I think the title says it all...oh except in VB.NET Thanks in advance David

Well I figured it out, the answer is to write a procedure that goes off to set the permissions. Just have this code run by the SQL agent

use tempdb
Declare @userName char(100)
Declare @DatabaseUserID [smallint]

--internal sql user name or domain\username
Set @userName = 'InternalUser'
select @DatabaseUserID = [sysusers].[uid] from sysusers where name = @userName
IF @DatabaseUserID IS NULL
BEGIN
EXEC sp_grantdbaccess @userName
EXEC [sp_addrolemember]
@rolename = 'db_datareader',
@membername = @userName
EXEC [sp_addrolemember]
@rolename = 'db_datawriter',
@membername = @userName
END

I am using SQL server to handle my session variables. However every time I reboot the server the permission to call the SELECT queries get reset and I have to manual set them again. To create the SQL Session server I used the script InstallSqlState.sql, should I have used InstallPersistSqlState.sql? Thanks.

I am using SQL server to handle my session variables. However every time I reboot the server the permission to call the SELECT queries get reset and I have to manual set them again. To create the SQL Session server I used the script InstallSqlState.sql, should I have used InstallPersistSqlState.sql? Thanks,

It is not a bug. Custom validators when assigned to a text box only go off when there is text in the control. What you want to do is make sure that the ControlToValidate is NOT set. I use custom validators to validate many different controls at once. Also make sure the the button has the CausesValidation property set to true. If you are still having some problems, I can send you my validation code.

The problem was using FormsAuthentication.RedirectFromLoginPage, it writes its own cookie which over writes yours!!!:mad: So I change it to a Response.Redirect and everything works fine. :-D
However...It took me two days to figure that out because it is not in the documentation. ugh!
Later

I am having problems with the FormsAuthenticationTicket keeping the UserData that I store in it when creating the ticket. The UserData (i.e. my role information) is getting lost. My login code is the following (simpiflied)

'returns "SA" for this demo
Dim roles As String = GetRoles()
Dim authTicket As FormsAuthenticationTicket = New FormsAuthenticationTicket(1, Me.txtLogin.Text, DateTime.Now, DateTime.Now.AddMinutes(60), False, roles)
Dim encryptedTicket As String = FormsAuthentication.Encrypt(authTicket)
Dim authCookie As HttpCookie = New HttpCookie(FormsAuthentication.FormsCookieName, encryptedTicket)
Response.Cookies.Add(authCookie)
FormsAuthentication.RedirectFromLoginPage(Me.txtLogin.Text, False)

Now when a page gets authenticated the code, Application_AuthenticateRequest, in the global.asax the following happens (again simplified)

Dim cookieName As String = FormsAuthentication.FormsCookieName
Dim authCookie As HttpCookie = Context.Request.Cookies(cookieName)
Dim authTicket As FormsAuthenticationTicket = Nothing
authTicket = FormsAuthentication.Decrypt(authCookie.Value)

'this should be "SA" but UserData is ""
Dim roles As String() = authTicket.UserData.Split("|".ToCharArray)

Dim id As FormsIdentity = New FormsIdentity(authTicket)
Dim principal As CustomPrincipal = New CustomPrincipal(id, roles)
Context.User = principal

If I stop the execution in the debugger and modify the value of roles to be "SA" then everything else works fine. The big question is, Why is UserData empty? Thanks in advance.

Is that the source from your aspx file? or the source from right-clicking in the browser and selecting "view source"? It doesn't looking like line 11 is the real problem. Run the program again, do a view source from the browser and see what line 11 is there. Also, you could a put a break point in and traverse line by line to see where it blows up. Hope that helps

It sounds like you are trying to use an object before creating. For example you have something like this

Dim x As Object
x.SomeFunction 'produces error

You should have something like this

Dim x As New Object
x.SomeFunction

or

Dim x As Object
x = New Object
x.SomeFunction

Hope this helps.

Thanks, but I already know how to search for free web analysis tools. I am asking for peoples opinions on any ones that they already have used or heard about. I am looking for personal recommendations.

Most of the examples in the O'reilly books are just to show a working concept, which doesn't really fit into the real world situtation. You should not store the dataset in the session variable for many reasons, the biggest reason is data integratity. If some other process, person, service changes the database, the information stored in the session variable will be invalid which can lead to many problems. Just keep getting your data from the database, just be smart with your queries if performance is becoming an issue, e.g. dont just blinding call "SELECT * FROM Table" when you only need 1 column of data. Anyway, thats just my opinion.

I think he wants to remove the "/" also. so do this... DateTime.Now.ToLongTimeString().Replace("/", "")

Anyone have a suggestion for a good FREE web anaylsis tool?

There are lots of different ways to do it, but here is a function that you can use for setting the focus on loading of page.

'"name" is the control's ID
Private Sub FocusOnControl(ByVal name As String)
    Dim strBuilder As String = ""
    strBuilder += "<script language='javascript'>"
    strBuilder += "document.getElementById('" + name + "').focus();"
    strBuilder += "</script>"
    RegisterStartupScript("FocusOnControl", strBuilder)
End Sub

Then in say in your Page_Load you can call the function

Private Sub Page\_Load(ByVal sender As System.Object, ByVal e As System.EventArgs) Handles MyBase.Load
    FocusOnControl("txtBox")
End Sub

I know Session_End event doesnt get trigger if you have an out-proc session state, i.e. SessionState or SQLServer. So how can I have the session server or the web application trigger an event (i.e. some asp code) when the session times out?

Its not the webform that displays the toolbar, its how you open the webform in the browser. Take a look at the jscript for the open function of the window object. basically you will do some like the following:

<script LANGUAGE="JavaScript">
var url = "mypage.aspx"; // your url to the webform
var name = "popup"; // any name for the window, if you want to reuse the window
var settings = "menubar=no,status=no,resizeable=no,toolbar=no,scrollbars=no"

window.open(url, name, settings);

</script>

Hope this helps.

1. Server.Transfer works as a kind of server-side redirect. It terminates the execution of the current page and passes control to the specified page. Unlike Server.Execute, control is not passed back to the caller page. It is more effective than Response.Redirect. However, If you use Server.Transfer to transfer a user to another page, ensure that the currently authenticated user is authorized to access the target page. If you use Server.Transfer to a page that the user is not authorized to view, the page is still processed. Server.Transfer uses a different module to process the page rather than making another request from the server, which would force authorization. Do not use Server.Transfer if security is a concern on the target web page. Use HttpResponse.Redirect instead. p.s. That is the information i read from "Programming Microsoft ASP.NET" and "Improving Web Application Security: Threats and Countermeasures" 2) I never call Dispose...I like ASP decide when to do clean up.

Well you could pass the information in a session variable. When the page loads, check the variable, if variable exists then display the apprpoiate information. Just a thought.

How do you get the SessionCookie value to add it the [Users] table? Also should there also be another query, something like INSERT INTO [Users] (SessionCookie) VALUES (xxx) WHERE [Users].[Name]=yyy ? Thanks for all your help

Ah I figured it out...atleast with setting up my sessionState to SQLServer mode. I will get back if I need any more help.