I work for a large multination company, which boast possibly the largest intranet in europe.

The microsoft parts of this intranet are taking, upto 9,000,000 hits per day, using an assumtion of 10 hits per page impressiion (GIFs, CSS etc) that is 900,000 page impressions per day, I can’t speak for the linux hosted parts as I don’t have access to ALL of the data.

Compare to  an avarage joe-doe blog site or even the avarage small business web site (4,000 page impressions per day, this is real data from a small 10 employee ecommerce web site) that is quite impressive.

Then enter the BBC , from the BBC annual report “bbc.co.uk’s reach grew by 16.2 per cent over the year, with page impressions averaging over 3.6 billion per month.” that is 120 Million page impressions per day (or using the same assumption I made above 1.2 billion server hits per day)

one word

WOW !!!!!!!!!!!!!!!!

Like many, my preferred web platform, (done a few intranet and internet) uses a CIFS based backend content store and unique AD based application pool identities for EACH application. This has several plus points. Add to this a tweaked .NET medium trust and you have a secure and scalable platform.

But that is where the fun starts

.NET needs to trust the code it is being asked to run, which by default only include local disks, so code on a UNC path is not trusted by default. Fortunately for .NET 2.0 that is fairly easy and the following command will arrange that for you…

caspol -machine -addgroup 1. -url \\HOST\SHARE\* FullTrust

OR  so you would think

One of the platforms which had passed all of its Accept into Service tests, and was happily running a handful of websites doing all manner of stuff, was refusing to correctly interpret a simple parameter, on one web site. A web site using the “ajaxcontroltoolkit.dll”, in the <controls> section of the web.config file the line 
<add namespace=”AjaxControlToolkit” assembly=”AjaxControlToolkit” tagPrefix=”ajaxToolkit”/>”
was being completely ignored. It was not a case of the assembly was not being found as some code which created a NEW object based on a class in the assembly (Dim mp As AjaxControlToolkit.ModalPopupExtender) worked fine, but any attempt to us a ajaxToolkit tag “<ajaxToolkit:ModalPopupExtender ” failed with a “Parser Error Message: Unknown server tag ‘ajaxToolkit:ModalPopupExtender’.”

Various tests on the same code on servers with local content all worked, and in fact it works on the (unc based) Development platform too.. (lot of head scratching followed)

Anyway after 15 hours of digging to locate the fault, is came down to a missing “\”
caspol -machine -addgroup 1. -url \\HOST\SHARE\* FullTrust
compared to
caspol -machine -addgroup 1. -url \\HOST\SHARE* FullTrust

All fixed and working now

A FEW WORDS OF ADVICE,

• Changes to security.config doe not force a recompile
• When faulting an ASP.NET config issue, always do and IISreset and clear the compilation cache before each test.

This Blogging Platform is built on Wordpress MU, Wordpress MU is slightly different to Wordpress in that it has support for multiple independent blogs on top of a single user database, when running in folder per blog mode Wordpress MU is totally dependent on the apache MOD-ReWrite feature to rebuild URL in the fly. This is a feature that has been missing from IIS until now, Microsoft have released, albeit CTP1 at the moment, a URL rewrite module for IIS7.

Wordpress and Wordpress MU can also use url-rewrite to create “friendly” permalinks

Well I did it, installed a copy of Wordpress MU on IIS7 in folder per blog mode

• Server 2008 enterprise
• IIS7 URL-ReWrite CTP1
•  Wordpress MU 1.5.1
•  mysql-5.1.25-rc-win32
•  ZendCore-2.5.0-Windows-x86

Using the URL-Write Module and some help from IIS.net, it was fairly straight forward; URL-ReWrite is still in CTP1 and has a few known issues. For instance the import wizard correctly identifies the  [L] parameter in .htaccess and create the correct XML, but the ”stopProcessing” attribute does not get copied to the web.config file and the ReWritecondition flag created a NEW rule with no action , rather than apply the condition to the next rule.

So after a bit of fiddling and some help from IIS.NET I got it all working including CSS and themes for folder based blogs.
The Only issue I did not fix was an issue with ONE of the CSS files which controls the layout of the TOP of the admin pages,

SORTED !!!!!!!!!!

Just so i dont lose it the web.config file is here

And dont forget the rewrite server variable fix too

I have been working on a ZERO touch build script for IIS on and off for a few weeks,

One of the last stepping stone for formating the “data” drive prior to setting everything up

“FORMAT H: /FS:NTFS /V:ASG” will prompt for “do you want to erase all yoiu data”, and again if the disk is in use !

 So enter WMI, after only 20 mins of digging around the the internet I found some code to do a defrag, a few tweaks, and I have some VBS code that will format a DRIVE, NO questions, even if the drive is in use, and it is ONLY 7 lines

strComputer = “.”
Set objWMIService = GetObject(”winmgmts:\\” & strComputer & “\root\cimv2″)
Set colVolumes = objWMIService.ExecQuery (”Select * from Win32_Volume Where Name = ‘H:\\’”)
For Each objVolume in colVolumes
     errResult  = objvolume.dismount(1,0)
     errResult = objVolume.format(”NTFS”, 1, 4096, “ASG”, 0)
Next

I am heavily involved in designing, building some large intranet and internet Microsoft based web hosting platforms. Many of these platforms are designed to allow consolidation of existing applications on to a load balanced web farm. As the quality of the source code is unknown , and many employ file upload techniques I extensively use a CIFS backend for web content, once you get past all the smoke and mirrors with IIS connecting to content on the UNC share. You have to consider how this UNC path is managed. To reduce any future implications of file server changes DFS provides an excellent way to alias in the REAL UNC path in a manner which is understood by all of the modern windows operating systems. But then you have to create and possibly destroy DFS links on the fly , as part of your automated site creation processes.
Version 1 of my automation scripts, used a SHELL to  call DFSCMD.exe, while this works it is less than ideal,

After many hour of internet searching,   I came across http://pinvoke.net and  a few articles on calling netapi32.dll from c#
http://jkhines.com/blogs/code/archive/2007/12/15/access-dfs-from-net-posted.aspx
http://msdn.microsoft.com/en-us/library/bb524805(VS.85).aspx

A FEW hours later I have a working .net 3.5 assembly to add and remove DFS links, Sorted

Download the source here

After going the full duration, 3 interviews and an assessment day over 3months
I had “the Call” from Microsoft HR consultants this morning

Unfortunately it is a “NO Hire” that makes it the first job (ever) I have applied for that I have not got ! BUM

Got some good feedback, no surprises for me though

Good points

• General Technical knowledge is good, particularly in web services area
• Presentation content was well researched and has ALL of the appropriate points

Bad points

• Technical knowledge not deep enough in some areas AD GPO, and high end security got tripped up in duel vendor firewalls, I may have even been tripped up on SQL log shipping recovery process (I need to check), I also struggled to explain some of the decision points when I have built  HUGE intranet platforms
• Some of the business stuff is outside my comfort zone , which limits my ability to talk to business people
• Presentation style. In hind sight (the wonderful tool that it is) I spent too long researching the content, and not enough time rehearsing, end result is I will TOO reliant on my notes and came across as reading a script,

Just not quite what they are looking for at in a consultant at the moment

I can’t help feeling, the presentation delivery is totally my fault , and I KNOW I can do better
It is not my normal style to be dependent on notes, and running out of time to prior to the event rehearse is totally my fault and in excusable

I will now be wondering if I would have been better missing a few points and get the delivery right

One of the most hotly requested features for IIS is now available!  Yesterday Microsoft shipped the first technical preview of a new URLrewrite module for IIS7.  It is free for all IIS7 users and available for download x86 and x64

  May be Time to POC Wordpress MU on IIS7

I am busy designing and building  infrastructure for various “as a Service” service offerings

Web as a Service (IIS)
Data as a Service (SQL and Oracle)
Middleware as a Service

So I thought I would float a few questions

What is High Availability?
When do you need it?
How do you create it?
How do you measure it?

DISCUSS !!

[UPDATE]

Here is my two penneth,

Historically many bespoke application are developed on the same servers the prodcution application runs on. Often this server was built by the developers with little regards for consistancy. After all developers develop applications for a living, not build server infrastructure.

Developing an application on the production server can lead to many problems, particularly if that server build is not quite right or the developer is a little wet behind the ears and does not considure scaling issues and hard coded resource refernces. Then of course it is always possible to cripple the production server by testing rogue application code at the whim a developer. I could witter on for ages about this, bit i want to get on towards what needs to be done to consolidate these applications to central managed infrastructure. Putting to one side the issues of supporting the, often extremely large, consolidation platform, many problems need to be over come to ensure the successful migration / consolidation of bespoke applications in the enterprise.

<UPDATE>
It is worth pointing out that these applications should be consolidated to a well defined, well managed platform, where each appliaction exists in a logical container where ALL interfaces and features are defined and controlled by the infrastructure. Hopeful reducing or even eliminating many of the future gotchas

It should also be noted the technology is only a small part of the battle. Accurate recording of succesfull migration, ownership, and reporting of KPIs also need to be considered. i am not talking a few spreadsheets, it needs to be a fully operation CMDB. spreadsheets are not searchable on MASS, so without a proper CMDB you still only have a huge quantity of unstructure data which is be out of data before you can use it
</UPDATE>

 So this is my list of check points and Gotchas

Information Required

• Who owns the application (business owner, not a Project manager) ?
• Do they have resource to manage coding changes that may be required ?
• Who Need access to develop the application ?
• Who supports the APP ?
• Does the app have a offical supoprt team ?
• Does the app have approval from the corporate security guys?
• How many users ?
• Does it need access to employ data / GAL ?
• .net version requirements
• Database Requirements (oracle and SQL), linked Servers
• Database requirements (un supported and  will need to migrate)
• Downstream dependencies
• Upstream dependencies
• LOB implications (many corporates have to segragate their LOBs BT Openreach for example)
• Any 3rd party access customers (via portals)
• Any 3rd party access offshore users
• Any 3rd party access offshore support
• Any 3rd party access vendors COTS software
• Quantity of SMTP traffic generated
• Database growth expectations
• File Space growth expectations
• Any confidential data requirements
• Any encryption Key management requirements

Things that may need to change

• Db connect strings
• Tnsnames migration to non tns connection strings
• SMTP parameters
• Cold fusion with ldap queries
• Hard coded File paths
• Hard coded Server names
• Hard coded data (other)

Gothchas

• Oracle client compatibility
• File system access by application
• 3rd party components
• Has it been used to running with elevated privileges
• Do any DTS/SSIS need access to file systems
• Does SQL run as a service account, What perms does this have
• Self referencing http calls such as web services (can break on hardware load balanced farms)
• SMTP components
• Non web based components, windows exe, scripts or services
• Use of MS Office components
• Use of MSACCESS
• Sql optimisation (query and indexes)
• Cold fusion version (4.x , 5 code not 100% compatible with MX series)
• Cold fusion with AD  authentication (will need code change if using bluedragon CFML engine)
• Asp/asp.net auth against local accounts
• .net data components and memory usage
• SSL
• Session management
• Web gardens
• .net assemblies in bin folder
• .net assemblies in GAC
• .net trust requirements
• Frontpage (Yuck)
• WebDAV (Security implications)
• Application session variables cannot be seen by other servers in the farm
• Do the support guys have SA access to the current SQL server
• Do the Support guys have console access to the current  SQL server
• Do the support guys have console access to the web current  server
• Date time issues on code developed on servers with wrong regional configuration

For a while now many Cold Fusion app have been doing LDAP auth using a JRUN Call.

ntauth = createObject(”java”, “jrun.security.NTAuth”);

As Blue Dragon Runs on J# and .NET a JRUN call fails
After refereing to the BlueDragon Deploying CFML on .net Guide and a Microsoft article on AD Authenication,

I created a ADAuth DLL (an assembly which goes in the bin folder) from the MS code, and used the following CFML Component code to call it

<cftry>
<cfscript>
//create the object
ntauth = createObject(”.net”, “FormsAuth.LdapAuthentication”);
//Call the contructor
ntauth.init(”LDAP://DC=xxxx,DC=yyyy,DC=zzzzz,DC=com”);
//do the Auth
ntauth.IsAuthenticated(arguments.domain, arguments.userid, arguments.passwd);
auth = true;
</cfscript>
<cfcatch>
<cfset auth = false>
</cfcatch>
</cftry>

 Now to write a CFML Component which detects the CFML engine and call the correct method !