\adsutil.vbs get w3svc/NTAuthenticationProviders If Negotiate is enabled, the following is returned:

NTAuthenticationProviders : (STRING) Negotiate,NTLMFor more information, click the following article number to view the article in the Microsoft Knowledge Base:
215383?(http://support.microsoft.com/kb/215383/) How to configure IIS to support both the Kerberos protocol and the NTLM protocol for network authenticationNotesYou must install Microsoft Data Access (MDAC) 2.6, or later, on the IIS Services server. To do so (and to make the tools available for testing), install the SQL Server 2000 client tools to the Web server. To install only MDAC 2.6, or later (without installing the client tools), visit the following Microsoft Web site:
http://msdn2.microsoft.com/en-us/data/aa937730.aspx(http://msdn2.microsoft.com/en-us/data/aa937730.aspx)IIS is a common middle tier system. However, IIS is not the only middle tier system. If IIS is not the middle tier system in your environment, follow the appropriate steps for your middle tier system.Verify that the HKLM\SW\MS\MSSQLSERVER\Client\DSQUERY value is present in the registry. If the value is not displayed, add it as DSQUERY:Reg_SZ:DBNETLIB. Use the Kerbtray.exe utility to verify that Kerberos tickets were received from the domain controller and host: Right-click the Kerbtray icon in the notification area, and then click purge tickets.Wait for the green Kerbtray icon to change from green to yellow. As soon as this occurs, open a command prompt window and run this command:
net session * /d This will drop the existing sessions, and force a new session to be established and a Kerberos ticket received. Step 3: Configure the SQL Server service to create SPNs dynamicallyTo do this, you must grant the following access control settings for the SQL Server service account in the Active Directory directory service:Read servicePrincipalNameWrite servicePrincipalNameWarningsIf you use the Active Directory Service Interfaces (ADSI) Edit snap-in, the LDP utility, or the LDAP 3 clients and you incorrectly modify the attributes of Active Directory objects, serious problems occur. To resolve these problems, you may have to reinstall Microsoft Exchange 2000 Server or Microsoft Exchange Server 2003. In some cases, you may have to reinstall Microsoft Windows 2000 Server or Microsoft Windows Server 2003 and then reinstall Exchange 2000 Server or Exchange Server 2003. We cannot guarantee that these problems can be resolved. Modify these attributes at your own risk.You must be logged on as a domain administrator. Alternatively, you must ask your domain administrator to grant the appropriate permissions and the appropriate user rights to the SQL Server startup account.To configure the SQL Server serviceto create SPNs dynamically when the SQL Server service starts, follow these steps:Click Start, click Run, type Adsiedit.msc, and then click OK.
Note TheADSIEdit tool is included in the Windows Support Tools. To obtain the Windows Support Tools, visit the following Microsoft Web site:
http://www.microsoft.com/downloads/details.aspx?familyid=6EC50B78-8BE1-4E81-B3BE-4E7AC4F0912D&displaylang=en(http://www.microsoft.com/downloads/details.aspx?familyid=6EC50B78-8BE1-4E81-B3BE-4E7AC4F0912D&displaylang=en)In the ADSI Edit snap-in, expand Domain [DomainName], expand DC= RootDomainName, expand CN=Users, right-click CN= AccountName , and then click Properties.
NotesDomainName is a placeholder for the name of the domain.RootDomainName is a placeholder for the name of the root domain.AccountName is a placeholder for the account that you specify to start the SQL Server service.If you specify the Local System account to start the SQL Server service, AccountName is a placeholder for the account that you use to log on to Microsoft Windows.If you specify a domain user account to start the SQL Server service, AccountName is a placeholder for the domain user account.In the CN= AccountName Properties dialog box, click the Security tab.On the Security tab, click Advanced.In the Advanced Security Settings dialog box, make sure that SELF is listed under Permission entries.
If SELF is not listed, click Add, and then add SELF.Under Permission entries, click SELF, and then click Edit.In the Permission Entry dialog box, click the Properties tab.On the Properties tab, click This object only in the Apply onto list, and then click to select the check boxes for the following permissions under Permissions:Read servicePrincipalNameWrite servicePrincipalNameClick OK two times.
Note For help with this process, contact Active Directory product support, and mention this Microsoft Knowledge Base article.
Note To use the dsacls tool to determine if the self account hasthe Write ServicePrincipalName permission, use the dsacls command.The following is the syntax:

dsacls <distinguished_Name_of_service_account> If the self account has the Write ServicePrincipalName permission, you see the following output:

Allow NT Authority\SELF SPECIAL ACCESS for Validated Write to Service principal name
WRITE PROPERTYThe dsacls tool is part of the Support Tools.In the CN= AccountName Properties dialog box, click Attribute Editor.Under Attributes, click servicePrincipalName in the Attribute column, and then click Edit.In the Multi-valued String Editor dialog box, remove the service principle names (SPNs) for the instances of SQL Serverthat use this SQL Server service account.
WarningYou should only delete the SPNs for the instances of SQL Server that you are currently working on. The other instances of SQL Server that use this service account will be able to remove the SPNs that are related to these instances the next time that you start these instances.Exit the ADSI Edit snap-in.After you follow these steps, SPN issues are also eliminated if you change the TCP/IP port or the domain name for new installations of SQL Server 2005 or for existing instances of SQL Server 2005.Step 4: Configure the clientcomputersFor each client that will connect, verify that Microsoft Internet Explorer is configured to use Windows authentication: In Internet Explorer, on the Tools menu, click Internet Options. Click the Advanced tab.Under Security, click to select Enable Integrated Windows Authentication (requires restart), and then click OK.Step 5: Test the configuration For each computer that is involved: Log on to the computer, and then use Kerbtray.exe to verify that the computer can obtain a valid Kerberos ticket from the domain controller.Use Kerbtray.exe to remove all tickets on the computer.Create and connect to the Web page that returns the SQL Server data.
Note Replace SQLSERVERNAME with the name of the computer that is running SQL Server: If data is returned, this page displays the authentication type Negotiate, and the SQL Server data for the result of the sp_helpdb stored procedure that should return a list of the databases on the server that is being connecting to through the .ASP page. If you have auditing turned on in SQL Server, in the Application log you will see that the connection is “trusted”.
ASP test script for SQL Server data retrievalHere is an ASP test script for SQL Server data. If you use this code sample, make sure that you replace SQLSERVERNAME with the name of the computer that is running SQL Server.

<%@ Language=VBScript %><HTML><HEAD><META NAME=”GENERATOR” Content=”Microsoft Visual Studio 6.0″></HEAD><BODY><%=”‘auth_user’ is” & request.servervariables(“auth_user”)%><P><%=”‘auth_type’ is” & request.servervariables(“auth_type”)%><P>Connections string is <B>” Provider=SQLOLEDB.1;Integrated Security=SSPI;Persist Security Info=False;Initial Catalog=pubs;Data Source=SQLSERVERNAME </B><P><% set rs = Server.CreateObject(“ADODB.Recordset”) set cn = Server.CreateObject(“ADODB.Connection”) cn.Open “Provider=SQLOLEDB.1;Integrated Security=SSPI;Persist Security Info=False;Initial Catalog=pubs;Data Source=SQLSERVERNAME” rs.open “MASTER..sp_helpdb”,cn Response.Write cstr(rs.Fields.Count) +”<BR>” while not rs.EOF Response.Write cstr(rs(0))+”<BR>” rs.MoveNext wend rs.Close cn.Close set rs = nothing ‘ Frees memory reserved by the recordset. set cn = nothing ‘ Frees memory reserved by the connection.%></BODY></HTML>
How to gather a list of Active Directory server principle name information To gather a list of Active Directory server principal name (SPN) information, type the following command on one of your domain controllers, where betaland is the NetBIOS domain name and NewoutputUsers.txt is the name of the output file that you will use to port the results. If you do not use a full path, the file is placed in the current folder where you run the command line. This sample command queries the whole domain:
ldifde -d “CN=Users,DC=betaland” -l servicePrincipalName -F NewoutputUsers.txt This syntax creates a file named NewoutputUsers.txt that contains information that is similar to the output in the “Domain level output of NewouputUsers.txt” section in this article.
This output may be overwhelming when you gather it for a whole domain. Therefore, to limit the gathered information to a specific user name, use the following syntax, where User Name is the user name and betaland is the domain that you are querying:
ldifde -d “CN=User Name,DC=betaland” -l servicePrincipalName -F NewoutputUsers.txt Gathering the information for a specific user greatly reduces the data that you must search through. If you gather the information for a whole domain, search for the specific user name of the server in question. In the output sample, you see: Entries for servers that no longer exist, but that were not completely removed from Active Directory.The user “User Name” has valid SPN information about ten different servers. Additionally, you can use the Active Directory Service Interfaces (ADSI) tool to correct Active Directory entries that are not valid.
Warning If you use the ADSI Edit snap-in, the LDP utility, or any other LDAP version 3 client, and you incorrectly modify the attributes of Active Directory objects, you can cause serious problems. These problems may require you to reinstall Microsoft Windows 2000 Server, Microsoft Windows Server 2003, Microsoft Exchange 2000 Server, Microsoft Exchange Server 2003, or both Windows and Exchange. Microsoft cannot guarantee that problems that occur if you incorrectly modify Active Directory object attributes can be solved. Modify these attributes at your own risk.
Domain level output of NewouputUsers.txt

dn: CN=User Name,CN=Users,DC=betaland changetype: add servicePrincipalName: MSSQLSvc/CLUSTERDEFAULT.betaland:1257 servicePrincipalName: MSSQLSvc/INST3.betaland:3616 servicePrincipalName: MSSQLSvc/INST2.betaland:3490 servicePrincipalName: MSSQLSvc/SQLMAN.betaland:1433 servicePrincipalName: MSSQLSvc/VSS1.betaland:1433 servicePrincipalName: MSSQLSvc/INST1.betaland:2536 servicePrincipalName: MSSQLSvc/INST4.betaland:3967 servicePrincipalName: MSSQLSvc/SQLVIRTUAL1.betaland:1434 servicePrincipalName: MSSQLSvc/SQLVIRTUAL.betaland:1433 servicePrincipalName: MSSQLSvc/SQLBUSTER.betaland:1315

E-Commerce with AspDotNetStorefront

E-Commerce with AspDotNetStorefront
AspDotNetStorefront is not just a shopping cart; it is a fully implemented e-commerce store siteand e-commerce toolkit for developers, including shopping cart classes, database, and administration site. This solution is a professional, high performance, fully customizable solution for professional developers. It can support a wide range of store types including general merchandise, clothing, music, software, food products, automotive products, books, computer products, etc. It includes a full store administration module that allows adding/editing of all store information, shipping, taxes, categories, manufacturers, products, affiliates, coupons, orders,
etc.
System Requirements
? .Net framework 3.5
? Windows NT Server 2003 or 2008, Windows XP Professional, Windows Vista Home
Premium
? IIS 5, IIS 6, or IIS 7
? Databases Supported:
? Microsoft SQL Server 2005/2008
? Microsoft SQL Server 2005/2008 Express
? Internet Merchant Account
? SSL (for security)
? Optional: Visual Studio.net or other asp.net development tool if you want to change
source code.
Features Included
AspDotNetStorefront have many features for both the merchants and developers which cause them to choose it from the list of available storefronts.
General Features Provides complete web site solution, including shopping cart, content management, customer management etc. Dynamic data driven pages via XmlPackages Source code option available (either C# or VB.NET)
Multi-lingual capabilities in multiple languages: Store site can support dynamic run-time language switching. Customers can choose to save the language at run time. Storage administrator controls allowed languages. Multi-Currency: customers can choose the currency in order to view stored in the run-time. Allowed
currencies are under control of store administrator.
Search Engine Features Every product, category, and the department page can their own custom search engine meta tags (title, keywords, description, no script blocks, etc). Fully dynamic page titles and meta tags search engine Google Analytics Metrics
Product Capabilities & Features Supports multiple images per product (icon, medium, and large) Automatic image watermarking for protection Ajax Shipping Estimator allows customers to get an idea of how much shipping would cost right on the product detail page. Mini Cart allows customers to quickly view the contents of their cart from any page on the site. Without this page element, customers must go to the shopping cart page to see what they have in their cart currently.
Skinning & Page Layout Customization Features Free skins included, custom skins can be designed and integrated easily. Completely customize the layout & appearance of any category, section, manufacturer, or product page using XmlPackages
Customer Account Customer can view order history, also can reorder the previous order. Skip account creation on checkout (Anonymous Checkout)
Payment Methods Credit Cards: Accept Credit Cards in Real Time: Cards can be processed & verified in real-time, or customer can delay processing until a later time. PayPal, PayPal Express Checkout, eChecks and many more.
Payment Gateways Manual Gateway, Authorize.net, PayPal, PayPal Express Checkout, Secure Net, PayPal , Pay Flow Pro and many more.
PABP security features Visa / MasterCard PABP Certification Certification visa to adhere to the guidelines outlined strict security policies and procedures / installation of the master card, PCI shows to help ensure compliance. SSL is a secure shopping cart for your protection mode automatically switches to the appropriate encryption support. Other brand support SSL certificate. database connection string in web.config file encryption
Notifications Order receipts automatically e-mailed to customer E-mail notification sent to store Administrator when new order arrives Cell-Phone SMS Messages sent to store Administrator when new order arrives.
Limitations
Because of hundreds of features included and providing full control over the source code
AspDotNetStorefront price is competitively high; the pricing structure will keep it beyond the reach of most new site developers. Another limitation of the AspDotNetStorefront (other than cost) is new developers who are still learning can struggle with configuration, making modification of the templates and the back end difficult for the newcomer to properly execute.New developers have to spend some more time to understand AspDotNetStorefront features to make any modification.
Conclusion
Since many years of its release, AspDotNetStorefront is one of the best ecommerce software with its upgraded versions to support multiple languages at regular time intervals.AspDotNetStorefront has a large customer base and has proven to be technically innovative. A beta versions for multi store is released, using this software you can host many stores using different domain name and can manage all them from a central place. Now verified with Visa and having secure checkout with PayPal, Google, authorize.net and many other services it has complete solution for your store. However AspDotNetStorefront team still needs to work on speed of the store site to compete with the storefront available in other technologies like php.
SunArc Technologies