Anton Gogolev's questions

Yes, it's all ancient. Yes, not supported. Welp...

What would be the correct way to create an IIS SMTP Virtual Server using command-line tools so that the whole endeavor could be scripted and DevOpsed away in a Git repository?

Here are my unsuccessful attempts thus far (as Administrator, of course):

adsutil create smtpsvc
adsutil create smtpsvc/2
adsutil create smtpsvc/2/root
adsutil create smtpsvc "IisSmtpServer"
adsutil create smtpsvc/2 "IisSmtpServer"
adsutil create smtpsvc/2/root "IisSmtpServer"

and all the variations thereof. All of them failed with one error or another.

Oh, the places I've been to while Googling for answers... But alas, nothing really helped me even create the SMTP Virtual Server.

Is there any way to do a test run on the the AD FS Claim Transformation Rule (as in this)?

I have a valid SAML response, I have a more-or-less valid CTR, but how on Earth can I run the CTR against the SAML response to actually see the result of the transformation?

Case in point. This is the SAML response:

<samlp:Response Version="2.0" ID="rABny-Np-JQ4Gfg1S7x3Mtb71KX" IssueInstant="2018-12-14T12:47:12.591Z" InResponseTo="id-2328a4b7-c905-428e-a0c7-bc163f6ab1f4" xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol">
    <saml:Issuer xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion">...</saml:Issuer>
    <samlp:Status>
        <samlp:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Success"/>
    </samlp:Status>
    <saml:Assertion ID="wPg-7mgx97wCreyIZNLuQG5O5sc" IssueInstant="2018-12-14T12:47:13.075Z" Version="2.0" xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion">
        <saml:Issuer>se-idp</saml:Issuer>
        <ds:Signature xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
            <ds:SignedInfo>
                <ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/>
                <ds:SignatureMethod Algorithm="http://www.w3.org/2001/04/xmldsig-more#rsa-sha256"/>
                <ds:Reference URI="#wPg-7mgx97wCreyIZNLuQG5O5sc">
                    <ds:Transforms>
                        <ds:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature"/>
                        <ds:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/>
                    </ds:Transforms>
                    <ds:DigestMethod Algorithm="http://www.w3.org/2001/04/xmlenc#sha256"/>
                    <ds:DigestValue>Zzkf8Kzwtqj2fx/fIyVt6FnMTXLWy+BEApwzqFqzEHo=</ds:DigestValue>
                </ds:Reference>
            </ds:SignedInfo>
            <ds:SignatureValue>...</ds:SignatureValue>
            <ds:KeyInfo>
                <ds:X509Data>
                    <ds:X509Certificate>..</ds:X509Certificate>
                </ds:X509Data>
            </ds:KeyInfo>
        </ds:Signature>
        <saml:Subject>
            <saml:NameID Format="urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified">SESA442598</saml:NameID>
            <saml:SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer">
                <saml:SubjectConfirmationData Recipient="https://sso.example.com/adfs/ls/" NotOnOrAfter="2018-12-14T12:52:13.075Z" InResponseTo="id-2328a4b7-c905-428e-a0c7-bc163f6ab1f4"/>
            </saml:SubjectConfirmation>
        </saml:Subject>
        <saml:Conditions NotBefore="2018-12-14T12:42:13.075Z" NotOnOrAfter="2018-12-14T12:52:13.075Z">
            <saml:AudienceRestriction>
                <saml:Audience>http://sso.example.com/adfs/services/trust</saml:Audience>
            </saml:AudienceRestriction>
        </saml:Conditions>
        <saml:AuthnStatement SessionIndex="wPg-7mgx97wCreyIZNLuQG5O5sc" AuthnInstant="2018-12-14T12:47:13.044Z">
            <saml:AuthnContext>
                <saml:AuthnContextClassRef>urn:oasis:names:tc:SAML:2.0:ac:classes:unspecified</saml:AuthnContextClassRef>
            </saml:AuthnContext>
        </saml:AuthnStatement>
        <saml:AttributeStatement>
            <saml:Attribute Name="mail" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:basic">
                <saml:AttributeValue xsi:type="xs:string" xmlns:xs="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">[email protected]</saml:AttributeValue>
            </saml:Attribute>
            <saml:Attribute Name="sAMAccountName" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:basic">
                <saml:AttributeValue xsi:type="xs:string" xmlns:xs="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">JA234123</saml:AttributeValue>
            </saml:Attribute>
        </saml:AttributeStatement>
    </saml:Assertion>
</samlp:Response>

And this is the CTR I'm trying to use to transform the /Attribute/@Name="mail" to a claim we're expecting:

c:[Type == "mail"] => 
  issue(Type = "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress", Issuer = c.Issuer, OriginalIssuer = c.OriginalIssuer, Value = c.Value, ValueType = c.ValueType);

Is there any official documentation on what happens with in-flight requests when an IIS Application Pool is stopped (either from withing the UI or programmatically)?

I suspect that an AppPool is "gracefully" stopped, draining all active requests, but I'd love to have my slightly-educated-guess confirmed.

My .NET 4.0 webapp is running on Windows Server 2008 on IIS 7.5 using an Integrated pipeline.

I want to only enable the "big four" HTTP verbs. According to the documentation, this should do the trick:

<system.webServer>
  <security>
    <requestFiltering>
      <verbs allowUnlisted="false" applyToWebDAV="true">
        <add verb="GET" allowed="true" />
        <add verb="POST" allowed="true" />
        <add verb="PUT" allowed="true" />
        <add verb="DELETE" allowed="true" />                    
      </verbs>
    </requestFiltering>
  </security>
</system.webServer>

But, as you might have already guessed, it does not. Doing an OPTION request still results in "HTTP 200 OK", as do LOCK, PROPFIND and some others. All of this with WebDAV not being installed.

Removing the <add verb="GET" ... line results in IIS correctly responding with a HTTP 404.6 (Verb Denied) error.

Am I missing something obvious here?

I'm aiming for a zero-downtime deployment of our ASP.NET 4.0 web application and the Internets say that the kosher way of doing this is as follows:

• Copy new files over to c:\inetpub\my-site-new-version
• Change application physical directory from c:\inetpub\my-site-old-version to c:\inetpub\my-site-new-version

Now, it all sounds fine and dandy, but nowhere I could find any information on what happens to requests in-flight while IIS changes its settings. In other words, what are the consequences of changing physical directory of an application that is currently serving requests?

We're developing a SaaS application which, among other things, provides space for Mercurial (Hg) repositories. Now, Hg repo is just a directory on a disk and each user is allowed to have as many of them as possible, but the limiting factor here is the amount of disk space allocated based on their subscription (like, 100 Mb for Free plan, 6 Gb for Premium, etc).

What we're trying to do is to have per-directory quotas for one user (which will be the user ASP.NET site will be running under). Is this doable under Windows Server? If it is, can it be done programmatically?

Here's my configuration: Windows Server 2008 R2 Standard as a host OS, and two guests VMs running the same exact OS.

Yesterday, Trial Activation on all OSes has expired and quite naturally all machines shut down. I rearmed the host, but cannot log on to either guest VMs. From what I see, they start up normally (State is listed as Running) but CPU Usage seems to be stuck at 3% and when I connect to it all I see is black textmode screen with cursor blinking.

One of my VMs has several snapshots, and when I revert back, it starts up normally. Moreover, "reference VM" (the one I cloned these two VMs from) starts up just normally.

How can I troubleshoot this issue?

It's either me or this feature doesn't work.

I have a Google Apps account (non-paid) for example.com set up fine and dandy. Among other addresses, there are support@ and employee@.

Now I want to set up Filters such that all mail sent to support@ should be forwarded to employee@. Note that this is not POP3/IMAP forwarding: I really need to do this with filters.

The problem is as such: when an email arrives to support@ it is never ever forwarded to an address within the same domain, but is forwarded perfectly fine to some "outside" address (for instance, forwarding to my personal GMail account works flawlessly).

How do I set up Filters to forward email propely?

I may not be asking this question correctly, so please excuse me if I'm woefully wrong.

I have a VM running inside Hyper-V. The host machine is actually a web server, so it has IIS, Internet connection and all that. What I want is to have this VM, which will also run IIS, accessible from the outside world. I understand that it will be impossible to have IIS listening on port 80 since it's already taken over by the host, so something like 8080 (or whatever arbitrary port) will be just fine.

I Googled all around and couldn't find anything on how to set up port forwarding with either Windows Firewall, or with Hyper-V itself.

I'm running VisualSVN Server on a machine which is a member of a domain (it's Windows Server 2008 R2). Now I'm trying to grant myself permissions to access a repository. I right-click on Repository node, click "Properties", then "Add". Standard "Select Users or Groups" dialog pops out, but what's strange about it is that it has "DEV" as "From this location", although other non-VisualSVN Server windows have domain name as Location:

_{(source: rsdn.ru)}

After adding myself (I'm in the LDAP directory), here's what VisualSVN displays in Repository Properties:

_{(source: rsdn.ru)}

And finally, try as I might, I cannot access the repository. Event Log entry for VisualSVN Server says this:

LookupAccountSid() failed. (OS 1332) No mapping between account names and security IDs was done. [client 192.168.0.94]

What can I do to resolve this problem?

I can't get my head around the following situation. We have an outside-available web site (say, http://example.com). It runs on our Windows 2008 server in IIS7. Now I want to make one of our internal servers available to the outside world as well (http://dev.example.com). I've set up DNS entries so that dev.example.com points to the same IP as example.com does, but I'm not sure how to configure web servers correctly.

This dev server hosts, among other things, an OpenID server (which, I think, can cause some serious problems when web servers are incorrectly configured), bug tracker and a Subversion repository. This whole slew of applications runs inside Tomcat 6 which is, to my limted knowledge, is not a web server per se. I know that it can talk to Apache and I'll install it if it's really needed.

The question is: how do I set up IIS/Tomcat/DNS/whatever so that the configuration I just described will work seamlessly.

This is a Canonical Question about Active Directory domain naming.

After experimenting with Windows domains and domain controllers in a virtual environment, I've realized that having an active directory domain named identically to a DNS domain is bad idea (Meaning that having example.com as an Active Directory name is no good when we have the example.com domain name registered for use as our website).

This related question seems to support that conclusion, but I'm still not sure about what other rules there are around naming Active Directory domains.

Are there any best practices on what an Active Directory name should or shouldn't be?

I'm currently setting up operational environment for our company, which includes installing Crowd for SSO, JIRA for bug tracking, and Confluence as our wiki. My idea is that all these products should be available via HTTP 80 on our internal development server (kinda http://dev/crowd, http://dev/jira, etc.) and will be available from the outside (for instance, Google Apps requires publicly available SSO server, so http://dev.acme.com/crowd should work there).

I'm currently at a loss trying to choose good appserver for all these products. What I need is a Windows Server 2008 x64 R2-compatible appserver which is easy enough to set up and administer (GUI administration utilities will be nice, but I'm quite comfortable with console and configuration files) and wich can handle some 5+ applications for a 10+ people organization.

Tired of wading throug MMC jungles, I need a way to import a given .cer file (which contains just a public key) into machine-wide certificate store (don't know how is it called in English since I'm using a localized version of Windows) into "Personal Certificates" folder. Both cmd.exe or PowerShell versions will be fine.

I'm currently setting up an environment for our developers and I am faced with a problem. We're planning on having Crowd, JIRA, Confluence, Bamboo, etc (all by Atlassian; all running on Windows Server 2008). All these products need a back-end database, which will be Microsoft SQL Server 2008.

So the issue is: is it fine to have SQL Server running inside a guest OS (performance-wise) or performance will be sub-optimal in this environment?

We're planning to move all our corporate emails to Google Apps, but I couldn't find an answer to the following question anywhere. Hope anybody will help.

Currently, we have 10 real email addresses (that is, for everyone in our organization) plus a handful of administrative ones (like support@, registrationrequest@, etc.). After moving to Google Apps I'm only planning to keep these 10 "real" addresses and leave support@ as the only "administrative" address: there's no benefit in paying 50$ a year for an address which will receive a dozen emails a year.

So here's my problem: is it possible to tell Google Apps to forward all emails sent to an unknown (unregistered) address to a particular email box so that all emails sent to, say, registrationrequest@ will eventually end up in support@?

We're a small development company and we're currently looking for a server for our internal needs. The basic idea I came up with is that this machine will itself run nothing but VMWare or Virtual Server (we'll be using Windows) and host virtual machines for various capacities.

We need to run:

• Domain Controller
• Microsoft SQL Server (for testing purposes, nothing really heavy)
• Web server (again, for testing purposes)
• TeamCity, JIRA, Confluence whatever

I'm absolutely unaware of current hardware trends (but I do know how to assemble a PC, I just can't really tell the difference between all theses Conroe, Merom, Wolfdales, etc.), so I'm asking for a configuration for a machine capable of performing the said tasks. My personal wishes include lots of RAM, multicore CPU (this is common nowadays, isn't it?) and probably RAID. Other than that I'm open for any ideas.

I'm a complete newbie with regard to managing Apache, so excuse me if I'm phrasing something incorrectly.

I have a web site -- say, http://domain.com. The problem is that when I try to open http://domain.com/index.html in a web browser it displays the page, but when I attempt to access http://domain.com/Index.html (note capital I), it responds with HTTP 404.

How do I configure Apache to serve both these files (and directories, for that matter) in a case-insensitive manner? Current httpd.conf is here.

EDIT Dan C, thanks for a hint. I basically want to allow users to download files from my server and don't really want them to be aware that Index.html and index.html are in fact different.

I'm also very willing to know as to what are the ramifications of this decision.