Hosting and Servers

21-Oct-13 7:13

I am trying to force a canonical domain rewrite for HTTPS in IIS using the rewrite module - i.e
if user types
https://mydomain.com?querystring
they get sent to
https://www.mydomain.com?querystring

I can get this to work for the simple HTTP protocol, but not HTTPS - I've tried all sorts of variations but this is the closest (as I say, it works for HTTP)

XML

<rewrite>
    <rules>
        <rule name="force_www_https" enabled="true" patternSyntax="ECMAScript" stopProcessing="true">
            <match url=".*" />
            <conditions>
                <add input="{HTTPS_HOST}" pattern="^mydomain.com$" />
            </conditions>
            <action type="Redirect" url="https://www.mydomain.com/{R:0}" redirectType="Permanent" />
        </rule>
        <rule name="force_www" enabled="true" patternSyntax="ECMAScript" stopProcessing="true">
            <match url=".*" />
            <conditions>
                <add input="{HTTP_HOST}" pattern="^mydomain.com$" />
            </conditions>
            <action type="Redirect" url="http://www.mydomain.com/{R:0}" redirectType="Permanent" />
        </rule>
    </rules>

so why won't my HTTPS URL's redirect?

The issue is my SSL certificate which is only valid for www.mydomain.com, so if users type in teh URL for a secure page without the www. they get presented with a browser securoty warning.

Any help gratefully received!

Richard Deeming21-Oct-13 7:38

21-Oct-13 7:38

Try something like this:

XML

<rewrite>
    <rules>
        <rule name="force_www_https" enabled="true" stopProcessing="true">
            <match url=".*" />
 
            <conditions>
                <add input="{HTTPS}" pattern="on" />
                <add input="{HTTP_HOST}" pattern="^www.mydomain.com$" negate="true" />
            </conditions>
 
            <action 
                type="Redirect" 
                redirectType="Permanent" 
                url="https://www.mydomain.com{REQUEST_URI}" 
                appendQueryString="false" 
            />
        </rule>
        
        <rule name="force_www_http" enabled="true" stopProcessing="true">
            <match url=".*" />
            
            <conditions>
                <add input="{HTTPS}" pattern="off" />
                <add input="{HTTP_HOST}" pattern="^www.mydomain.com$" negate="true" />
            </conditions>
 
            <action 
                type="Redirect" 
                redirectType="Permanent" 
                url="http://www.mydomain.com{REQUEST_URI}" 
                appendQueryString="false" 
            />
        </rule>
    </rules>
</rewrite>

"These people looked deep within my soul and assigned me a number based on the order in which I joined."
- Homer

modified 21-Oct-13 14:06pm.

Wombaticus21-Oct-13 7:50

21-Oct-13 7:50

Thanks, but... still stays stubbornly on https://mydomain.com....

Richard Deeming21-Oct-13 8:07

21-Oct-13 8:07

OK, I think I see the problem. I've updated the rules in my previous answer.

"These people looked deep within my soul and assigned me a number based on the order in which I joined."
- Homer

Wombaticus21-Oct-13 8:15

21-Oct-13 8:15

Still no, I'm afraid... as before, it's fine for HTTP but not HTTPS

Richard Deeming21-Oct-13 8:30

21-Oct-13 8:30

Have you copied the rules exactly as I posted them, substituting your real domain name?
NB: Your question used {HTTPS_HOST}, which doesn't exist. You have to use {HTTP_HOST} instead.

Are you sure you're updating the config file on the live server?

Is there any load-balancing hardware in the way?

Everything I've seen suggests that the rules I posted should work. For example, they're practically identical to:
http://www.rewriteguide.com/enforce-canonical-domain-iis.html[^]

"These people looked deep within my soul and assigned me a number based on the order in which I joined."
- Homer

Wombaticus21-Oct-13 8:35

21-Oct-13 8:35

Yes, I copy pasted your code, substitutuing the domain name, to he live server - but see my other post in reply to this...

While the certificate is installed on this server (of course) the domain's DNS is handled by a third-party, adn it *seems* as though what is happening is that when the original request comes in, the DNS server is requesting authorisation from the certificate before passing teh request on.... is that how it works? It would explain it, but leave me in a fix...

[edit] no, no load balancing

Richard Deeming21-Oct-13 8:43

21-Oct-13 8:43

The DNS server shouldn't be requesting anything from your site. It's simply an address book which maps an entry like www.mydomain.com to an IP address.

From your other post, it sounds like the browser is making the request for https://mydomain.com, and then barfing when it gets a certificate for www.mydomain.com, since they might not be the same site.

Many certificate authorities will issue a certificate which is valid for both www.mydomain.com and mydomain.com, so it might be worth seeing if that's an option. Otherwise, you'll need a spare IP address and a second SSL cert to avoid this error. (You could probably get away with a free cert from StartSSL[^], since you're only securing a redirect to the real site.)

"These people looked deep within my soul and assigned me a number based on the order in which I joined."
- Homer

Wombaticus21-Oct-13 8:57

21-Oct-13 8:57

Yes, I was afraid that might be the case. Given that it's pretty much a standard that mydomain.com and www.mydomain.com be the same site, you'd think this would be a standard too for SSL certificates. Sigh.

Thanks anyway for your help.

Wombaticus21-Oct-13 8:31

Superuser on Domain Controller

21-Oct-13 8:31

AH.... what's hapening is that the browser still shows https://mydomain.com in the address bar, and throws up a "This connection is untrusted" warning... but if you click through that THEN you will get redirected to https://www.mydomain.com, adn all is well.

However, I need, of course, to by-pass this warning...

[DK]KiloDunse21-Sep-13 4:18

[DK]KiloDunse

21-Sep-13 4:18

Hi.

How can allow a user (Domain User?) to log on to a DC, and unlock user accounts?.

I've created a Group called "SuperUsers".

I've added the group Superusers to the Remote Desktop Users, and added the group in the "Allow logon through Terminal Services" option in Local Security Policy - and Delegate Control... by setting the Read/Write lockout properties on user accounts.

But when the users tries to start mmc.exe, the users is asked for Administrator credentials.

I know that you can do it with Remote Desktop Administrative Tools - but it's an assignment, where it has to be done on the Domain Controller.

Edit: Wrong forum. How do i move it to "System Admin"

modified 23-Sep-13 13:54pm.

Re: Superuser on Domain Controller

[DK]KiloDunse23-Sep-13 7:52

[DK]KiloDunse

23-Sep-13 7:52

I solved the problem.

I need to create an extra GPO, which overrules the "Default Domain Controllers Policy" - and add the SuperUsers group to the "Allow log on locally" property in Policies -> Windows Settings -> Security Settings -> Local Policies/User Rights Assignment.

Now a normal Domain User can be delegated to job of unlocking users on the domain controller using Remote Desktop.

Help with web hosting

Otekpo Emmanuel16-Sep-13 14:01

Otekpo Emmanuel

16-Sep-13 14:01

Hello everyone! Please I need some guidelines about web hosting and its techniques. I want to host a website that will charge visitors per click. Now the question is how can I host the website so that it can have its own domain name. And, how can I be paid when a click is performed. Please help! Emmanuel.

Re: Help with web hosting

Richard MacCutchan16-Sep-13 21:16

Richard MacCutchan

16-Sep-13 21:16

Please stop spamming these forums and go and spend some time learning your subject. There are plenty of resources to be found on the internet, including the CodeProject Articles section.

Veni, vidi, abiit domum

Software update hosting service

Andrey Moskvichev10-Sep-13 2:27

Andrey Moskvichev

10-Sep-13 2:27

Hello,

I have an idea to make cloud software update service for desktop apps.
Most of the apps require updates, and i don't know flexible update systems (If you know such solutions, please, let me know).

It consist of two parts:
Update client. Software component, that checks for updates (scheduled, on app start, etc), downloads them, and performs update. Update client is made as multiplatform SDK, that can be easily integrated into projects.

Update server. Holds updates on cloud storage. Has web-based UI, with access control, products/releases dashboard, and client update logs/reports.

Here are some features of it:
- SDK, that can be easily integrated to .Net/C++/Java apps.
- Customisable update client
- Differential updates. Update is binary diff. So, it 20 MB file has a few changes, will be downloaded a few bytes, instead of full 20 Mb file
- Client update logs and reports
- Multiple products and releases
- Update rollback
- Integrated with MS Visual Studio and Elipse

What do you think about it?
If you are interested in such service, please send me your comments and suggestions.

Best regards,
Andrey Moskvichev V.

RedDk19-Sep-13 7:35

RedDk

19-Sep-13 7:35

Don't take this the wronng way, but, since you asked and I get 10 points for answering (here in Discussions) as well as can now go on record as having answered a survey about a "trendy topic" of sorts ...

This whole cloud paradigm is doomed to fail. There.

And with any work on my part will fail sooner than later.

Andrey Moskvichev28-Sep-13 6:01

Andrey Moskvichev

28-Sep-13 6:01

I know, that cloud services have a drawbacks, and how they are used today is not the best way.

But, can you explain, why do you think, that "This whole cloud paradigm is doomed to fail." ?

RedDk28-Sep-13 9:08

RedDk

28-Sep-13 9:08

Sure Andrei,

Computers have been "online" since before 1980. General subscribers have been playing games through billed services and bulletin board posters have been placing peers on the alert through the years up until the turn of the century when the latest morph/changling of the proud parent "the internet", the cloud, was born. Since then the whole business of "connectivity" has blossumed into a billion dollar industry and everybody welcomed another venue to exploit this electronics gene-pool. But computers, aside from what one reads now, are calculating devices at a level just above electronics. And hopefully you'd agree with me being a coder and a CPian, that just to the left of any ethernet card or serial port device, growth of this technology is around speed and volume.

CPU and memory. Faster and more of something. And possibly smaller footprint.

Now look at the cloud. what is it? A storage device. It's an external "hard drive" to the computer. Instead of adding a drive to my stack I add a drive to an external location? Seems more like an unknown Ex on a map where I have little influence over maintenance and security. Average dunderheaded cloud user (the one who signs up to store stuff, his apps, his information, his things he's going to make available to others) there could just as easily plop another hard drive into his ccabinet and have locally, his way, when he wants it, out from under any eyes but his own, for a decade until it's full, all his stuff just as easily.

It's a conservative spin on an alarmingly liberal communicative yackety-yack non-sense-for-the-sake-connected-non-sense that I will stand behind. Frankly, noone's going to chuck their hulking 100lb stack of hardrives and their gigantic 6.0GHz CPU and the 256GB of RAM they call "MyComputer" just because "cloud" storage is free now.

Mr. Deasey, what say we now ... ?