Overview

Overview of iisPROTECT
Return to Introduction
iisprotect

Thank you for choosing iisPROTECT, a complete Membership and authentication system. Using a high performance ISAPI filter for authentication and a powerful component for administration, iisPROTECT provides an unprecedented level of protection for your web site. iisPROTECT will protect any file within ones web site and requires no specific configuration on a per file basis. It will also protect entire directories and all files within given directories in addition to single files.

New: iisPROTECT Version 3.0 See what's new!

iisPROTECT Features:
· Protect all types of files not just ASP scripts .gif .jpg .htm .zip .pdf .mdb .anything!
· Users / groups / authentication Independent from NT users
· Users and groups stored in a database backend with high performance access via native OLEDB.
· Supports Access and SQL server for high end membership systems
· No limit to the number of groups and users. Users can belong to 1 or more groups.
· Does NOT require cookies, can optionally use cookies and custom login forms
· Cluster and web farm ready multiple web servers running iisPROTECT can use a common database of users
· Specifically designed for ISP and WPP environments with multiple independent sites on a given server. Each site has its own admin and server administrators can remotely administer iisPROTECT asp.
· Supports dedicated IP and host header sites (multiple sites on a single IP address)
· Auto login users based on criteria including IP, domain, useragent and referrer including wildcard support. e.g add your intranet systems so you don't need to login from the office but outside internet users must still login
· Filter users based on their IP, domain, useragent and referrer and present a custom error or HTML if the filter criteria is met. e.g. redirect specific browser version to a download page, ban links from a given site etc.
· Set session length on a per site basis
· Tie into existing databases without migrating existing data or maintaining separate database.
· log to event log / text file. Site logs are specific to each site.
· Redirect or return custom errors for account expired or account inactive conditions
· disable accounts through the web interface with a simple selection without deleting the user
· Configure access restrictions on any specific file, an entire directory or a directory and all subdirectories and files within it
· Web administration is dynamically generated from the database. If you add new fields you can add information to them without any programming or scripting
· Complete web administrations allows for viewing, updating, adding, deleting users / groups / access
· Easily page through user / group listings: with all entries, show only options starting with a letter of the alphabet or search for any specific criteria.
· Powerful search facility works with any custom fields you may add automatically with no changes needed. The same is true for email selection criteria and data fields.
· Drill down on any user / group from any listing to view or modify information
· Email any selection of users through the web interface. e.g. email all users that are set to expire within 1 week a special offer to extend their membership
· Disable users without deleting them
· Access the current logged in user at any time for personalization / customization of the site
· Email functionality: Send email to any selected users using full search criteria.
· Script level add user functionality for automated addition of users and integration with payment / signup services.
· User Password reminder: Users can request a password reminder by entering their userid. If they have a valid email address on record their password will be mailed to them.
· User Change Password: Users can change their own password through a web interface by providing their username, old password, new password, and new password confirmation.
· Global filter support

iisPROTECTquota includes all iisPROTECT features plus:

· Limit concurrent access tracks duplicate logins using the same userid. This feature can block subsequent requests, log, or even automatically disable the account should abuse be obvious. Concurrent access has multiple thresholds for actions and the user can receive a custom html error or be redirected to a specific page if concurrent access is detected.
· Limit kilobytes per user tracks the total file size of requests for a given user and will prevent further access to the site if the size exceeds your setting for a given period of time. This feature can prevent content scrapers from downloading your entire site for distribution or offline browsing.
· Limit hits per user functions in the same way as limit kilobytes except the data being tracked and limited on is each hit or request for a web page / file or image.
· Limit sequential logins prevents an user from logging in more than the quota you set per period of time.
· Prevent password cracking tracks failed login attempts by a given system. If the number exceeds the quota then the users IP will be banned and they will no longer have access to the username and password prompt. This is especially useful in preventing dictionary attacks where an automated program is used to send 1000's of login attempts to try and guess common passwords.

iisPROTECTvideo is an add-on product for iisPROTECT or iisPROTECTquota that offers password protection for video files streamed through Windows Media Services.

· Integrates seamlessly with iisPROTECT and iisPROTECTquota to offer simultaneous protection of all web content in addition to streaming audio and video files
· Supports high end SQL server (optional) databases at no additional charge
· No limit to the number of users or groups configured for audio and video protection
· Easily set video realm through the web interface
· Industry first support for multiple independent video protection administrators with unicast publishing point aliases or physical directories
· Prevents other clients from protecting other peoples directories. Allows identical directory, file and usernames with no conflict and correct function.
· Ideal for ISP's and large organizations
· Allows different companies on a shared server to each have their own unique protected videos with their own administration with no naming or protection conflicts.
· Within one company different groups can control and maintain their own video and audio protected areas and authentication
· iisPROTECTvideo is an extremely affordable solution for high end windows media server protection. Windows 2000 or NT 4 with Windows Media Server (free from microsoft) is all that is required. No additional MS software or special licenses are required.
· Supports existing user bases and databases via high end OLEDB connections
· Protecting media files is as simple as protecting web files, create an access restriction with the name of the media file, or an entire directory of media files. Supports protecting a specific directory or directories with inheritance with all subdirectories and files.

iisPROTECTcc is an add-on product for iisPROTECT or iisPROTECTquota that offers real-time payment processing and recurring billing with 20 different gateways.

· Process single billings and individual 1 time charges through a simple to use web interface
· Process recurring billings with point and click ease with automatic expiry date updates
· Supports all major credit card processors, 20 in total, including: Cybercash, Authorize.net, SkipJack, LinkPoint API, Itransact, PayReady, PayflowLink,
· PayflowPro, Intellipay, Ecommerce Exchange, iBill, eProcessing, PlanetPayment, NetBilling, ioNgate, Mcps, PSiGate, Go Real-time, Paycom, and ePoch Systems.
· Clients remain within your web site at all times, even during the real-time transaction, and are not required to redirect to another site
· Configure recurring billing settings on a per user basis with point and click ease
· Easily navigate through a list of users configured with recurring billing and drill down on any given user to modify settings. Display paged results and limit return by any letter of the alphabet
· Search on any or all of the entries for a specific recurring billing configuration, view the total number of payments made, next payment due, total amount paid, and more.
· Configure processor specific settings in seconds to switch payment processors without recoding your application. If a company goes under or has an unfavorable rate change you have 20 choices to keep you processing with the best rates and services.
· Powerful script level methods allow your custom signup form to charge an user at the time of signup and, if the charge is successful, add the user with a set expiry date
· Methods also allow a recurring billing to be automatically configured at the time the user signs up with no human intervention
· Run detailed billing reports to locate any past charges based on specific criteria including date range, charge status, credit card number, and more.
· Process batching of outstanding recurring billings with a single click.
· A complete summary of billings to run is displayed prior to processing including number of payments due, amount, next billing due date and more
· See a summary of the transaction status displayed immediately after processing
· Options to run multiple back due recurring billings as a single charge or individual charges

Learn more about iisPROTECT and play with a live demo at our web site.


Common Uses
"If you need to control access to your web site, web files, or media files for free, for charge or just for your own security then the iisPROTECT family of products are for you!"

Membership System - I want to restrict access to parts of my web site and require a valid username and password for someone to gain access: iisPROTECT is commonly used for this case. You can protect entire directories including all files and subdirectories with a single access restriction. For example if you have membership content in /members, protect this directory and grant only the "members" group access. Now create some users, each user that belongs to the members group will be able to access the members area. iisPROTECT allows you to set per user expiry dates, after which time they will no longer be able to gain access. In addition, iisPROTECT has automated signup scripts that allow users to signup and "add themselves" with no human intervention. With iisPROTECTcc you can even integrate realtime payment processing so users can signup, and if charged successfully they will have immediate access to the members area.

Intranet - I want to setup parts of our web sites for employee only information such as payroll and internal sales documents etc: This is another common use. With iisPROTECT you can create accounts for each of your employees and grant them access to different sections of your web site. In addition, since you can access the userid from script you could have dynamic pages provide specific content on a per employee basis, for example, you could create a script that would provide different data (hour sheet for example) to each specific employee based on their userid. You can even enable and autologin for users within your physical network so they will have access to protected areas of your web site without needing to login when in the office but it accessing from another system outside your network they would need to login with valid credentials.

Retail / Wholesale: For our ecommerce site we have areas that are specific to wholesale, of course we don't want regular users seeing this, can iisPROTECT help? Yes, you can protect your wholesale section and assign an username and password for each wholesale account (or have them pick their own). When someone tries to access the wholesale section they will be required to login before gaining access.

Protect Files: We have some trial download files that we want to protect in addition, there are some database files we don't want anyone to access. No problem, with iisPROTECT you can protect trial downloads and change the password for access as often as you like. Furthermore, you can protect sensitive database and document files and ensure that no one has access to them - all through a simple to use web interface. Or perhaps you wish to protect PDF or powerpoint presentations, there is no problem with iisPROTECT as it can protect any file type server through your web server.

Paid Membership Sites: I want to charge users access to my web site on a recurring basis. iisPROTECTquota with iisPROTECTcc is ideal for this case. Quota it ideally suited for paid access as it works to prevent account abuse such as password sharing (limits concurrent logins) and password cracking (dictionary attack prevention). When you are charging for content you need to ensure that users are not sharing your passwords and hackers are not able to mine your system to find a valid username and password. iisPROTECTcc enables you to charge clients in realtime and integrates seamlessly with iisPROTECTquota so you can have users added and accessing your protected content as soon as their payment is made with no human intervention. iisPROTECTcc will also handle recurring billing every day, week, month, quarter, year, or even any number of arbitrary days.

Free Access: I have a members only site but I don't charge for access. iisPROTECT is ideal for this case, perhaps you have a signup form and want users to gain access after completion. Or maybe you get to many junk submissions so you want to verify submissions, just have them default to disabled. Users still add themselves but they won't gain access until you make their account active with a simple check box.

Security: There are typically some files such as XML configuration files, and access databases that your site uses but you don't want any web visitor to access directly. iisPROTECT is idea for this case, protect individual files, directories or entire directory trees. If someone learns the path to download your senstive files they will not gain access as iisPROTECT would prompt for authentication credentials.

Company Administration: I am a manager of a large organization with many departments. I want to delegate user administration to each department head but also be able to manage departments if required. iisPROTECT with a multiple site, server or enterprise license is ideally suited for this case. You can setup seperate sites for each department which will use their own unique database and configuration settings. This means that each department has access to their own configuration system where they can manage users and access restrictions. If a new employee come on board or someone leaves the manager can address this without involving the IT department. If there is a problem, you can step in with the global administration and drill down into any given site with ease.

Shared Server Environments: Not every company owns their own dedicated server and many have a dedicated server that is configured to serve a number of different web sites for different companies, groups or organizations. iisPROTECT was specifically designed to excel at this task. Each site has its own unique administration, user database, groups and access configuration lists. In addition, all settings can be set individually on a per site basis. iisPROTECT also offers extremely flexible licensing, since you can add sites at any time using the licensing manager and not need to reinstall or even restart the server.

And that's not all: We have outlined a number of common uses here however this list is by no means exhaustive. iisPROTECT is being used anywhere that web content needs to be protected and every day new clients are finding new and existing uses for our products.


What's New
iisPROTECT Version 3.0 has been released October 2003 with the following new features and updates:

· Enhanced IIS 6.0 and Windows 2003 support (dedicated application pool per site and mixed number of sites per application pool are now supported).
· Logging of IP/Cookie has been added for concurrent access entries
· Automatic database reconnect and access reload attempts now supported on a user defined interval
· Ability to remove an user from the cache with a programmatic admin method
· Ability to reload access with a programmatic admin method
· Ability to reload settings with a programmatic admin method
· New key system with greater flexibility for routable IP selection
· Enhanced cache structure and performance tuning
· Unlimited cookie length
· Ability to set email subject and body for automated emailpass method

NOTE: iisPROTECT 3.0 requires an iisPROTECT 3.0 license key.


Installation
System Requirements provides information on the minimum requirements for running iisPROTECT.
Instructions provides information on how to install iisPROTECT


System Requirements
iisPROTECT is designed to be used in a web server environment to protect web content.

Supported Operating Systems:
· Windows 2000 Server
· Windows NT Server 4
· Windows XP Professional
· Windows 2000 Professional
· Windows Server 2003

Additional Requirements:
· Internet Information Server (IIS) 4 / 5 / 6
· MDAC 2.5 or greater (if you are not already running MDAC 2.5 or greater it is available as a free download from Microsoft's data access site. This is only required for NT4 systems as all other supported operating systems come preloaded with MDAC 2.5 or greater.)


Instructions
iisPROTECT can be deployed quickly and easily by running the iisPROTECT.exe automated installer. If you do not have this file you can obtain a free trial from our web site. In order to install iisPROTECT you must be able to execute the installer directly on your web server. For those without direct access to your server, your ISP or WPP must perform the installation on your behalf. If they have any questions or concerns please have them contact info@iisPROTECT.com.

Procedure:
· Ensure you are logged in as administrator on your server
· Double click the iisPROTECT.exe automated installer
· Follow the prompts to complete installation, this takes approximately 5 minutes.
· You will be asked to select a web site where iisPROTECT will install its site and global administration scripts along with a sample protected area. A list of all configured web site will be provided to choose from. You can add and configure additional sites for protection after the installation completes however if you plan on protecting a single web site you should select the correct site you want to protect at this point. iisPROTECT does not add or modify any files within the actual web site you select nor does it change the web sites configuration.
· Once installation is complete you will be able to access the administration, demos and documenation through the start menu under iisPROTECT.

We strongly encourage you to read the detailed user documentation before using iisPROTECT, if you are in a hurry visit the quickstart.


QuickStart
Don't miss the much more detailed site and global admin sections of the documentation.

At this point we assume you have successfully installed iisPROTECT:

· When you installed iisPROTECT you selected a web site during the install. Under this site a virtual directory is created will allows you access the iisPROTECT web based administration. In addition, a sample protected area was created to demonstrate iisPROTECT in action right away with no special configuration! That's right, iisPROTECT is fully functional after installation with no special configuration - you are up and running in less than 5 minutes!
· Now that you have seen iisPROTECT work with the sample protected directory, let's protect another directory on your web site!
· Create a directory in your web site and put a file in it or write down the name of an exisiting directory you want to protect and also note the name of a file in the directory.
· From the start menu open the iisPROTECT site administration interface.
· Go to the "access" tab and select the "add" sub tab.
· Enter the path as /directory for example if you would normally access "www.yourdomain.com/directory" use "/directory" or with "www.yourdomain.com/directory/subdir" use "/directory/subdir" (don't enter the quotes " just the directory starting with the slash)
· Select a group (click on group 1)
· Hit the "add new record button"
· Select the general tab from the top row and click the "reload access" button

Now let's visit the newly protected directory or a file in your browser: www.yourdomain.com/directory (the actual web address of your site, directory and file should be used here). You will be prompted for a login and password. Enter "admin" and "pass" to gain access!

That's it! Install, create an access restriction and your have just protected an area of your own site! Now you can add users, create more access restrictions, add groups etc! See the full site and global administration documentation for details.


User Documentation
User documentation for the site and global administration systems. If you are in a hurry, see the quickstart.


Site Administration
iisPROTECT has a unique web based site administrative offering. Unlike desktop based systems which require you to physically be at the server system to make configuration changes, iisPROTECT's distributed admin allows you to access and configure iisPROTECT through any web browser, from any location. Another major advantage comes with iisPROTECT's multiple site support, where site level administrators can change their settings without needing full and unrestricted access to the server system.

Detailed information on the functionality of the general, search, email, users, groups, access, filters, autologin, db, ipmask, quota and billing sections of the site administration.


General
The general tab provides access to general site specific settings for iisPROTECT. You can find a detailed description of the various options below.

progen

Reload Settings: Reloads settings the admin interface may have changed. Options include Settings and Access. These options tell the filter to reload specific settings for example if you just finished updating new access configurations. When you add, remove or modify and access restriction you must reload access. When you modify any settings you must reload settings.

User Session Length: In minutes. This is determined by a collection of client requests from the same address. If no further requests are received within the time period specified then the session is assumed to be over.

Form Based Cookie Login: Enabled / Disabled. Use this option if you are wanting to use cookie based login with a custom login form rather than basis authentication. See common tasks for step on changing to forms authentication.

Cookie Login Form URL: Web site address for the login form used if the previous option is enabled. This field takes a virtual path for example if your full URL to the form is http://www.domain.com/login.asp you would enter /login.asp

Unsupported cookie handling: Determines if users will be allowed to failover to basic authentication if cookies are not supported or disabled.

Logout URL: Web site address for the logout URL. This field takes a virtual path for example if your full URL to the form is http://www.domain.com/logout.asp you would enter /logout.asp. Users will be redirected to this page when they are logged out but accessing www.yourdomain.com/logout This is a special URL used for logout purposes. For basic authentication your access realm settings must be the same if you wish to use logout. Note: users would not directly access your logout page, they would access www.yourdomain.com/logout and iisPROTECT would redirect to the page you entered for this setting.

Encryption Password: This controls the password used to encrypt and decrypt cookie password details.

Account Expired Error HTML/URL: Redirect to URL or return HTML when account expired.

Account Inactive Error HTML/URL: Redirect to URL or return HTML when account inactive.

Log File Path: The full path including filename of sites log file. This will log site specific information in a text format.

Mail Server: The address of the SMTP mail server you wish iisPROTECT to use when sending email. e.g. mail.yourdomain.com

Return address: The return address and name of the account you wish iisPROTECT to send email from. e.g. you@yourdomain.com,Sales group

Application Pool: This setting is IIS6 specific and allows you to identify sites that below to a specific application pool.

Apply Filters To: This feature controls how filters will behave. By default, filters will only apply to protected areas. This means, areas where you have defined a valid access restriction. You can also configure filters to apply globally to the entire site. For the global option perhaps you want to prevent people from linking to images on your site, you could globally apply a filter and allow only your own as a valid referrer with a filter.

Case Sensitivity: This option controls which inputs should be considered case sensitive. Options include both username and password, username, password and none.

NOTE: When you have made a change to any of these settings you must reload settings from the general tab before they will take effect.


Search
The search tab enables you to locate users or selections of users based on specific criteria.

search

When you select the search tab you will be provided with a search form that is dynamically created from your database. This means that you will be able to search on any fields you have in your database, not just the fields that iisPROTECT requires. If you add a field to the database it will also appear, you can add fields to the provided iisPROTECT database and have the same benifit.

Text fields can be used with a partial match, for example, if you seach for "Da" in the username it would return both "Dave" and "Dan"

Date fields will display with 2 entries. The first is the from date and the second is the to date. If you enter both it will display records which have a date within this range. If you enter only the from date it will display only records after this date and if you enter only the to date it will display only records before this date

Yes / No fields will display with a combo box with 3 values, yes, no or both

When you run a search you can specify one or more fields to match your values for example if you want to see all users which expire after a given date are active and start with the letter H this is simple - just enter any additional criteria you wish and then perform your search.

Search results are returned in a paged listing which you can navigate through using the next and previous buttons


Email
Email provides the same interface as the search however the full results of your search are displayed in the following page (not paged). This list is the list of users your mail will be sent to.

email

You are also provided with a form to enter your email address, name, subject and message
When you hit send iisPROTECT will send the email to all users in the list that have valid email addresses set and display a list with the send results. In the following screen you see a list (in this case a single user is listed, admin) of all the users that will be sent the message.

email2

The Email server address is set in the general tab. This must be set in order for mail to be sent.


Users
When you select this tab you will be provided with a list of users. You can page through results and drill down on a given user. You are also presented with another row of tabs which allow you to drill down on alphabetical lists of users. The add tab can be used to add a new user.

users

Here the database only contains 10 users. If there were more users you would see many pages and navigation to page through the results. You will notice the all tab is selected, this means that all users are displayed (and paging provided to get to other users). Of course if you had thousands of users you don't want to go through many pages to get to Henry, so iisPROTECT provides letter tabs. Jumpt to "H" to see a paged listing of all users that start with "H."

users2

To view / edit / delete an user you can simple click on their username. We will view Henry...

user3

Here you can change the details for a given user, then update. Groups handling is unique, you will see two list boxes. From the first box select any groups you want to remove, from the second box select any groups you want to add (ctrl click to make multiple selections) when you update any selected groups in the left will be removed and the ones in the right will be added. Note: usernames and passwords are case sensitive.

To add a new user we can select the add tab.

users4
Here we see a form dynamically generated from the database. If you added a field to your database such as age, this will automatically appear in the user manager and you could submit or update the value! When adding an user you must provide at least the username and password. A list of available groups is provided and you can select one or more (using the ctrl key) groups for a given user.


Groups
Groups allow you to group users together with sets of access permissions. For example, with a guest group you can allow any user that belongs to the guest group access to areas that allow the guest group.

groups
The group tab provides a paged listing of groups, you can select a given group to edit it or select add to create a new group.

groups2
Create a new group by entering the name and description and hitting "add new record"
Note: GroupName should consist of a single word composed of letters and numbers only.


Access
Access controls which areas of your site you want to protect.

access1
The access tab provides a pages listing of all configured access restrictions. The add tab will allow you to add a new access restriction, clicking an existing restriction will allow you to edit / delete it.

access2

Path: Access restrictions are virtual path based, which is extremely easy and intuitive to use. For example, you have a web site www.yoursite.com and are viewing a page in your browser you see http://www.yoursite.com/mypage.htm. To protect this page you create an access restriction with "/mypage.htm" of if you see www.yoursite.com/images/picture.jpg you use "/images" to protect all files in the images directory or /images/picture.jpg" to protect that specific file. Note, the leading slash "/" is required however you should not include one at the end. Examples - Correct: "/directory" Incorrect: "/directory/"

Realm: This controls the message on the basic authentication popup box that asked for the username and password when using basic authentication. Typically you would set the same realm for your access restrictions because if they differ users will be prompted to login again when then request a page within a different realm. This can be left blank.

Usernames: Accepts a comma delimited list of usernames, when you hit add new record any usernames listed will be added. e.g. joe,bill,tom

Inherit: Controls if subdirectories and files will be protected below the access restriction. For example you have www.yoursite.com/admin which in turn has www.yoursite.com/admin/database. If you select yes for this option all directories sub directories and files beneath the specified path will be protected.

GroupNames: All available groups will be listed, you can select any or all groups to allow access for this specific access restriction. Hold down the ctrl key and click to select multiple values.

Error: The error message returned when authentication failed (this will only display when basic authentication is used).

access3
When you click on an exisiting access restriction you can edit or delete it. Groups handling is unique, you will see two text boxes. From the first box select any groups you want to remove, from the second box select any groups you want to add (ctrl click to make multiple selections) when you update any selected groups in the left will be removed and the ones in the right will be added. You can provide a comma delimited list of usernames, generally it is best to use groups as it is much easier to manage. To remove an user from the access restriction select it from the users list.


Filters
Overview: Filters enable you to deny access to the protected resource based on the following criteria:
· Domain: Limit access to only the users listed domains, includes wildcard support e.g. *domain.com would work allow user1.domain.com and user2.domain.com. This feature requires that IIS be configured to do reverse DNS lookups on each request, IIS has this disable by default for performance reasons.
· IP: Limit access by the clients IP address or range e.g. 24.54.32.*
· Referrer: Limit by referrer - ensure clients are coming from a feeder site or prevent content scraping and people linking to your images. See common tasks for an example!
· User Agent: Filters incoming requests based on user agent (browser). Can be used to kill spiders and content scrapers.

filter1

Filters control if a request gets to the authentication system. If a request passes the filters it will still require an username and password to gain access to a protected resource.

If the filter is not passed the the request is denied. If the optional error message / URL is set for a given filter the user will be returned the error message or redirected to the defined URL.

To save time typing large exclusionary lists there is an option as to whether the list should be denied or allowed. For example if you list 2 IP's in the IP filter this option would control if the 2 IP's would be allowed and all others denied or if the 2 IP's would be denied and all others allowed.

All filters have an error setting. If the filter condition is met and user will be shown the error if HTML / text is entered or redirected if a complete URL is provided (e.g. http://www.yourdomain.com/YourFilterError.htm). Filters can be applied to your entire site or only to protected areas, this is controlled with a general setting.


AutoLogin
Autologin allows for authentication to be skipped if specific conditions are met.

autologin

Overview: Controls automatically logging in users based on the following criteria:
· Domain: login if request is from one of the listed domains, includes wildcard support e.g. *domain.com would work allow www.domain.com and domain.com
· IP: login if request is from one of the listed IP address or range e.g. 24.54.32.*
· Referrer: Auto login if they are coming from a given referrer.
· User Agent: Login users with specific user agents (browsers).
In this case, if an request meets the auto login criteria they will immediately be granted access to the resource without having to provide an username and password.

This is much different than filters which control if the request gets to the authentication system. Here if the request meets the criteria they skip the login step. This is useful for internal networks for example. Define the IP's for your Intranet and then any request from within your network would not be authentication and any request from outside would.


DB
The database tab controls the database access and optional database mappings used by iisPROTECT.

prodb

Database Name/Path: Controls the path of the database if using MS Access or the name if using SQL server
User Name: The username used to access the database.
Pass Word: Password set for the username
Driver Name: Database access is through OLEDB, the highest performance database access technology available. Supports predefined entries for Access 97/ 2000 / XP and SQL server.
Server Name: For SQL Server

A Note Regarding Database Field Mapping: If you use the default expected database structure you do not need to set any of the database field or table values as they will use the default values. If you use the mapping for any given field you must use it for all fields even if the naming has only changed for 1 field. For example if your database contains the fieldname userlogin instead of username you would need to set the user fields to: "USERNAME=userlogin;PASSWORD=password;ACTIVE=active; GROUPNAMES=groupnames;EXPIRE=expire;" If you were using features dependent on other fields such as NTUSER or LASTLOGIN you would also need to set those values in the same string e.g. LASTLOGIN=lastlogin

Access Fields: A semicolon (;) delimited list of field name = your field name values. This can be used to map the expected fields to the existing fields in your own custom database. The required fields are: PATH, GROUPNAMES, USERNAMES and the optional fieldnames are INHERIT,REALM,ERROR.
Access table: Determines the name of the access table if your own database does not have a table named access with the expected fields.
Users Fields: Required fields are: USERNAME,PASSWORD. Optional: ACTIVE,GROUPNAMES,EXPIRE,NTUSER,NTPASSWORD,LASTLOGIN
Users Table: Determines the name of the users table if your own database does not have a table named users with the expected fields.
Groups Fields: Required field: GROUPNAME.
Groups Table: Determines the name of the groups table if your own database does not have a table named groups with the expected fields.
Last Login: Determines if the date and time of the last login are updated in the database
Retry Failed Access: Number of minutes between attempts to retry a failed access reload. This is useful if the database is not accessible when the filter first loads, it will attempt again to load the access restrictions at this interval in minutes.

NOTE: iisPROTECT uses a high performance cache structure so the second hit from an user, within an active session, will not go to the DB / data store as it will be retrieved from the cache.

Using a SQL server Database: When you installed iisPROTECT a /database subdirectory was created under the iisPROTECT directory. This contains the sample access database but it also contains a /sqlserver directory. The sqlserver directory contains scripts to create the iisPROTECT database in SQL server along with a readme.txt that provides step by step instructions for using the script to create the database on your sql server system. Once your database is created you would need to change the database settings on the DB tab as follows:
· Change the path to the access database to the name of your database, by default it is created as iisPROTECT.
· Set the username and password to valid user credentials for accessing the newly created database.
· Change the database type from Access to SQL server.
· Set the servername to your SQL servers IP address or network server name.
· Click update and then reload settings from the general tab. You may now continue to use iisPROTECT and it will use the configured SQL server database.

Using your own existing Database: As detailed in the documentation above, iisPROTECT supports field mappings which enable you to use your own database without having to migrate your user data to the provided iisPROTECT database structure. In most scenerios you will have a database with a number of tables specific to your application with one table containing your user data.
· At minimum you need a table with fields containing data for the username and password. For example, you may have a table named "members" with fields for "email" and "accesscode" amoung others.
· If you want to use groups (highly recommended) you must also add a field to your members table named GroupNames (if you wanted to support other functionality such as lastlogin or active you should add those fields to the same table).
· Under the DB tab you should now change the Users Table entry to members, and the Users Fields entry to USERNAME=userlogin;PASSWORD=password;GROUPNAMES=groupnames;
· Once you hit the update button and reload settings you will be setup to get user details from your own custom database but you are not quite finished.
· You still need to create the tables and fields for the groups and access tables in your custom database. You must ensure that you use the same field types and typically you would also use the same table and field names (if not you would need to setup a mapping entry on the DB tab as detailed above under field mappings).
· With the users table and fields mapped, and your database setup with the groups and access table you are ready to use iisPROTECT with your custom database. Update the settings if you have made any changes since your last reload and reload settings from the general tab.
· You can now create groups, assign users to those groups, and assign groups access based on a new access restriction. When you access a protected area you will be prompted to enter an username and password, enter an email address and accesscode from your database that has access and you will be authenticated!
· When you access the administration you will notice another benifit - the other fields in your database will be accessible automatically because of the dynamic database capabilities of iisPROTECT. If you had a field such as age in your members table you will see this in the users listing and when you check the search tab you will also see a field for age. If you add fields to the members table in the future the changes will automatically take effect!


IPMask
IP mask requires an iisPROTECTquota license and is specific to concurrent login tracking.

ipmask

Some client requests such as those coming from AOL will appear as numerous sessions even though they are from only one user. To account for this iisPROTECT allows you to set a list of IP's with wildcards which will be treated as one user. This allows AOL users to hit your site without concurrent access controls blocking them out.

Further explanation: HTTP is a stateless protocol. As such, there is no way to know if a given HTTP request is the users first, or last. iisPROTECT implements an user defined session time. With this we assume that groups of requests from a given IP address are 1 user. If there is no further requests for the session time then the session is closed. If the session is still open and another request comes from the same userid/password but a different IP it is assumed to be another user and the concurrent access counter is increased. The problem arises with caching and proxy systems which a single user could make requests from 10+ IP's. To prevent them from being blocked out the IP mask feature exists.

iisPROTECT also offers exact concurrent access tracking when cookie logins are used. With this system the IP Mask is not required and concurrent access is tracked by a cookie. For this reason a given request, even across multiple IP addresses is still counted as 1 user.


Quota
The quota features are available if you have an iisPROTECTquota license.

quota

Data Transfer: Controls Kilobytes per time period on a per user basis. If the KB total is exceeded in the given time then the user is redirected / returned HTML.

Hits: Controls hits per time period on a per user basis. If the hit total is exceeded in the given time then the user is redirected / returned HTML.

Login: Controls sequential logins per time period on a per user basis. If the login total is exceeded then the user is redirected / returned HTML.

Concurrent Access: If more than 1 user requests a protected resource using the same username and password then this is tracked and the counter for CA is increased. 2 thresholds are presented where actions can be taken. Further requests could be redirected or the user could be disabled - for example if the account was compromised or the details posted on the web. If concurrent access is enabled and you don't specify a redirect for CA it will just log the occurrence.

When used in conjunction with cookie login, concurrent access provides the most precise system for tracking concurrent access - via cookie. Concurrent access is also tracked via the clients unique IP if cookie login is not used or cookies are not supported.

Dictionary Attack Protection: To prevent malicious users from getting users passwords in the first place there is protection for brute force attacks on the user database. iisPROTECT tracks the failed login attempts on a per IP basis. If the number of attempts is greater than the configured maximum then the IP address is banned and no further requests will reach the system. iisPROTECTquota accomplished this IP ban by adding the client IP address to the IP filter listing. If you wish to remove an IP ban you need to open the filter / IP tab and delete the specific ban.

Error Messages: You can enter text/html and it will be returned when the condition is true. Alternatively you can enter a full URL including http:// and it will redirect to that URL. This allows large descriptive errors that fit the look and feel of your site.


Billing
The billing functionality is made available if you have an iisPROTECTcc license.

bill1

You can run a single billing (one time charge, like using a credit card terminal with the single billing tab.

bill2
When in the users listing you can jump to recurring billing to change or add a recurring billing definition for that user.

bill3
All users with a recurring billing defined will be listed on the recurring billing tab. This will look familiar (the same interface as the users tab however any users with such a definition will not be listed). To add an user to this section visit the users tab and add a recurrring billing for that user. They will then be listed here as well.

bill4
This search is billing specific, it enables you to locate users by their recurring billing details.

bill5
The settings are specific to the realtime processors supported by iisPROTECTcc. These are the account details the gatway company provided you with when you signed up for a payment processing account. Charge individually controls if multiple recurring payments are due for an exisiting customer if they should be billed as seperate charges or once for the total outstanding amount.

bill6
The billing report will return a listing of any charges that have been run based on your own criteria. You can control if you want to search on approved / declined or both.

bill7
When you visit the process billing tab you will be prompted for a date (defaulting to the current date). A listing of all charges will be provided that are due on or before that date. Here we see one listing for Henry. Pressing charge will run a charge for each entry listed and provide a summary of the success / failure. You will also be able to view the transaction details through the billing report tab at any time.


Global Administration
iisPROTECT includes a powerful web based global administration system. Unlike desktop based systems which require you to physically be at the server system to make configuration changes, iisPROTECT's distributed admin allows you to access and configure iisPROTECT through any web browser, from any location. In addition, the system allows global administrators to quickly and easily drill down into any site level administration from a single point of entry.

Detailed information on the setting, binding, sites, add/remove, and licensing sections of the global administration interface.


Settings
The global settings for iisPROTECT allow a number of configuration and reload options:

gsetting

Reload: Controls reloading of the bindings (use after a change has been made in the bindings tab), settings (use when a change has been made to these settings), sites (use when a new site has been created or one removed).

Overwrite NT account With: The NT user to use as a security context for authentications. Typically this would be left blank in which case the anonymous web use would be used. This has a major advantage over using NT users, in addition to not requiring thousands of NT accounts, if an account is comprimized it will have no credentials on the server. If specified the given account would be used.

Password of Account: The password for the account detailed above.

Log File Path: The path for the text log files created for iisPROTECT. This will include global messages such as the filter loading and any general error messages.

NT Event Logging: Enable all (NT logging globally and for sites), enable global (nt logging for global, not sites) disable all (no nt logging).

Global Admin Site: All Sites (not recommended, limit this so a malicous administrator could not gain access to global administration), Default web site (sites created will list here). Select a site for global admin, this option is important and be careful as you can lock yourself out of global admin if you select an invalid site (e.g. a site with no bindings). If you are locked out you can reset this to allow all sites by double clicking the restoreadmin.reg file from the directory where iisPROTECT is installed.


Bindings
The bindings tab allows you to configure bindings for a given iisPROTECT site. There are three types of bindings:

bind1
Hostheader bindings are used when multiple domains share the same IP address. In such a case you should add the full domain and any variations that can be used to access the site. For example www.yourdomain.com / yourdomain.com yourdomainpointer.com etc.

To add a new header enter the string in the textbox, select a web site form the sites list and hit "add new header." To delete a header select it from the headers list and hit "delete selected headers."

bind2

IP bindings are the most common and most secure option. In this case, each web site has its own unique IP address.

To add a new IP address to be bound to the site enter it in the text boxes, select a web site form the sites list and hit "add new IP." To delete an IP select it from the headers list and hit "delete selected IPs."

bind3

Video bindings are specific to iisPROTECTvideo, if you don't have windows media services installed on your system this option will not be present. You can control the realm, and add/remove binding paths. For iisPROTECTvideo if you have a directory /test within your windows media server directory you can bind /test to a specific site. This means you could support multiple unique userbases effectively breaking up a media server into seperate sites like you do with IIS by creating seperate sites. Each site for a media server would actually be a directory off the server such as mms://myserver.com/customer1 and mms://myserver.com/customer2. iisPROTECTvideo check this entry (in this case a path of customer1 or customer2 should be used and added with a given web site) for binding information.


Sites
The sites tab provides a listing of all configured site in iisPROTECT.

sites

As an administrator for the iisPROTECT system you can drill down on any configured iisPROTECT sites from the global administration. If you have a large number of sites and you delegate the site administration to different groups or companies for different sites on your sever and there is a problem you need to address you may not know the passwords etc the users have protected their site admin with. The global admin sites tab allows you to simple select the site and access the full site administration to correct any configuration problems or just access the site adminstration of many sites from one central address. Selecting any given site from this list will provide you with a fully functional site administrative interface for the site.

You can control which site can run the global administration through the settings tab.


Add/Remove
The add/remove section allows you to create new sites, for a complete step by step manual for creating a new site from scratch see the frequent questions section.

addremove

When iisPROTECT is installed you are asked to select a web site for installation. iisPROTECT installs on this site and configures it for site protection. It also loads the global administration on this site. Using the global administration you can add more sites to protect, each with their own unique administration. If you plan on protecting just one web site with iisPROTECT, you would not use this section.

Site list: A list of all configured sites for iisPROTECT. You can select entries from the list and hit "delete selected sites" to remove them. NOTE: this action can not be reversed and all iisPROTECT configuration information for the site will be lost.

New Site Name: The name of the site to be created (this name will apprear in the sites listing and is used internally by iisPROTECT, it need not be the same name as your site in IIS however often this is used to avoid confusion).

Bound IP: An IP address to be bound to the site, this is optional as you can add this later through the bindings tab.

Header: A hostheader to be bound to the site, this is optional as you can add this later through the bindings tab.


Licensing
The licensing tab provides a simple interface for enabling your licenses on configured sites.

licensing

As you create new sites under the add/remove tab, they will be listed on here in the licencing section.

Default Web Site: This is the name of the site being protected. When installing we choose to protect the web site named "Default Web Site." If you have created more than 1 site they will be listed here. If you installed to protect a different site you will see its name listed here.

Licenses Used: This line will list the total number of licensed currently in use for iisPROTECTquota, iisPROTECTvideo, and iisPROTECTcc. You can create as many sites as you have licensed for iisPROTECT. You can enable quota, video and cc for as many sites as you are licensed. You can also change licenses between sites.

Licenses: The total number of licenses you have purchased.

Available: The number of unused licenses available.

Sites Created: The total number of sites created (along with the number available in not a trial).

Server IP and Licensing details: Licensing is bound to the server IP address reported on this screen. When you purchase, your licenses you need to provide this IP address. Regardless of how many sites or types of licenses (iisPROTECT, CC, quota, video) they would all be purchased with the server IP listed. The actual web sites IP is not limited with licensing, so you are free to change your license to protect a different web site or different IP address however the main server IP can not change.


Add-Ons
Information of iisPROTECTquota, iisPROTECTvideo and iisPROTECTcc.


iisPROTECTquota
iisPROTECTquota is ofter referred to as an add-on but it is more similar to a bundle as it includes all the features of iisPROTECT and also offers advanced features designed to prevent account abuse. For usage and settings see the quota section of the site administration.

· Limit concurrent access tracks duplicate logins using the same userid. This feature can block subsequent requests, log, or even automatically disable the account should abuse be obvious. Concurrent access has multiple thresholds for actions and the user can receive a custom html error or be redirected to a specific page if concurrent access is detected.

· Limit kilobytes per user tracks the total file size of requests for a given user and will prevent further access to the site if the size exceeds your setting for a given period of time. This feature can prevent content scrapers from downloading your entire site for distribution or offline browsing.

· Limit hits per user functions in the same way as limit kilobytes except the data being tracked and limited on is each hit or request for a web page / file or image.

· Limit sequential logins prevents an user from logging in more than the quota you set per period of time.

· Prevent password cracking tracks failed login attempts by a given system. If the number exceeds the quota then the users IP will be banned and they will no longer have access to the username and password prompt. This is especially useful in preventing dictionary attacks where an automated program is used to send 1000's of login attempts to try and guess common passwords.


iisPROTECTvideo
iisPROTECTvideo is an add-on product that requires iisPROTECT or iisPROTECTquota. iisPROTECTvideo runs on Windows NT or Windows 2000 with Windows media services 4.x

Overview:
· iisPROTECTvideo provides integrated protection for video and audio streamed through Windows Media Server (.asf files). It works seamlessly with iisPROTECT or iisPROTECTquota to provide a complete authentication solution for all file and data types.
· If you are not running windows media server you will not have access to iisPROTECTvideo. Windows media server is a free addition to windows NT and Windows 2000 Server.

Video Binding Configuration: Global Bindings, Video Tab:
· Video Bindings: iisPROTECTvideo allows you to have multiple independent sites protected and administered by separate individuals on the same server. To accomplish this you can bind a particular video path or directory to the site that will administer it. This tells iisPROTECTvideo which files it can protect and will prevent other sites from protecting or gaining access to these files. The sample configures a binding for the main site for the "video" path.
· Adding a new video binding: Setup a directory containing video files and create a path in the media services administrator to this directory. For example, myvideos. Enter myvideos for the path name and select a site from the list and then select the "add new path" button. You can now add access restrictions for videos within this path using the site administration. For details please see the next section of the documentation, "protecting videos"
· Video Realm: This option set a realm for all video related access restrictions.
· Update: This option updates the realm settings when a change is made

Protecting Videos: Site Admin, Access Tab
· Protecting videos and audio is similar to protecting regular directory or files. You need to create an access restriction in the site administration for the file path. The following special conditions apply:
· 1-To add a new access restriction for video , start with "mms://" followed by relative path to your Unicast Publishing Point.
· 2-Realm and error are not used. You can still define a global realm in global admin->global bindings->video tab.
· When you reload access, changes and additions to your video / audio restrictions will take effect within 30 seconds.
· For example if your video server was at mms://yourserver.com/ and you wanted to protect all videos in the clients directory you would enter mms://clients and ensure that inheritance was checked.
· If you wanted to protect the test.asf video in the root of your video server you would enter mms://test.asf for the path.
· The sample created works within the video binding for the sample site. Therefore any files or directories within the video directory can be protected with relative paths. The example protected file, sample.asf, is protected with an access restriction for mms://sample.asf. You could protect a subdirectory newmedia with mms://newmedia or a file within it: mms://newmedia/sample.asf
· iisPROTECTvideo works to protect your enter video server. You can protect any specific video file, directories of videos or the entire server and select which users / groups will be given access.


iisPROTECTcc
iisPROTECTcc provides realtime and recurring billing for integrated memebership solutions. For usage see the billing section of the site administration. iisPROTECTcc is an add-on product that requires iisPROTECT or iisPROTECTquota.

· Process single billings and individual 1 time charges through a simple to use web interface
· Process recurring billings with point and click ease with automatic expiry date updates
· Supports all major credit card processors, 20 in total, including: Cybercash, Authorize.net, SkipJack, LinkPoint API, Itransact, PayReady, PayflowLink,
· PayflowPro, Intellipay, Ecommerce Exchange, iBill, eProcessing, PlanetPayment, NetBilling, ioNgate, Mcps, PSiGate, Go Real-time, Paycom, and ePoch Systems.
· Clients remain within your web site at all times, even during the real-time transaction, and are not required to redirect to another site
· Configure recurring billing settings on a per user basis with point and click ease
· Easily navigate through a list of users configured with recurring billing and drill down on any given user to modify settings. Display paged results and limit return by any letter of the alphabet
· Search on any or all of the entries for a specific recurring billing configuration, view the total number of payments made, next payment due, total amount paid, and more.
· Configure processor specific settings in seconds to switch payment processors without recoding your application. If a company goes under or has an unfavorable rate change you have 20 choices to keep you processing with the best rates and services.
· Powerful script level methods allow your custom signup form to charge an user at the time of signup and, if the charge is successful, add the user with a set expiry date
· Methods also allow a recurring billing to be automatically configured at the time the user signs up with no human intervention
· Run detailed billing reports to locate any past charges based on specific criteria including date range, charge status, credit card number, and more.
· Process batching of outstanding recurring billings with a single click.
· A complete summary of billings to run is displayed prior to processing including number of payments due, amount, next billing due date and more
· See a summary of the transaction status displayed immediately after processing
· Options to run multiple back due recurring billings as a single charge or individual charges


Common Tasks
How do I protect a specific file / entire directory / subdirectory:
· To protect an area of your site you need to add a new access restriction using the site admin page. The path determines the specific resource to be protected. To protect a specific file you would enter the path to that file. For example, if the file was data.mdb in your /database directory you would enter /database/data.mdb as the path for protection. If you wanted to protect all files in the database directory you would just enter /database as the path. If you wanted to protect all files in the database directory and all file in any subdirectories then make sure the inheritance option is selected. Note it is your web path or URL which is entered not a file path. For example, when you browse your web site at http://www.yourdomain.com/mydir/myfile.htm only mydir/myfile.htm should be entered as the path for protection, not your full web address. The leading slash "/" is required however you should not include a trailing slash at the end of your path.
· With the path entered correctly you can now select the groups that you want to have access to your resource by selecting them form the groups list. You can make multiple selections by holding down the ctrl key and clicking the first mouse button
· The realm is optional and controls the message that appears in the popup box which asks the user for their username and password
· Once you have configured a new access restriction you must reload access from the general tab of site admin for it to take effect.

How do I use a custom login form and cookie authentication:
· Enable "Form Based Cookie Login" in the general tab of site admin
· Enter the virtual path to your login form for "Cookie Login Form URL". For example, if your login page could be reached at http://www.yourdomain.com/forms/login.asp then you would enter /forms/login.asp for the cookie login form URL.
· An example login form can be found in the /sample directory (login.asp)
· login.asp stores login details in an encrypted cookie which the filter accesses
· After you have modified site specific settings you must reload settings from the general tab in the site admin in order for the changes to take effect.

How do I determine the currently logged in user for personalization:
· The current user is exposed through the IISPROTECTUSER server variable
· This information can be displayed in a web page with the following ASP script:
<% response.write(request.servervariables("HTTP_IISPROTECTUSER")) %>
· Note, since this information is exposed in a standard server variable it will also be accessible through other scripting systems such as ASP.NET or Cold Fusion.

How can I see who is online:
· iisPROTECT also provides a facility to view live users on your site at any given time. This is accessable through a special web page, liveusers.htm. You don't need to create this page, the filter dynamically generates it. This must be requested from your web root for example: http://www.yourdomain.com/liveusers.htm
· It is easy to protect this page using iisPROTECT by creating a new access restriction for /liveusers.htm if you don't want others to be able to view it
· This page will list all the users currently on the site, along with their KB, hits, logins, and concurrent access counts if you are using iisPROTECTquota

How do I protect a file and grant a specific user access but no groups:
· In this case you setup an access restriction as above for your specific file. Instead of selecting groups you can type the username and add the entry. If you wish to add multiple users then navigate to the access tab, click on your new access restriction and add any more users you wish by entering the username in the username field and hitting the update button.
· Once you have modified an access restriction you must reload access from the general tab of site admin for it to take effect.

How do I create a new separately administered site for protection:
· Load the global administration and select the Add/Remove tab
· Enter the name of the site and its IP or hostheader information for a binding to be created at the same time of your site addition. You can also manually add site bindings after site creation through the global bindings tab.
· Once the site is created and the global bindings are set reload bindings and sites through the global admin's globalsetting tab.
· You can now load the site settings through a copy of the site admin script within the site or drill down to the site using the global admins site tab
· You will now be at the site admin settings for your newly created site. You must now configure any site specific settings, most importantly the database settings from the database tab. It is also recommended that you configure a log path from the sites general tab.
· From this point you can continue to use your newly created site by adding users, access restrictions and quota settings as you would with any other site.
· If you wish another group / individual to manage the site level settings you need only copy the siteadmin.asp into their site. They will be able to edit their site settings and protect areas within their site but will not affect any other sites you have configured or their protection settings. Best of all, no special configuration is required. So long as a valid binding is in place, the site will auto detect which site it should edit.

How do I configure database settings, use an existing members database or work with SQL Server?
Please see the user documentation under the DB (database) section for a detailed explanation of these options.

How do I prevent people from linking directly to my content / images / documents from their own sites?
This is a common problem, people link to your images or content, you have additional hits and bandwidth costs, and the images display on their web pages so you get no credit or exposure. iisPROTECT solves this problem with the filter by referrer feature. In general settings enable filters to affect your whole site, now in filters add your sites domain and any variations with a wildcard entry such as "http://www.yourdomain.com*" and "http://yourdomain.com*" This will prevent people from accessing your images / files unless they are using your site directly!


Developer Documentation
Information on the sample scripts and scripting level methods. Scripts and scripts methods are ASP specific.


Sample Scripts
Scripts can be found in the install directory /web/sample and include:

AddUser.asp: Shows automated user addition through a signup form.

AddUserCC.asp: Shows automatted user addition through a signup form conditionally based on realtime credit card payment, requires iisPROTECTcc license.

ChangePass.asp: Shows basic change password functionality using a form.

EmailPass.asp: Shows basic email password functionality using a form.

login.asp: An example login form for use with cookie authentication.

logout.asp: An example logout form for use with cookie authenication.

Updateuser.asp: An update user example.

Updateusercc.asp: An update user example that uses iisPROTECTcc, when the user is charged successfully the users expiry is updated.

RemoveUserFromCache: Demonstrates programmatically removing an user from the cache.


Scripting Methods
siteadmin.asp properties which can be changed / set:
· DoNotShow: This property accepts a comma delimited list of fields. Any fields in this list will be ignored by the generic DB handling in the admin. This option is useful for autonumbers and other field types that could cause problems or that you don't want to have shown in the admin
obj.DoNotShow="fieldname1, fieldname2"
· RowCol: Affects the number of rows and columns of users, groups etc. returned in the siteadmin.
obj.RowCol ="10,5"

Login.asp cookie encryption methods:
· Encrypt: Encrypts the provided data and returns an encrypted string.
EncryptedData = obj.Encrypt( Data)
· Decrypt: Decrypts the provided data and returns the plain text string.
Data = obj.Decrypt( EncryptedData)
· SID: Generates a unique ID used when concurrent access control is configured to use cookies, if available, in place of the clients IP address for more precise concurrent access handling.
Return = obj.SID

UpdateUser.asp methods used in sample:
· ReturnDate: Returns the date of the specifed user.
ReturnDate = obj.ExpireDate(username)
· UpdateUser: Takes 1 parameter which consists of comma delimited fieldname=fieldvalue pairs. This will update the user specified. Note: The method returns 1 for sucess or error message
Message = obj.UpdateUser("username=joe, password=pass...")

Emailpass.asp:
· EmailPass: Emails the password to the specified username. This requires that the username have an email address set. EmailPass method accepts emailSubject and emailBody as optional second and third parameters (which they are optional). The actual password is appended to the end of the message body.
return values from the EmailPass method:
1 = success
2 = user does not exist
3 = Host Name is null
4 = EMail address is null
Number = obj.EmailPass( username)
Number = obj.EmailPass( username,EmailSubject)
Number = obj.EmailPass( username,EmailSubject,EmailBody)

changepass.asp method used:
· ChangePass: Takes the username, oldpassword and newpassword with confirmation and changes the password.
return values from the changepass method:
1 = success
2 = user does not exist/or old pass word is wrong
3 = Update can not be done. The update query failed.
4 = new pass does not match with NewPassConfirm
5 = one of the inputs is null.
6 = Database setting is wrong.
Number = obj.ChangePass "username", "OldPassWord", "NewPassWord", "NewPassWordConfim"

Add user:
· AddUser: Adds the user specified. You must specify the appropriate fieldnames and values you want added using comma delimited key=value pairs.
· Note: The method returns 1 or error message
Message = obj.AddUser("username=value;....")

Add user CC: (required iisPROTECTcc license)
· AddUsercc: Performs a real-time credit card transaction and if the charge is successful, adds the user. The method returns 1 or an error message.
· First parameter: You must specify the appropriate fieldnames and values you want added using comma delimited key=value pairs. In addition, there are a number of fixed key values for the cc processing that are expected including ccnumber, ccdate, fname, lname, ccemail, ccphone, ccaddress, ccCity, ccCountry, Period, DailyValue, Active, StartDate, DueDate, ccZipPostal.
· Period takes the following values: "Daily","weekly","Monthly","Quarterly", "Semi Annually". "Annually" and "Other". DailyValue can be set to a specific number of days when period is set to other.

· strInput = "UserName=Admin;Password=1234;Groupnames= G1;Expire=12/2/2; FName=Peter;LName=Box;ccNumber=41111111111111;ccEMail=peter@test.com;
· ccDate=1203;ccAmount=120;ccPhone=60412223333; ccAddress=10th; ccCity=Vancouver";ccCountry=US"
· Optional second parameter (true/false) determines if a recurring billing entry is automatically setup for the user at the same time. Default is false.
· Example usage: Message = obj.AddUser(stringinput,true)

Remove User:
· Programmatically removes an user from the cache.
· Sample usage: obj.RemoveUser("UserName")

Reload Access:
· Programmatically reloads access and returns 0 on success and 1 on failure.
· Sample usage: obj.ReloadAccess()

Reload Settings:
· Programmatically reloads settings and returns 0 on success and 1 on failure.
· Sample usage: obj.ReloadSettings()

NOTE: Remove and reload methods will work from ASP scripts only and must be called within the site binding of the site for which they will take effect.


Support
Before contacting support be sure to read the common problems and frequent questions listings!


Frequent Questions
How do I protect a specific file / entire directory / subdirectory:
· To protect an area of your site you need to add a new access restriction using the site admin page. The path determines the specific resource to be protected. To protect a specific file you would enter the path to that file. For example, if the file was data.mdb in your /database directory you would enter /database/data.mdb as the path for protection. If you wanted to protect all files in the database directory you would just enter /database as the path. If you wanted to protect all files in the database directory and all file in any subdirectories then make sure the inheritance option is selected. Note it is your web path or URL which is entered not a file path. For example, when you browse your web site at http://www.yourdomain.com/mydir/myfile.htm only /mydir/myfile.htm should be entered as the path for protection, not your full web address. The leading slash "/" is required however you should not include a trailing slash at the end of your path.
· With the path entered correctly you can now select the groups that you want to have access to your resource by selecting them form the groups list. You can make multiple selections by holding down the ctrl key and clicking the first mouse button
· The realm is optional and controls the message that appears in the popup box which asks the user for their username and password
· Once you have configured a new access restriction you must reload access from the general tab of site admin for it to take effect.

How do I use a custom login form and cookie authentication:
· Enable "Form Based Cookie Login" in the general tab of site admin
· Enter the virtual path to your login form for "Cookie Login Form URL". For example, if your login page could be reached at http://www.yourdomain.com/forms/login.asp then you would enter /forms/login.asp for the cookie login form URL.
· An example login form can be found in the /sample directory (login.asp)
· login.asp stores login details in an encrypted cookie which the filter accesses
· After you have modified site specific settings you must reload settings from the general tab in the site admin in order for the changes to take effect.

How do I determine the currently logged in user for personalization:
· The current user is exposed through the IISPROTECTUSER server variable
· This information can be displayed in a web page with the following ASP script:
<% response.write(request.servervariables("HTTP_IISPROTECTUSER")) %>
· Note, since this information is exposed in a standard server variable it will also be accessible through other scripting systems such as ASP.NET or Cold Fusion.

How can I see who is online:
· iisPROTECT also provides a facility to view live users on your site at any given time. This is accessable through a special web page, liveusers.htm. You don't need to create this page, the filter dynamically generates it. This must be requested from your web root for example: http://www.yourdomain.com/liveusers.htm
· It is easy to protect this page using iisPROTECT by creating a new access restriction for /liveusers.htm if you don't want others to be able to view it
· This page will list all the users currently on the site, along with their KB, hits, logins, and concurrent access counts if you are using iisPROTECTquota

How do I protect a file and grant a specific user access but no groups:
· In this case you setup an access restriction as above for your specific file. Instead of selecting groups you can type the username and add the entry. If you wish to add multiple users then navigate to the access tab, click on your new access restriction and add any more users you wish by entering the username in the username field and hitting the update button.
· Once you have modified an access restriction you must reload access from the general tab of site admin for it to take effect.

How do I create a new separately administered site for protection:
· Load the global administration and select the Add/Remove tab
· Enter the name of the site and its IP or hostheader information for a binding to be created at the same time of your site addition. You can also manually add site bindings after site creation through the global bindings tab.
· Once the site is created and the global bindings are set reload bindings and sites through the global admin's globalsetting tab.
· You can now load the site settings through a copy of the site admin script within the site or drill down to the site using the global admins site tab
· You will now be at the site admin settings for your newly created site. You must now configure any site specific settings, most importantly the database settings from the database tab. It is also recommended that you configure a log path from the sites general tab.
· From this point you can continue to use your newly created site by adding users, access restrictions and quota settings as you would with any other site.
· If you wish another group / individual to manage the site level settings you need only copy the siteadmin.asp into their site. They will be able to edit their site settings and protect areas within their site but will not affect any other sites you have configured or their protection settings. Best of all, no special configuration is required. So long as a valid binding is in place, the site will auto detect which site it should edit.

How do I configure database settings, use an existing members database or work with SQL Server?
Please see the user documentation under the DB (database) section for a detailed explanation of these options.

How do I prevent people from linking directly to my content / images / documents from their own sites?
This is a common problem, people link to your images or content, you have additional hits and bandwidth costs, and the images display on their web pages so you get no credit or exposure. iisPROTECT solves this problem with the filter by referrer feature. In general settings enable filters to affect your whole site, now in filters add your sites domain and any variations with a wildcard entry such as "http://www.yourdomain.com*" and "http://yourdomain.com*" This will prevent people from accessing your images / files unless they are using your site directly!


Common Problems
You can browse to the protected area and are not asked to login:
· Check the site and global log files for errors
· Make sure that the filter is loaded (in the MMC under global www properties, ISAPI filters tab)
· Make sure that a valid binding exists for the site (global admin, bindings)
· make sure a valid access restriction exists (site admin, access) **make sure the path specified is a valid virtual path, if the path does not match then it will not be protected**
· ensure that your are not being logged in by the auto-login feature
· if this is a new access configuration make sure you reloaded access from the general tab in site admin.

You can't view a protected area, even when entering a valid username and password:
· Both the username and password are CaSe SenSitiVe. Ensure that you are entering the authentication details in the same way they were entered.
· Ensure the access restriction is created correctly and grants the user or a group the user belongs to access to the protected area.
· Ensure the user is created correctly and belongs to a group allowed by access. Also check the username and password to confirm you are entering it correctly as typed.
· Check any filters or quota settings you may have setup that would deny access to the user.

Could not find sites name! You can not edit the site:
· iisPROTECT includes an automatic detection system which allows you to drop the administration into any site and it will automatically edit the correct site, and only that site. This system is based on the site bindings.
· If you have accidentally removed a valid binding or created an invalid binding you will see this error and be locked out of the site and global admin. You can reset the bindings by doubleclicking restoreadmin.reg which is installed into the directory you selected to install e.g. c:\program files\iisPROTECT
· See the global administration's bindings section for more information.

Error In global admin access:
· This message occurs when you try to access the global administration through a site that is not set to have access.
· If you access the global admin through the site you have configured you will be able to gain access. This is a security feature that allows you to limit global admin access to a specific site.
· If you changed this setting by mistake to a site without a valid binding or a site you don't have access to you can reset the settings by doubleclicking restoreadmin.reg which is installed into the directory you selected to install e.g. c:\program files\iisPROTECT
· See the global administration's settings sections for details on the global administrations site setting.

Error message indicates trial is expired or key is invalid:
· trial versions of iisPROTECT time out, this means that you have a free trial period for 15-30 days, after which point you need to purchase to continue using the product
· You can purchase at our site http://www.iisPROTECT.com under the pricing & purchase link.

Suggestions / Additions:
If you feel something requires more explanation within the documentation or have an idea for a topic to be included in the common problems and resolutions section please email info@iisprotect.com


Support Policy
· 30 days of priority email support is provided with purchase. After this point free support is still provided on an as available basis.

· Support is offered for evaluations / presales on an as available basis.

· Priority per incident support is available for purchase.

· Maintainance contracts are available for 25% of total product licensing cost and include priority email support along with all major and minor upgrades for a full year! Maintainance contracts may be purchased within 30 days of your original license purchase.


Contacting Support
Please be sure to see the Common Problems & Resolutions and Frequently Asked Questions topics in the documenation before contacting support.

You can contact support by emailing info@iisPROTECT.com

Please be sure to include the following information:
· Your orderid provided when you purchased iisPROTECT
· A detailed description of your problem
· An exact error message if applicable
· The logfiles located in the /logfile directory where you installed iisPROTECT


Licensing Information
This chapter includes information on pricing as well as the license agreement.


Pricing & Purchase
iisPROTECT is Licensed per unique administrative interface:

 | Site (single unique administrative interface) | Server (unlimited sites, each with their own unique administrative interface) | Enterprise (unlimited sites and servers for a given company at a given location)
iisPROTECT | $245 | $995 | $1995
iisPROTECTquota | $345 | $1495 | $2995
iisPROTECTcc (add-on) | $145 | $395 | $795
iisPROTECTvideo (add-on) | N/A | $995 | $1995

iisPROTECTquota includes iisPROTECT. iisPROTECTcc and iisPROTECTvideo are add-ons that require either iisPROTECT or iisPROTECTquota. Purchase through our online store at www.iisprotect.com.

iisPROTECT offers significant savings over alternative solutions. Save more than 20% on single licenses and much more for server and enterprise wide licenses. If you believe that another solution is more affordable contact us and we will be pleased to provide additional information.

Upgrades: If you have purchased iisPROTECT within 2 months of the 3.0 release you are entitled to a free upgrade. If you have purchased within 6 months of the release, you can upgrade for 50% of the regular license cost.


License Agreement
This license agreement is a legal agreement between you and Corporate Web Solutions for iisPROTECT. By using this product/key you agree to be bound by the terms of this agreement.

This software/key is protected by national and international copyright laws. This software/key is licensed, not sold.

Granted Rights: This license grants you the right to install this software/key for use on a single (1) web site / store for the domain specified when your key was purchased. In addition, you may use the product for local development purposes on a single (1) computer system. This product/key is licensed per store (also known as per domain or per site).

Limitations: You may not reverse engineer, decompile, or disassemble iisPROTECT. You may not rent or lease this software/key, you may not transfer your rights under this license agreement. A license may not be used for any domain other than that specified at the time of purchase, licenses can not be transfered to different domains. iisPROTECT is designed to be used in web sites for password protection. iisPROTECT is not a development tool and may not be used in any other application outside of a web server environment. iisPROTECT may not be integrated with or incorporated into any software product or script sold or offered to any 3rd party. A single iisPROTECT license may not be used in an ISP / Mall environment, each site must have its own unique license. Enterprise licenses are company specific and may not be provided to other companies.

Ownership: Corporate Web Solutions retains ownership of the software/key.

Liability: In no event shall Corporate Web Solutions be liable for any damages whatsoever (including, without limitation, damages for loss of business profits, business interruption, loss of information or any other pecuniary loss) arising out of the use of inability to use this software/key, even if Corporate Web Solutions has been advised of the possibility of such damages.

Termination: Without prejudice to any other rights, Corporate Web Solutions may terminate this license agreement if you fail to comply with the terms and conditions of this agreement. In such event, you must destroy all copies of iisPROTECT, any derivative work, and all of its component parts.

General: By installing this software/key you acknowledge that you have read this license agreement, understand it, and agree to be bound by its terms and conditions.


Trademark & Copyright
iisPROTECT documentation, logo, design and application is copyright 2002 Corporate Web Solutions Ltd.

All trademarks of products, services, company or organizational names, logos, phrases, service marks, service logos, and/or slogans are trademark(s) or registered trademark(s) and/or service mark(s) of the respective holder(s), where applicable.


.topic 208540

Thank you for choosing iisPROTECT, a complete Membership and authentication system. Using a high performance ISAPI filter for authentication and a powerful component for administration, iisPROTECT provides an unprecedented level of protection for your web site. iisPROTECT will protect any file within ones web site and requires no specific configuration on a per file basis. It will also protect entire directories and all files within given directories in addition to single files.

New: iisPROTECT Version 3.0 See what's new!

iisPROTECT Features:
Protect all types of files not just ASP scripts .gif .jpg .htm .zip .pdf .mdb .anything!
Users / groups / authentication Independent from NT users
Users and groups stored in a database backend with high performance access via native OLEDB.
Supports Access and SQL server for high end membership systems
No limit to the number of groups and users. Users can belong to 1 or more groups.
Does NOT require cookies, can optionally use cookies and custom login forms
Cluster and web farm ready multiple web servers running iisPROTECT can use a common database of users
Specifically designed for ISP and WPP environments with multiple independent sites on a given server. Each site has its own admin and server administrators can remotely administer iisPROTECT asp.
Supports dedicated IP and host header sites (multiple sites on a single IP address)
Auto login users based on criteria including IP, domain, useragent and referrer including wildcard support. e.g add your intranet systems so you don't need to login from the office but outside internet users must still login
Filter users based on their IP, domain, useragent and referrer and present a custom error or HTML if the filter criteria is met. e.g. redirect specific browser version to a download page, ban links from a given site etc.
Set session length on a per site basis
Tie into existing databases without migrating existing data or maintaining separate database.
log to event log / text file. Site logs are specific to each site.
Redirect or return custom errors for account expired or account inactive conditions
disable accounts through the web interface with a simple selection without deleting the user
Configure access restrictions on any specific file, an entire directory or a directory and all subdirectories and files within it
Web administration is dynamically generated from the database. If you add new fields you can add information to them without any programming or scripting
Complete web administrations allows for viewing, updating, adding, deleting users / groups / access
Easily page through user / group listings: with all entries, show only options starting with a letter of the alphabet or search for any specific criteria.
Powerful search facility works with any custom fields you may add automatically with no changes needed. The same is true for email selection criteria and data fields.
Drill down on any user / group from any listing to view or modify information
Email any selection of users through the web interface. e.g. email all users that are set to expire within 1 week a special offer to extend their membership
Disable users without deleting them
Access the current logged in user at any time for personalization / customization of the site
Email functionality: Send email to any selected users using full search criteria.
Script level add user functionality for automated addition of users and integration with payment / signup services.
User Password reminder: Users can request a password reminder by entering their userid. If they have a valid email address on record their password will be mailed to them.
User Change Password: Users can change their own password through a web interface by providing their username, old password, new password, and new password confirmation.
Global filter support

iisPROTECTquota includes all iisPROTECT features plus:

Limit concurrent access tracks duplicate logins using the same userid. This feature can block subsequent requests, log, or even automatically disable the account should abuse be obvious. Concurrent access has multiple thresholds for actions and the user can receive a custom html error or be redirected to a specific page if concurrent access is detected.
Limit kilobytes per user tracks the total file size of requests for a given user and will prevent further access to the site if the size exceeds your setting for a given period of time. This feature can prevent content scrapers from downloading your entire site for distribution or offline browsing.
Limit hits per user functions in the same way as limit kilobytes except the data being tracked and limited on is each hit or request for a web page / file or image.
Limit sequential logins prevents an user from logging in more than the quota you set per period of time.
Prevent password cracking tracks failed login attempts by a given system. If the number exceeds the quota then the users IP will be banned and they will no longer have access to the username and password prompt. This is especially useful in preventing dictionary attacks where an automated program is used to send 1000's of login attempts to try and guess common passwords.

iisPROTECTvideo is an add-on product for iisPROTECT or iisPROTECTquota that offers password protection for video files streamed through Windows Media Services.

Integrates seamlessly with iisPROTECT and iisPROTECTquota to offer simultaneous protection of all web content in addition to streaming audio and video files
Supports high end SQL server (optional) databases at no additional charge
No limit to the number of users or groups configured for audio and video protection
Easily set video realm through the web interface
Industry first support for multiple independent video protection administrators with unicast publishing point aliases or physical directories
Prevents other clients from protecting other peoples directories. Allows identical directory, file and usernames with no conflict and correct function.
Ideal for ISP's and large organizations
Allows different companies on a shared server to each have their own unique protected videos with their own administration with no naming or protection conflicts.
Within one company different groups can control and maintain their own video and audio protected areas and authentication
iisPROTECTvideo is an extremely affordable solution for high end windows media server protection. Windows 2000 or NT 4 with Windows Media Server (free from microsoft) is all that is required. No additional MS software or special licenses are required.
Supports existing user bases and databases via high end OLEDB connections
Protecting media files is as simple as protecting web files, create an access restriction with the name of the media file, or an entire directory of media files. Supports protecting a specific directory or directories with inheritance with all subdirectories and files.

iisPROTECTcc is an add-on product for iisPROTECT or iisPROTECTquota that offers real-time payment processing and recurring billing with 20 different gateways.

Process single billings and individual 1 time charges through a simple to use web interface
Process recurring billings with point and click ease with automatic expiry date updates
Supports all major credit card processors, 20 in total, including: Cybercash, Authorize.net, SkipJack, LinkPoint API, Itransact, PayReady, PayflowLink,
PayflowPro, Intellipay, Ecommerce Exchange, iBill, eProcessing, PlanetPayment, NetBilling, ioNgate, Mcps, PSiGate, Go Real-time, Paycom, and ePoch Systems.
Clients remain within your web site at all times, even during the real-time transaction, and are not required to redirect to another site
Configure recurring billing settings on a per user basis with point and click ease
Easily navigate through a list of users configured with recurring billing and drill down on any given user to modify settings. Display paged results and limit return by any letter of the alphabet
Search on any or all of the entries for a specific recurring billing configuration, view the total number of payments made, next payment due, total amount paid, and more.
Configure processor specific settings in seconds to switch payment processors without recoding your application. If a company goes under or has an unfavorable rate change you have 20 choices to keep you processing with the best rates and services.
Powerful script level methods allow your custom signup form to charge an user at the time of signup and, if the charge is successful, add the user with a set expiry date
Methods also allow a recurring billing to be automatically configured at the time the user signs up with no human intervention
Run detailed billing reports to locate any past charges based on specific criteria including date range, charge status, credit card number, and more.
Process batching of outstanding recurring billings with a single click.
A complete summary of billings to run is displayed prior to processing including number of payments due, amount, next billing due date and more
See a summary of the transaction status displayed immediately after processing
Options to run multiple back due recurring billings as a single charge or individual charges

Learn more about iisPROTECT and play with a live demo at our web site.

.topic 208790
"If you need to control access to your web site, web files, or media files for free, for charge or just for your own security then the iisPROTECT family of products are for you!"

Membership System - I want to restrict access to parts of my web site and require a valid username and password for someone to gain access: iisPROTECT is commonly used for this case.  You can protect entire directories including all files and subdirectories with a single access restriction.  For example if you have membership content in /members, protect this directory and grant only the "members" group access.  Now create some users, each user that belongs to the members group will be able to access the members area.  iisPROTECT allows you to set per user expiry dates, after which time they will no longer be able to gain access.  In addition, iisPROTECT has automated signup scripts that allow users to signup and "add themselves" with no human intervention.  With iisPROTECTcc you can even integrate realtime payment processing so users can signup, and if charged successfully they will have immediate access to the members area.

Intranet - I want to setup parts of our web sites for employee only information such as payroll and internal sales documents etc: This is another common use. With iisPROTECT you can create accounts for each of your employees and grant them access to different sections of your web site. In addition, since you can access the userid from script you could have dynamic pages provide specific content on a per employee basis, for example, you could create a script that would provide different data (hour sheet for example) to each specific employee based on their userid.  You can even enable and autologin for users within your physical network so they will have access to protected areas of your web site without needing to login when in the office but it accessing from another system outside your network they would need to login with valid credentials.

Retail / Wholesale: For our ecommerce site we have areas that are specific to wholesale, of course we don't want regular users seeing this, can iisPROTECT help? Yes, you can protect your wholesale section and assign an username and password for each wholesale account (or have them pick their own).  When someone tries to access the wholesale section they will be required to login before gaining access.

Protect Files:  We have some trial download files that we want to protect in addition, there are some database files we don't want anyone to access.  No problem, with iisPROTECT you can protect trial downloads and change the password for access as  often as you like.  Furthermore, you can protect sensitive database and document files and ensure that no one has access to them - all through a simple to use web interface.  Or perhaps you wish to protect PDF or powerpoint presentations, there is no problem with iisPROTECT as it can protect any file type server through your web server.

Paid Membership Sites:  I want to charge users access to my web site on a recurring basis.  iisPROTECTquota with iisPROTECTcc is ideal for this case.  Quota it ideally suited for paid access as it works to prevent account abuse such as password sharing (limits concurrent logins) and password cracking (dictionary attack prevention).  When you are charging for content you need to ensure that users are not sharing your passwords and hackers are not able to mine your system to find a valid username and password.  iisPROTECTcc enables you to charge clients in realtime and integrates seamlessly with iisPROTECTquota so you can have users added and accessing your protected content as soon as their payment is made with no human intervention.  iisPROTECTcc will also handle recurring billing every day, week, month, quarter, year, or even any number of arbitrary days.

Free Access: I have a members only site but I don't charge for access.  iisPROTECT is ideal for this case, perhaps you have a signup form and want users to gain access after completion.  Or maybe you get to many junk submissions so you want to verify submissions, just have them default to disabled.  Users still add themselves but they won't gain access until you make their account active with a simple check box.

Security:  There are typically some files such as XML configuration files, and access databases that your site uses but you don't want any web visitor to access directly.  iisPROTECT is idea for this case, protect individual files, directories or entire directory trees.  If someone learns the path to download your senstive files they will not gain access as iisPROTECT would prompt for authentication credentials.

Company Administration:  I am a manager of a large organization with many departments.  I want to delegate user administration to each department head but also be able to manage departments if required.  iisPROTECT with a multiple site, server or enterprise license is ideally suited for this case.  You can setup seperate sites for each department which will use their own unique database and configuration settings.  This means that each department has access to their own configuration system where they can manage users and access restrictions.  If a new employee come on board or someone leaves the manager can address this without involving the IT department.  If there is a problem, you can step in with the global administration and drill down into any given site with ease.

Shared Server Environments:  Not every company owns their own dedicated server and many have a dedicated server that is configured to serve a number of different web sites for different companies, groups or organizations.  iisPROTECT was specifically designed to excel at this task.  Each site has its own unique administration, user database, groups and access configuration lists.  In addition, all settings can be set individually on a per site basis.  iisPROTECT also offers extremely flexible licensing, since you can add sites at any time using the licensing manager and not need to reinstall or even restart the server.

And that's not all: We have outlined a number of common uses here however this list is by no means exhaustive.  iisPROTECT is being used anywhere that web content needs to be protected and every day new clients are finding new and existing uses for our products.

.topic 209090
iisPROTECT Version 3.0 has been released October 2003 with the following new features and updates:

Enhanced IIS 6.0 and Windows 2003 support (dedicated application pool per site and mixed number of sites per application pool are now supported).
Logging of IP/Cookie has been added for concurrent access entries
Automatic database reconnect and access reload attempts now supported on a user defined interval
Ability to remove an user from the cache with a programmatic admin method
Ability to reload access with a programmatic admin method
Ability to reload settings with a programmatic admin method
New key system with greater flexibility for routable IP selection
Enhanced cache structure and performance tuning
Unlimited cookie length
Ability to set email subject and body for automated emailpass method

NOTE: iisPROTECT 3.0 requires an iisPROTECT 3.0 license key.

.topic 208550
System Requirements provides information on the minimum requirements for running iisPROTECT.
Instructions provides information on how to install iisPROTECT

.topic 208560
iisPROTECT is designed to be used in a web server environment to protect web content.

Supported Operating Systems:
Windows 2000 Server
Windows NT Server 4
Windows XP Professional
Windows 2000 Professional
Windows Server 2003

Additional Requirements:
Internet Information Server (IIS) 4 / 5 / 6
MDAC 2.5 or greater (if you are not already running MDAC 2.5 or greater it is available as a free download from Microsoft's data access site.  This is only required for NT4 systems as all other supported operating systems come preloaded with MDAC 2.5 or greater.)

.topic 208570
iisPROTECT can be deployed quickly and easily by running the iisPROTECT.exe automated installer.  If you do not have this file you can obtain a free trial from our web site.  In order to install iisPROTECT you must be able to execute the installer directly on your web server.  For those without direct access to your server, your ISP or WPP must perform the installation on your behalf.  If they have any questions or concerns please have them contact info@iisPROTECT.com.

Procedure:
Ensure you are logged in as administrator on your server
Double click the iisPROTECT.exe automated installer
Follow the prompts to complete installation, this takes approximately 5 minutes.
You will be asked to select a web site where iisPROTECT will install its site and global administration scripts along with a sample protected area.  A list of all configured web site will be provided to choose from.  You can add and configure additional sites for protection after the installation completes however if you plan on protecting a single web site you should select the correct site you want to protect at this point.  iisPROTECT does not add or modify any files within the actual web site you select nor does it change the web sites configuration.
Once installation is complete you will be able to access the administration, demos and documenation through the start menu under iisPROTECT.

We strongly encourage you to read the detailed user documentation before using iisPROTECT, if you are in a hurry visit the quickstart.

.topic 209010
Don't miss the much more detailed site and global admin sections of the documentation.

At this point we assume you have successfully installed iisPROTECT:

When you installed iisPROTECT you selected a web site during the install.  Under this site a virtual directory is created will allows you access the iisPROTECT web based administration.  In addition, a sample protected area was created to demonstrate iisPROTECT in action right away with no special configuration!  That's right, iisPROTECT is fully functional after installation with no special configuration - you are up and running in less than 5 minutes!
Now that you have seen iisPROTECT work with the sample protected directory, let's protect another directory on your web site!
Create a directory in your web site and put a file in it or write down the name of an exisiting directory you want to protect and also note the name of a file in the directory.
From the start menu open the iisPROTECT site administration interface.
Go to the "access" tab and select the "add" sub tab.
Enter the path as /directory for example if you would normally access "www.yourdomain.com/directory" use "/directory" or with "www.yourdomain.com/directory/subdir" use "/directory/subdir"  (don't enter the quotes " just the directory starting with the slash)
Select a group (click on group 1)
Hit the "add new record button"
Select the general tab from the top row and click the "reload access" button

Now let's visit the newly protected directory or a file in your browser: www.yourdomain.com/directory (the actual web address of your site, directory and file should be used here).  You will be prompted for a login and password.  Enter "admin" and "pass" to gain access!

That's it! Install, create an access restriction and your have just protected an area of your own site!  Now you can add users, create more access restrictions, add groups etc!  See the full site and global administration documentation for details.

.topic 208800
User documentation for the site and global administration systems.  If you are in a hurry, see the quickstart.

.topic 208810
iisPROTECT has a unique web based site administrative offering.  Unlike desktop based systems which require you to physically be at the server system to make configuration changes, iisPROTECT's distributed admin allows you to access and configure iisPROTECT through any web browser, from any location.  Another major advantage comes with iisPROTECT's multiple site support, where site level administrators can change their settings without needing full and unrestricted access to the server system.

Detailed information on the functionality of the general, search, email, users, groups, access, filters, autologin, db, ipmask, quota and billing sections of the site administration.

.topic 208830
The general tab provides access to general site specific settings for iisPROTECT.  You can find a detailed description of the various options below.

Reload Settings: Reloads settings the admin interface may have changed. Options include Settings and Access. These options tell the filter to reload specific settings for example if you just finished updating new access configurations. When you add, remove or modify and access restriction you must reload access. When you modify any settings you must reload settings.

User Session Length: In minutes. This is determined by a collection of client requests from the same address. If no further requests are received within the time period specified then the session is assumed to be over.

Form Based Cookie Login: Enabled / Disabled. Use this option if you are wanting to use cookie based login with a custom login form rather than basis authentication.  See common tasks for step on changing to forms authentication.

Cookie Login Form URL: Web site address for the login form used if the previous option is enabled. This field takes a virtual path for example if your full URL to the form is http://www.domain.com/login.asp you would enter /login.asp

Unsupported cookie handling: Determines if users will be allowed to failover to basic authentication if cookies are not supported or disabled.

Logout URL: Web site address for the logout URL. This field takes a virtual path for example if your full URL to the form is http://www.domain.com/logout.asp you would enter /logout.asp. Users will be redirected to this page when they are logged out but accessing www.yourdomain.com/logout This is a special URL used for logout purposes. For basic authentication your access realm settings must be the same if you wish to use logout. Note: users would not directly access your logout page, they would access www.yourdomain.com/logout and iisPROTECT would redirect to the page you entered for this setting.

Encryption Password: This controls the password used to encrypt and decrypt cookie password details.

Account Expired Error HTML/URL: Redirect to URL or return HTML when account expired.

Account Inactive Error HTML/URL: Redirect to URL or return HTML when account inactive.

Log File Path: The full path including filename of sites log file. This will log site specific information in a text format.

Mail Server: The address of the SMTP mail server you wish iisPROTECT to use when sending email. e.g. mail.yourdomain.com

Return address: The return address and name of the account you wish iisPROTECT to send email from. e.g. you@yourdomain.com,Sales group

Application Pool: This setting is IIS6 specific and allows you to identify sites that below to a specific application pool.

Apply Filters To: This feature controls how filters will behave.  By default, filters will only apply to protected areas.  This means, areas where you have defined a valid access restriction.  You can also configure filters to apply globally to the entire site.  For the global option perhaps you want to prevent people from linking to images on your site, you could globally apply a filter and allow only your own as a valid referrer with a filter.

Case Sensitivity: This option controls which inputs should be considered case sensitive. Options include both username and password, username, password and none.

NOTE: When you have made a change to any of these settings you must reload settings from the general tab before they will take effect.

.topic 208840
The search tab enables you to locate users or selections of users based on specific criteria.

When you select the search tab you will be provided with a search form that is dynamically created from your database. This means that you will be able to search on any fields you have in your database, not just the fields that iisPROTECT requires.  If you add a field to the database it will also appear, you can add fields to the provided iisPROTECT database and have the same benifit.

Text fields can be used with a partial match, for example, if you seach for "Da" in the username it would return both "Dave" and "Dan"

Date fields will display with 2 entries. The first is the from date and the second is the to date. If you enter both it will display records which have a date within this range. If you enter only the from date it will display only records after this date and if you enter only the to date it will display only records before this date

Yes / No fields will display with a combo box with 3 values, yes, no or both

When you run a search you can specify one or more fields to match your values for example if you want to see all users which expire after a given date are active and start with the letter H this is simple - just enter any additional criteria you wish and then perform your search.

Search results are returned in a paged listing which you can navigate through using the next and previous buttons

.topic 208850
Email provides the same interface as the search however the full results of your search are displayed in the following page (not paged). This list is the list of users your mail will be sent to.

You are also provided with a form to enter your email address, name, subject and message
When you hit send iisPROTECT will send the email to all users in the list that have valid email addresses set and display a list with the send results.  In the following screen you see a list (in this case a single user is listed, admin) of all the users that will be sent the message.

The Email server address is set in the general tab. This must be set in order for mail to be sent.

.topic 208860
When you select this tab you will be provided with a list of users. You can page through results and drill down on a given user. You are also presented with another row of tabs which allow you to drill down on alphabetical lists of users. The add tab can be used to add a new user.

Here the database only contains 10 users.  If there were more users you would see many pages and navigation to page through the results.  You will notice the all tab is selected, this means that all users are  displayed (and paging provided to get to other users).  Of course if you had thousands of users you don't want to go through many pages to get to Henry, so iisPROTECT provides letter tabs.  Jumpt to "H" to see a paged listing of all users that start with "H."

To view / edit / delete an user you can simple click on their username.  We will view Henry...

Here you can change the details for a given user, then update.  Groups handling is unique, you will see two list boxes.  From the first box select any groups you want to remove, from the second box select any groups you want to add (ctrl click to make multiple selections) when you update any selected groups in the left will be removed and the ones in the right will be added. Note: usernames and passwords are case sensitive.

To add a new user we can select the add tab.

Here we see a form dynamically generated from the database.  If you added a field to your database such as age, this will automatically appear in the user manager and you could submit or update the value!  When adding an user you must provide at least the username and password.  A list of available groups is provided and you can select one or more (using the ctrl key) groups for a given user.

.topic 208870
Groups allow you to group users together with sets of access permissions.  For example, with a guest group you can allow any user that belongs to the guest group access to areas that allow the guest group.

The group tab provides a paged listing of groups, you can select a given group to edit it or select add to create a new group.

Create a new group by entering the name and description and hitting "add new record"
Note: GroupName should consist of a single word composed of letters and numbers only.

.topic 208880
Access controls which areas of your site you want to protect.

The access tab provides a pages listing of all configured access restrictions.  The add tab will allow you to add a new access restriction, clicking an existing restriction will allow you to edit / delete it.

Path:  Access restrictions are virtual path based, which is extremely easy and intuitive to use.  For example, you have a web site www.yoursite.com and are viewing a page in your browser you see http://www.yoursite.com/mypage.htm.  To protect this page you create an access restriction with "/mypage.htm" of if you see www.yoursite.com/images/picture.jpg you use "/images" to protect all files in the images directory or /images/picture.jpg"   to protect that specific file.  Note, the leading slash "/" is required however you should not include one at the end.  Examples - Correct: "/directory"  Incorrect: "/directory/"

Realm: This controls the message on the basic authentication popup box that asked for the username and password when using basic authentication.  Typically you would set the same realm for your access restrictions because if they differ users will be prompted to login again when then request a page within a different realm.  This can be left blank.

Usernames: Accepts a comma delimited list of usernames, when you hit add new record any usernames listed will be added.  e.g. joe,bill,tom

Inherit: Controls if subdirectories and files will be protected below the access restriction.  For example you have www.yoursite.com/admin which in turn has www.yoursite.com/admin/database.  If you select yes for this option all directories sub directories and files beneath the specified path will be protected.

GroupNames: All available groups will be listed, you can select any or all groups to allow access for this specific access restriction.  Hold down the ctrl key and click to select multiple values.

Error: The error message returned when authentication failed (this will only display when basic authentication is used).

When you click on an exisiting access restriction you can edit or delete it.  Groups handling is unique, you will see two text boxes.  From the first box select any groups you want to remove, from the second box select any groups you want to add (ctrl click to make multiple selections) when you update any selected groups in the left will be removed and the ones in the right will be added.  You can provide a comma delimited list of usernames, generally it is best to use groups as it is much easier to manage.  To remove an user from the access restriction select it from the users list.

.topic 208890
Overview: Filters enable you to deny access to the protected resource based on the following criteria:
Domain: Limit access to only the users listed domains, includes wildcard support e.g. *domain.com would work allow user1.domain.com and user2.domain.com.  This feature requires that IIS be configured to do reverse DNS lookups on each request, IIS has this disable by default for performance reasons.
IP: Limit access by the clients IP address or range e.g. 24.54.32.*
Referrer: Limit by referrer - ensure clients are coming from a feeder site or prevent content scraping and people linking to your images.  See common tasks for an example!
User Agent: Filters incoming requests based on user agent (browser). Can be used to kill spiders and content scrapers.

Filters control if a request gets to the authentication system. If a request passes the filters it will still require an username and password to gain access to a protected resource.

If the filter is not passed the the request is denied. If the optional error message / URL is set for a given filter the user will be returned the error message or redirected to the defined URL.

To save time typing large exclusionary lists there is an option as to whether the list should be denied or allowed. For example if you list 2 IP's in the IP filter this option would control if the 2 IP's would be allowed and all others denied or if the 2 IP's would be denied and all others allowed.

All filters have an error setting. If the filter condition is met and user will be shown the error if HTML / text is entered or redirected if a complete URL is provided (e.g. http://www.yourdomain.com/YourFilterError.htm).  Filters can be applied to your entire site or only to protected areas, this is controlled with a general setting.

.topic 208900
Autologin allows for authentication to be skipped if specific conditions are met.

Overview: Controls automatically logging in users based on the following criteria:
Domain: login if request is from one of the listed domains, includes wildcard support e.g. *domain.com would work allow www.domain.com and domain.com
IP: login if request is from one of the listed IP address or range e.g. 24.54.32.*
Referrer: Auto login if they are coming from a given referrer.
User Agent: Login users with specific user agents (browsers).
In this case, if an request meets the auto login criteria they will immediately be granted access to the resource without having to provide an username and password.

This is much different than filters which control if the request gets to the authentication system. Here if the request meets the criteria they skip the login step. This is useful for internal networks for example. Define the IP's for your Intranet and then any request from within your network would not be authentication and any request from outside would.

.topic 208910
The database tab controls the database access and optional database mappings used by iisPROTECT.

Database Name/Path: Controls the path of the database if using MS Access or the name if using SQL server
User Name: The username used to access the database.
Pass Word: Password set for the username
Driver Name: Database access is through OLEDB, the highest performance database access technology available. Supports predefined entries for Access 97/ 2000 / XP and SQL server.
Server Name: For SQL Server

A Note Regarding Database Field Mapping: If you use the default expected database structure you do not need to set any of the database field or table values as they will use the default values. If you use the mapping for any given field you must use it for all fields even if the naming has only changed for 1 field. For example if your database contains the fieldname userlogin instead of username you would need to set the user fields to: "USERNAME=userlogin;PASSWORD=password;ACTIVE=active; GROUPNAMES=groupnames;EXPIRE=expire;" If you were using features dependent on other fields such as NTUSER or LASTLOGIN you would also need to set those values in the same string e.g. LASTLOGIN=lastlogin

Access Fields: A semicolon (;) delimited list of field name = your field name values. This can be used to map the expected fields to the existing fields in your own custom database. The required fields are: PATH, GROUPNAMES, USERNAMES and the optional fieldnames are INHERIT,REALM,ERROR.
Access table: Determines the name of the access table if your own database does not have a table named access with the expected fields.
Users Fields: Required fields are: USERNAME,PASSWORD. Optional: ACTIVE,GROUPNAMES,EXPIRE,NTUSER,NTPASSWORD,LASTLOGIN
Users Table: Determines the name of the users table if your own database does not have a table named users with the expected fields.
Groups Fields: Required field: GROUPNAME.
Groups Table: Determines the name of the groups table if your own database does not have a table named groups with the expected fields.
Last Login: Determines if the date and time of the last login are updated in the database
Retry Failed Access: Number of minutes between attempts to retry a failed access reload.  This is useful if the database is not accessible when the filter first loads, it will attempt again to load the access restrictions at this interval in minutes.

NOTE: iisPROTECT uses a high performance cache structure so the second hit from an user, within an active session, will not go to the DB / data store as it will be retrieved from the cache.

Using a SQL server Database:  When you installed iisPROTECT a /database subdirectory was created under the iisPROTECT directory.  This contains the sample access database but it also contains a /sqlserver directory.  The sqlserver directory contains scripts to create the iisPROTECT database in SQL server along with a readme.txt that provides step by step instructions for using the script to create the database on your sql server system.  Once your database is created you would need to change the database settings on the DB tab as follows:
Change the path to the access database to the name of your database, by default it is created as iisPROTECT.
Set the username and password to valid user credentials for accessing the newly created database.
Change the database type from Access to SQL server.
Set the servername to your SQL servers IP address or network server name.
Click update and then reload settings from the general tab.  You may now continue to use iisPROTECT and it will use the configured SQL server database.

Using your own existing Database:  As detailed in the documentation above, iisPROTECT supports field mappings which enable you to use your own database without having to migrate your user data to the provided iisPROTECT database structure.  In most scenerios you will have a database with a number of tables specific to your application with one table containing your user data.
At minimum you need a table with fields containing data for the username and password.  For example, you may have a table named "members" with fields for "email" and "accesscode" amoung others.
If you want to use groups (highly recommended) you must also add a field to your members table named GroupNames (if you wanted to support other functionality such as lastlogin or active you should add those fields to the same table).
 Under the DB tab you should now change the Users Table entry to members, and the Users Fields entry to USERNAME=userlogin;PASSWORD=password;GROUPNAMES=groupnames;
Once you hit the update button and reload settings you will be setup to get user details from your own custom database but you are not quite finished.
You still need to create the tables and fields for the groups and access tables in your custom database.  You must ensure that you use the same field types and typically you would also use the same table and field names (if not you would need to setup a mapping entry on the DB tab as detailed above under field mappings).
With the users table and fields mapped, and your database setup with the groups and access table you are ready to use iisPROTECT with your custom database.  Update the settings if you have made any changes since your last reload and reload settings from the general tab.
You can now create groups, assign users to those groups, and assign groups access based on a new access restriction.  When you access a protected area you will be prompted to enter an username and password, enter an email address and accesscode from your database that has access and you will be authenticated!
When you access the administration you will notice another benifit - the other fields in your database will be accessible automatically because of the dynamic database capabilities of iisPROTECT.  If you had a field such as age in your members table you will see this in the users listing and when you check the search tab you will also see a field  for age.  If you add fields to the members table in the future the changes will automatically take effect!

.topic 208920
IP mask requires an iisPROTECTquota license and is specific to concurrent login tracking.

Some client requests such as those coming from AOL will appear as numerous sessions even though they are from only one user. To account for this iisPROTECT allows you to set a list of IP's with wildcards which will be treated as one user. This allows AOL users to hit your site without concurrent access controls blocking them out.

Further explanation: HTTP is a stateless protocol. As such, there is no way to know if a given HTTP request is the users first, or last. iisPROTECT implements an user defined session time. With this we assume that groups of requests from a given IP address are 1 user. If there is no further requests for the session time then the session is closed. If the session is still open and another request comes from the same userid/password but a different IP it is assumed to be another user and the concurrent access counter is increased. The problem arises with caching and proxy systems which a single user could make requests from 10+ IP's. To prevent them from being blocked out the IP mask feature exists.

iisPROTECT also offers exact concurrent access tracking when cookie logins are used. With this system the IP Mask is not required and concurrent access is tracked by a cookie. For this reason a given request, even across multiple IP addresses is still counted as 1 user.

.topic 208930
The quota features are available if you have an iisPROTECTquota license.

Data Transfer: Controls Kilobytes per time period on a per user basis. If the KB total is exceeded in the given time then the user is redirected / returned HTML.

Hits: Controls hits per time period on a per user basis. If the hit total is exceeded in the given time then the user is redirected / returned HTML.

Login: Controls sequential logins per time period on a per user basis. If the login total is exceeded then the user is redirected / returned HTML.

Concurrent Access: If more than 1 user requests a protected resource using the same username and password then this is tracked and the counter for CA is increased. 2 thresholds are presented where actions can be taken. Further requests could be redirected or the user could be disabled - for example if the account was compromised or the details posted on the web. If concurrent access is enabled and you don't specify a redirect for CA it will just log the occurrence.

When used in conjunction with cookie login, concurrent access provides the most precise system for tracking concurrent access - via cookie. Concurrent access is also tracked via the clients unique IP if cookie login is not used or cookies are not supported.

Dictionary Attack Protection: To prevent malicious users from getting users passwords in the first place there is protection for brute force attacks on the user database. iisPROTECT tracks the failed login attempts on a per IP basis. If the number of attempts is greater than the configured maximum then the IP address is banned and no further requests will reach the system. iisPROTECTquota accomplished this IP ban by adding the client IP address to the IP filter listing. If you wish to remove an IP ban you need to open the filter / IP tab and delete the specific ban.

Error Messages: You can enter text/html and it will be returned when the condition is true. Alternatively you can enter a full URL including http:// and it will redirect to that URL. This allows large descriptive errors that fit the look and feel of your site.

.topic 208940
The billing functionality is made available if you have an iisPROTECTcc license.

You can run a single billing (one time charge, like using a credit card terminal with the single billing tab.

When in the users listing you can jump to recurring billing to change or add a recurring billing definition for that user.

All users with a recurring billing defined will be listed on the recurring billing tab.  This will look familiar (the same interface as the users tab however any users with such a definition will not be listed).  To add an user to this section visit the users tab and add a recurrring billing for that user.  They will then be listed here as well.

This search is billing specific, it enables you to locate users by their recurring billing details.

The settings are specific to the realtime processors supported by iisPROTECTcc.  These are the account details the gatway company provided you with when you signed up for a payment processing account.  Charge individually controls if  multiple recurring payments are due for an exisiting customer if they should be billed as seperate charges or once for the total outstanding amount.

The billing report will return a listing of any charges that have been run based on your own criteria.  You can control if you want to search on approved / declined or both.

When you visit the process billing tab you will be prompted for a date (defaulting to the current date).  A listing of all charges will be provided that are due on or before that date.  Here we see one listing for Henry.  Pressing charge will run a charge for each entry listed and provide a summary of the success / failure.  You will also be able to view the transaction details through the billing report tab at any time.

.topic 208820
iisPROTECT includes a powerful web based global administration system.  Unlike desktop based systems which require you to physically be at the server system to make configuration changes, iisPROTECT's distributed admin allows you to access and configure iisPROTECT through any web browser, from any location.  In addition, the system allows global administrators to quickly and easily drill down into any site level administration from a single point of entry.

Detailed information on the setting, binding, sites, add/remove, and licensing sections of the global administration interface.

.topic 208950
The global settings for iisPROTECT allow a number of configuration and reload options:

Reload: Controls reloading of the bindings (use after a change has been made in the bindings tab), settings (use when a change has been made to these settings), sites (use when a new site has been created or one removed).

Overwrite NT account With: The NT user to use as a security context for authentications.  Typically this would be left blank in which case the anonymous web use would be used.  This has a major advantage over using NT users, in addition to not requiring thousands of NT accounts, if an account is comprimized it will have no credentials on the server.  If specified the given account would be used.

Password of Account:  The password for the account detailed above.

Log File Path:  The path for the text log files created for iisPROTECT.  This will include global messages such as the filter loading and any general error messages.

NT Event Logging: Enable all (NT logging globally and for sites), enable global (nt logging for global, not sites) disable all (no nt logging).

Global Admin Site:  All Sites (not recommended, limit this so a malicous administrator could not gain access to global administration), Default web site (sites created will list here).  Select a site for global admin, this option is important and be careful as you can lock yourself out of global admin if you select an invalid site (e.g. a site with no bindings).  If you are locked out you can reset this to allow all sites by double clicking the restoreadmin.reg file from the directory where iisPROTECT is installed.

.topic 208960
The bindings tab allows you to configure bindings for a given iisPROTECT site.  There are three types of bindings:

Hostheader bindings are used when multiple domains share the same IP address.  In such a case you should add the full domain and any variations that can be used to access the site.  For example www.yourdomain.com / yourdomain.com yourdomainpointer.com etc.

To add a new header enter the string in the textbox, select a web site form the sites list and hit "add new header."  To delete a header select it from the headers list and hit "delete selected headers."

IP bindings are the most common and most secure option.  In this case, each web site has its own unique IP address.

To add a new IP address to be bound to the site enter it in the text boxes, select a web site form the sites list and hit "add new IP."  To delete an IP select it from the headers list and hit "delete selected IPs."

Video bindings are specific to iisPROTECTvideo, if you don't have windows media services installed on your system this option will not be present.  You can control the realm, and add/remove binding paths.  For iisPROTECTvideo if you have a directory /test within your windows media server directory you can bind /test to a specific site.  This means you could support multiple unique userbases effectively breaking up a media server into seperate sites like you do with IIS by creating seperate sites.  Each site for a media server would actually be a directory off the server such as mms://myserver.com/customer1 and mms://myserver.com/customer2.  iisPROTECTvideo check this entry (in this case a path of customer1 or customer2 should be used and added with a given web site) for binding information.

.topic 208970
The sites tab provides a listing of all configured site in iisPROTECT.

As an administrator for the iisPROTECT system you can drill down on any configured iisPROTECT sites from the global administration.  If you have a large number of sites and you delegate the site administration to different groups or companies for different sites on your sever and there is a problem you need to address you may not know the passwords etc the users have protected their site admin with.  The global admin sites tab allows you to simple select the site and access the full site administration to correct any configuration problems or just access the site adminstration of many sites from one central address.  Selecting any given site from this list will provide you with a fully functional site administrative interface for the site.

You can control which site can run the global administration through the settings tab.

.topic 208980
The add/remove section allows you to create new sites, for a complete step by step manual for creating a new site from scratch see the frequent questions section.

When iisPROTECT is installed you are asked to select a web site for installation.  iisPROTECT installs on this site and configures it for site protection.  It also loads the global administration on this site.  Using the global administration you can add more sites to protect, each with their own unique administration.  If you plan on protecting just one web site with iisPROTECT, you would not use this section.

Site list: A list of all configured sites for iisPROTECT.  You can select entries from the list and hit "delete selected sites" to remove them.  NOTE: this action can not be reversed and all iisPROTECT configuration information for the site will be lost.

New Site Name: The name of the site to be created (this name will apprear in the sites listing and is used internally by iisPROTECT, it need not be the same name as your site in IIS however often this is used to avoid confusion).

Bound IP: An IP address to be bound to the site, this is optional as you can add this later through the bindings tab.

Header: A hostheader to be bound to the site, this is optional as you can add this later through the bindings tab.

.topic 208990
The licensing tab provides a simple interface for enabling your licenses on configured sites.

As you create new sites under the add/remove tab, they will be listed on here in the licencing section.

Default Web Site: This is the name of the site being protected.  When installing we choose to protect the web site named "Default Web Site."  If you have created more than 1 site they will be listed here.  If you installed to protect a different site you will see its name listed here.

Licenses Used: This line will list the total number of licensed currently in use for iisPROTECTquota, iisPROTECTvideo, and iisPROTECTcc.  You can create as many sites as you have licensed for iisPROTECT.  You can enable quota, video and cc for as many sites as you are licensed.  You can also change licenses between sites.

Licenses: The total number of licenses you have purchased.

Available: The number of unused licenses available.

Sites Created: The total number of sites created (along with the number available in not a trial).

Server IP and Licensing details: Licensing is bound to the server IP address reported on this screen.  When you purchase, your licenses you need to provide this IP address.  Regardless of how many sites or types of licenses (iisPROTECT, CC, quota, video) they would all be purchased with the server IP listed.  The actual web sites IP is not limited with licensing, so you are free to change your license to protect a different web site or different IP address however the main server IP can not change.

.topic 209080
Information of iisPROTECTquota, iisPROTECTvideo and iisPROTECTcc.

.topic 209060
iisPROTECTquota is ofter referred to as an add-on but it is more similar to a bundle as it includes all the features of iisPROTECT and also offers advanced features designed to prevent account abuse.  For usage and settings see the quota section of the site administration.

Limit concurrent access tracks duplicate logins using the same userid. This feature can block subsequent requests, log, or even automatically disable the account should abuse be obvious. Concurrent access has multiple thresholds for actions and the user can receive a custom html error or be redirected to a specific page if concurrent access is detected.

Limit kilobytes per user tracks the total file size of requests for a given user and will prevent further access to the site if the size exceeds your setting for a given period of time. This feature can prevent content scrapers from downloading your entire site for distribution or offline browsing.

Limit hits per user functions in the same way as limit kilobytes except the data being tracked and limited on is each hit or request for a web page / file or image.

Limit sequential logins prevents an user from logging in more than the quota you set per period of time.

Prevent password cracking tracks failed login attempts by a given system. If the number exceeds the quota then the users IP will be banned and they will no longer have access to the username and password prompt. This is especially useful in preventing dictionary attacks where an automated program is used to send 1000's of login attempts to try and guess common passwords.

.topic 209050
iisPROTECTvideo is an add-on product that requires iisPROTECT or iisPROTECTquota.  iisPROTECTvideo runs on Windows NT or Windows 2000 with Windows media services 4.x

Overview:
iisPROTECTvideo provides integrated protection for video and audio streamed through Windows Media Server (.asf files). It works seamlessly with iisPROTECT or iisPROTECTquota to provide a complete authentication solution for all file and data types.
If you are not running windows media server you will not have access to iisPROTECTvideo. Windows media server is a free addition to windows NT and Windows 2000 Server.

Video Binding Configuration: Global Bindings, Video Tab:
Video Bindings: iisPROTECTvideo allows you to have multiple independent sites protected and administered by separate individuals on the same server. To accomplish this you can bind a particular video path or directory to the site that will administer it. This tells iisPROTECTvideo which files it can protect and will prevent other sites from protecting or gaining access to these files. The sample configures a binding for the main site for the "video" path.
Adding a new video binding: Setup a directory containing video files and create a path in the media services administrator to this directory. For example, myvideos. Enter myvideos for the path name and select a site from the list and then select the "add new path" button. You can now add access restrictions for videos within this path using the site administration. For details please see the next section of the documentation, "protecting videos"
Video Realm: This option set a realm for all video related access restrictions.
Update: This option updates the realm settings when a change is made

Protecting Videos: Site Admin, Access Tab
Protecting videos and audio is similar to protecting regular directory or files. You need to create an access restriction in the site administration for the file path. The following special conditions apply:
1-To add a new access restriction for video , start with "mms://" followed by relative path to your Unicast Publishing Point.
2-Realm and error are not used. You can still define a global realm in global admin->global bindings->video tab.
When you reload access, changes and additions to your video / audio restrictions will take effect within 30 seconds.
For example if your video server was at mms://yourserver.com/ and you wanted to protect all videos in the clients directory you would enter mms://clients and ensure that inheritance was checked.
If you wanted to protect the test.asf video in the root of your video server you would enter mms://test.asf for the path.
The sample created works within the video binding for the sample site. Therefore any files or directories within the video directory can be protected with relative paths. The example protected file, sample.asf, is protected with an access restriction for mms://sample.asf. You could protect a subdirectory newmedia with mms://newmedia or a file within it: mms://newmedia/sample.asf
iisPROTECTvideo works to protect your enter video server. You can protect any specific video file, directories of videos or the entire server and select which users / groups will be given access.

.topic 209070
iisPROTECTcc provides realtime and recurring billing for integrated memebership solutions.  For usage see the billing section of the site administration.  iisPROTECTcc is an add-on product that requires iisPROTECT or iisPROTECTquota.

Process single billings and individual 1 time charges through a simple to use web interface
Process recurring billings with point and click ease with automatic expiry date updates
Supports all major credit card processors, 20 in total, including: Cybercash, Authorize.net, SkipJack, LinkPoint API, Itransact, PayReady, PayflowLink,
PayflowPro, Intellipay, Ecommerce Exchange, iBill, eProcessing, PlanetPayment, NetBilling, ioNgate, Mcps, PSiGate, Go Real-time, Paycom, and ePoch Systems.
Clients remain within your web site at all times, even during the real-time transaction, and are not required to redirect to another site
Configure recurring billing settings on a per user basis with point and click ease
Easily navigate through a list of users configured with recurring billing and drill down on any given user to modify settings. Display paged results and limit return by any letter of the alphabet
Search on any or all of the entries for a specific recurring billing configuration, view the total number of payments made, next payment due, total amount paid, and more.
Configure processor specific settings in seconds to switch payment processors without recoding your application. If a company goes under or has an unfavorable rate change you have 20 choices to keep you processing with the best rates and services.
Powerful script level methods allow your custom signup form to charge an user at the time of signup and, if the charge is successful, add the user with a set expiry date
Methods also allow a recurring billing to be automatically configured at the time the user signs up with no human intervention
Run detailed billing reports to locate any past charges based on specific criteria including date range, charge status, credit card number, and more.
Process batching of outstanding recurring billings with a single click.
A complete summary of billings to run is displayed prior to processing including number of payments due, amount, next billing due date and more
See a summary of the transaction status displayed immediately after processing
Options to run multiple back due recurring billings as a single charge or individual charges

.topic 209000
How do I protect a specific file / entire directory / subdirectory:
To protect an area of your site you need to add a new access restriction using the site admin page.  The path determines the specific resource to be protected.  To protect a specific file you would enter the path to that file.  For example, if the file was data.mdb in your /database directory you would enter /database/data.mdb as the path for protection.  If you wanted to protect all files in the database directory you would just enter /database as the path.  If you wanted to protect all files in the database directory and all file in any subdirectories then make sure the inheritance option is selected.  Note it is your web path or URL which is entered not a file path.  For example, when you browse your web site at http://www.yourdomain.com/mydir/myfile.htm only mydir/myfile.htm should be entered as the path for protection, not your full web address.  The leading slash "/" is required however you should not include a trailing slash at the end of your path.
With the path entered correctly you can now select the groups that you want to have access to your resource by selecting them form the groups list.  You can make multiple selections by holding down the ctrl key and clicking the first mouse button
The realm is optional and controls the message that appears in the popup box which asks the user for their username and password
Once you have configured a new access restriction you must reload access from the general tab of site admin for it to take effect.

How do I use a custom login form and cookie authentication:
Enable "Form Based Cookie Login" in the general tab of site admin
Enter the virtual path to your login form for "Cookie Login Form URL". For example, if your login page could be reached at http://www.yourdomain.com/forms/login.asp then you would enter /forms/login.asp for the cookie login form URL.
An example login form can be found in the /sample directory (login.asp)
login.asp stores login details in an encrypted cookie which the filter accesses
After you have modified site specific settings you must reload settings from the general tab in the site admin in order for the changes to take effect.

How do I determine the currently logged in user for personalization:
The current user is exposed through the IISPROTECTUSER server variable
This information can be displayed in a web page with the following ASP script:
   <% response.write(request.servervariables("HTTP_IISPROTECTUSER")) %>
Note, since this information is exposed in a standard server variable it will also be accessible through other scripting systems such as ASP.NET or Cold Fusion.

How can I see who is online:
iisPROTECT also provides a facility to view live users on your site at any given time. This is accessable through a special web page, liveusers.htm. You don't need to create this page, the filter dynamically generates it. This must be requested from your web root for example: http://www.yourdomain.com/liveusers.htm
It is easy to protect this page using iisPROTECT by creating a new access restriction for /liveusers.htm if you don't want others to be able to view it
This page will list all the users currently on the site, along with their KB, hits, logins, and concurrent access counts if you are using iisPROTECTquota

How do I protect a file and grant a specific user access but no groups:
In this case you setup an access restriction as above for your specific file.  Instead of selecting groups you can type the username and add the entry.  If you wish to add multiple users then navigate to the access tab, click on your new access restriction and add any more users you wish by entering the username in the username field and hitting the update button.
Once you have modified an access restriction you must reload access from the general tab of site admin for it to take effect.

How do I create a new separately administered site for protection:
Load the global administration and select the Add/Remove tab
Enter the name of the site and its IP or hostheader information for a binding to be created at the same time of your site addition.  You can also manually add site bindings after site creation through the global bindings tab.
Once the site is created and the global bindings are set reload bindings and sites through the global admin's globalsetting tab.
You can now load the site settings through a copy of the site admin script within the site or drill down to the site using the global admins site tab
You will now be at the site admin settings for your newly created site.  You must now configure any site specific settings, most importantly the database settings from the database tab.  It is also recommended that you configure a log path from the sites general tab.
From this point you can continue to use your newly created site by adding users, access restrictions and quota settings as you would with any other site.
If you wish another group / individual to manage the site level settings you need only copy the siteadmin.asp into their site.  They will be able to edit their site settings and protect areas within their site but will not affect any other sites you have configured or their protection settings.  Best of all, no special configuration is required.  So long as a valid binding is in place, the site will auto detect which site it should edit.

How do I configure database settings, use an existing members database or work with SQL Server?
Please see the user documentation under the DB (database) section for a detailed explanation of these options.

How do I prevent people from linking directly to my content / images / documents from their own sites?
This is a common problem, people link to your images or content, you have additional hits and bandwidth costs, and the images display on their web pages so you get no credit or exposure.  iisPROTECT solves this problem with the filter by referrer feature.  In general settings enable filters to affect your whole site, now in filters add your sites domain and any variations with a wildcard entry such as "http://www.yourdomain.com*" and "http://yourdomain.com*"  This will prevent people from accessing your images / files unless they are using your site directly!

.topic 209020
Information on the sample scripts and scripting level methods.  Scripts and scripts methods are ASP specific.

.topic 209030
Scripts can be found in the install directory /web/sample and include:

AddUser.asp: Shows automated user addition through a signup form.

AddUserCC.asp: Shows automatted user addition through a signup form conditionally based on realtime credit card payment, requires iisPROTECTcc license.

ChangePass.asp: Shows basic change password functionality using a form.

EmailPass.asp: Shows basic email password functionality using a form.

login.asp: An example login form for use with cookie authentication.

logout.asp: An example logout form for use with cookie authenication.

Updateuser.asp: An update user example.

Updateusercc.asp: An update user example that uses iisPROTECTcc, when the user is charged successfully the users expiry is updated.

RemoveUserFromCache: Demonstrates programmatically removing an user from the cache.

.topic 209040
siteadmin.asp properties which can be changed / set:
DoNotShow: This property accepts a comma delimited list of fields. Any fields in this list will be ignored by the generic DB handling in the admin. This option is useful for autonumbers and other field types that could cause problems or that you don't want to have shown in the admin
obj.DoNotShow="fieldname1, fieldname2"
RowCol: Affects the number of rows and columns of users, groups etc. returned in the siteadmin.
obj.RowCol ="10,5"

Login.asp cookie encryption methods:
Encrypt: Encrypts the provided data and returns an encrypted string.
EncryptedData = obj.Encrypt( Data)
Decrypt: Decrypts the provided data and returns the plain text string.
Data = obj.Decrypt( EncryptedData)
SID: Generates a unique ID used when concurrent access control is configured to use cookies, if available, in place of the clients IP address for more precise concurrent access handling.
Return = obj.SID

UpdateUser.asp methods used in sample:
ReturnDate: Returns the date of the specifed user.
ReturnDate = obj.ExpireDate(username)
UpdateUser: Takes 1 parameter which consists of comma delimited fieldname=fieldvalue pairs. This will update the user specified. Note: The method returns 1 for sucess or error message
Message = obj.UpdateUser("username=joe, password=pass...")

Emailpass.asp:
EmailPass: Emails the password to the specified username. This requires that the username have an email address set.  EmailPass method accepts emailSubject and emailBody as optional second and third parameters (which they are optional). The actual password is appended to the end of the message body.
return values from the EmailPass method:
1 = success
2 = user does not exist
3 = Host Name is null
4 = EMail address is null
Number = obj.EmailPass( username)
Number = obj.EmailPass( username,EmailSubject)
Number = obj.EmailPass( username,EmailSubject,EmailBody)

changepass.asp method used:
ChangePass: Takes the username, oldpassword and newpassword with confirmation and changes the password.
return values from the changepass method:
1 = success
2 = user does not exist/or old pass word is wrong
3 = Update can not be done. The update query failed.
4 = new pass does not match with NewPassConfirm
5 = one of the inputs is null.
6 = Database setting is wrong.
Number = obj.ChangePass "username", "OldPassWord", "NewPassWord", "NewPassWordConfim"

Add user:
AddUser: Adds the user specified. You must specify the appropriate fieldnames and values you want added using comma delimited key=value pairs.
Note: The method returns 1 or error message
Message = obj.AddUser("username=value;....")

Add user CC: (required iisPROTECTcc license)
AddUsercc: Performs a real-time credit card transaction and if the charge is successful, adds the user. The method returns 1 or an error message.
First parameter: You must specify the appropriate fieldnames and values you want added using comma delimited key=value pairs. In addition, there are a number of fixed key values for the cc processing that are expected including ccnumber, ccdate, fname, lname, ccemail, ccphone, ccaddress, ccCity, ccCountry, Period, DailyValue, Active, StartDate, DueDate, ccZipPostal.
Period takes the following values: "Daily","weekly","Monthly","Quarterly", "Semi Annually". "Annually" and "Other". DailyValue can be set to a specific number of days when period is set to other.

strInput = "UserName=Admin;Password=1234;Groupnames= G1;Expire=12/2/2; FName=Peter;LName=Box;ccNumber=41111111111111;ccEMail=peter@test.com;
ccDate=1203;ccAmount=120;ccPhone=60412223333; ccAddress=10th; ccCity=Vancouver";ccCountry=US"
Optional second parameter (true/false) determines if a recurring billing entry is automatically setup for the user at the same time. Default is false.
Example usage: Message = obj.AddUser(stringinput,true)

Remove User:
Programmatically removes an user from the cache.
Sample usage: obj.RemoveUser("UserName")

Reload Access:
Programmatically reloads access and returns 0 on success and 1 on failure.
Sample usage: obj.ReloadAccess()

Reload Settings:
Programmatically reloads settings and returns 0 on success and 1 on failure.
Sample usage: obj.ReloadSettings()

NOTE: Remove and reload methods will work from ASP scripts only and must be called within the site binding of the site for which they will take effect.

.topic 208630
Before contacting support be sure to read the common problems and  frequent questions listings!

.topic 208640
How do I protect a specific file / entire directory / subdirectory:
To protect an area of your site you need to add a new access restriction using the site admin page.  The path determines the specific resource to be protected.  To protect a specific file you would enter the path to that file.  For example, if the file was data.mdb in your /database directory you would enter /database/data.mdb as the path for protection.  If you wanted to protect all files in the database directory you would just enter /database as the path.  If you wanted to protect all files in the database directory and all file in any subdirectories then make sure the inheritance option is selected.  Note it is your web path or URL which is entered not a file path.  For example, when you browse your web site at http://www.yourdomain.com/mydir/myfile.htm only /mydir/myfile.htm should be entered as the path for protection, not your full web address.  The leading slash "/" is required however you should not include a trailing slash at the end of your path.
With the path entered correctly you can now select the groups that you want to have access to your resource by selecting them form the groups list.  You can make multiple selections by holding down the ctrl key and clicking the first mouse button
The realm is optional and controls the message that appears in the popup box which asks the user for their username and password
Once you have configured a new access restriction you must reload access from the general tab of site admin for it to take effect.

How do I use a custom login form and cookie authentication:
Enable "Form Based Cookie Login" in the general tab of site admin
Enter the virtual path to your login form for "Cookie Login Form URL". For example, if your login page could be reached at http://www.yourdomain.com/forms/login.asp then you would enter /forms/login.asp for the cookie login form URL.
An example login form can be found in the /sample directory (login.asp)
login.asp stores login details in an encrypted cookie which the filter accesses
After you have modified site specific settings you must reload settings from the general tab in the site admin in order for the changes to take effect.

How do I determine the currently logged in user for personalization:
The current user is exposed through the IISPROTECTUSER server variable
This information can be displayed in a web page with the following ASP script:
   <% response.write(request.servervariables("HTTP_IISPROTECTUSER")) %>
Note, since this information is exposed in a standard server variable it will also be accessible through other scripting systems such as ASP.NET or Cold Fusion.

How can I see who is online:
iisPROTECT also provides a facility to view live users on your site at any given time. This is accessable through a special web page, liveusers.htm. You don't need to create this page, the filter dynamically generates it. This must be requested from your web root for example: http://www.yourdomain.com/liveusers.htm
It is easy to protect this page using iisPROTECT by creating a new access restriction for /liveusers.htm if you don't want others to be able to view it
This page will list all the users currently on the site, along with their KB, hits, logins, and concurrent access counts if you are using iisPROTECTquota

How do I protect a file and grant a specific user access but no groups:
In this case you setup an access restriction as above for your specific file.  Instead of selecting groups you can type the username and add the entry.  If you wish to add multiple users then navigate to the access tab, click on your new access restriction and add any more users you wish by entering the username in the username field and hitting the update button.
Once you have modified an access restriction you must reload access from the general tab of site admin for it to take effect.

How do I create a new separately administered site for protection:
Load the global administration and select the Add/Remove tab
Enter the name of the site and its IP or hostheader information for a binding to be created at the same time of your site addition.  You can also manually add site bindings after site creation through the global bindings tab.
Once the site is created and the global bindings are set reload bindings and sites through the global admin's globalsetting tab.
You can now load the site settings through a copy of the site admin script within the site or drill down to the site using the global admins site tab
You will now be at the site admin settings for your newly created site.  You must now configure any site specific settings, most importantly the database settings from the database tab.  It is also recommended that you configure a log path from the sites general tab.
From this point you can continue to use your newly created site by adding users, access restrictions and quota settings as you would with any other site.
If you wish another group / individual to manage the site level settings you need only copy the siteadmin.asp into their site.  They will be able to edit their site settings and protect areas within their site but will not affect any other sites you have configured or their protection settings.  Best of all, no special configuration is required.  So long as a valid binding is in place, the site will auto detect which site it should edit.

How do I configure database settings, use an existing members database or work with SQL Server?
Please see the user documentation under the DB (database) section for a detailed explanation of these options.

How do I prevent people from linking directly to my content / images / documents from their own sites?
This is a common problem, people link to your images or content, you have additional hits and bandwidth costs, and the images display on their web pages so you get no credit or exposure.  iisPROTECT solves this problem with the filter by referrer feature.  In general settings enable filters to affect your whole site, now in filters add your sites domain and any variations with a wildcard entry such as "http://www.yourdomain.com*" and "http://yourdomain.com*"  This will prevent people from accessing your images / files unless they are using your site directly!

.topic 208780
You can browse to the protected area and are not asked to login:
Check the site and global log files for errors
Make sure that the filter is loaded (in the MMC under global www properties, ISAPI filters tab)
Make sure that a valid binding exists for the site (global admin, bindings)
make sure a valid access restriction exists (site admin, access) **make sure the path specified is a valid virtual path, if the path does not match then it will not be protected**
ensure that your are not being logged in by the auto-login feature
if this is a new access configuration make sure you reloaded access from the general tab in site admin.

You can't view a protected area, even when entering a valid username and password:
Both the username and password are CaSe SenSitiVe.  Ensure that you are entering the authentication details in the same way they were entered.
Ensure the access restriction is created correctly and grants the user or a group the user belongs to access to the protected area.
Ensure the user is created correctly and belongs to a group allowed by access.  Also check the username and password to confirm you are entering it correctly as typed.
Check any filters or quota settings you may have setup that would deny access to the user.

Could not find sites name! You can not edit the site:
iisPROTECT includes an automatic detection system which allows you to drop the administration into any site and it will automatically edit the correct site, and only that site.  This system is based on the site bindings.
If you have accidentally removed a valid binding or created an invalid binding you will see this error and be locked out of the site and global admin.  You can reset the bindings by doubleclicking restoreadmin.reg which is installed into the directory you selected to install e.g. c:\program files\iisPROTECT
See the global administration's bindings section for more information.

Error In global admin access:
This message occurs when you try to access the global administration through a site that is not set to have access.
If you access the global admin through the site you have configured you will be able to gain access.  This is a security feature that allows you to limit global admin access to a specific site.
 If you changed this setting by mistake to a site without a valid binding or a site you don't have access to you can reset the settings by doubleclicking restoreadmin.reg which is installed into the directory you selected to install e.g. c:\program files\iisPROTECT
See the global administration's settings sections for details on the global administrations site setting.

Error message indicates trial is expired or key is invalid:
trial versions of iisPROTECT time out, this means that you have a free trial period for 15-30 days, after which point you need to purchase to continue using the product
You can purchase at our site http://www.iisPROTECT.com under the pricing & purchase link.

Suggestions / Additions:
If you feel something requires more explanation within the documentation or have an idea for a topic to be included in the common problems and resolutions section please email info@iisprotect.com

.topic 208650
30 days of priority email support is provided with purchase.  After this point free support is still provided on an as available basis.

Support is offered for evaluations / presales on an as available basis.

Priority per incident support is available for purchase.

Maintainance contracts are available for 25% of total product licensing cost and include priority email support along with all major and minor upgrades for a full year!  Maintainance contracts may be purchased within 30 days of your original license purchase.

.topic 208660
Please be sure to see the Common Problems & Resolutions and Frequently Asked Questions topics in the documenation before contacting support.

You can contact support by emailing info@iisPROTECT.com

Please be sure to include the following information:
Your orderid provided when you purchased iisPROTECT
A detailed description of your problem
An exact error message if applicable
The logfiles located in the /logfile directory where you installed iisPROTECT

.topic 208670
This chapter includes information on pricing as well as the license agreement.

.topic 208700
iisPROTECT is Licensed per unique administrative interface:

iisPROTECTquota includes iisPROTECT.  iisPROTECTcc and iisPROTECTvideo are add-ons that require either iisPROTECT or iisPROTECTquota.  Purchase through our online store at www.iisprotect.com.

iisPROTECT offers significant savings over alternative solutions. Save more than 20% on single licenses and much more for server and enterprise wide licenses. If you believe that another solution is more affordable contact us and we will be pleased to provide additional information.

Upgrades:  If you have purchased iisPROTECT within 2 months of the 3.0 release you are entitled to a free upgrade.  If you have purchased within 6 months of the release, you can upgrade for 50% of the regular license cost.

.topic 208680
This license agreement is a legal agreement between you and Corporate Web Solutions for iisPROTECT. By using this product/key you agree to be bound by the terms of this agreement.

This software/key is protected by national and international copyright laws. This software/key is licensed, not sold.

Granted Rights: This license grants you the right to install this software/key for use on a single (1) web site / store for the domain specified when your key was purchased.  In addition, you may use the product for local development purposes on a single (1) computer system.  This product/key is licensed per store (also known as per domain or per site).

Limitations: You may not reverse engineer, decompile, or disassemble iisPROTECT.  You may not rent or lease this software/key, you may not transfer your rights under this license agreement.  A license may not be used for any domain other than that specified at the time of purchase, licenses can not be transfered to different domains.  iisPROTECT is designed to be used in web sites for password protection.  iisPROTECT is not a development tool and may not be used in any other application outside of a web server environment.  iisPROTECT may not be integrated with or incorporated into any software product or script sold or offered to any 3rd party.  A single iisPROTECT license may not be used in an ISP / Mall environment, each site must have its own unique license.  Enterprise licenses are company specific and may not be provided to other companies.

Ownership: Corporate Web Solutions retains ownership of the software/key.

Liability: In no event shall Corporate Web Solutions be liable for any damages whatsoever (including, without limitation, damages for loss of business profits, business interruption, loss of information or any other pecuniary loss) arising out of the use of inability to use this software/key, even if Corporate Web Solutions has been advised of the possibility of such damages.

Termination: Without prejudice to any other rights, Corporate Web Solutions may terminate this license agreement if you fail to comply with the terms and conditions of this agreement. In such event, you must destroy all copies of iisPROTECT, any derivative work, and all of its component parts.

General: By installing this software/key you acknowledge that you have read this license agreement, understand it, and agree to be bound by its terms and conditions.

.topic 208730
iisPROTECT documentation, logo, design and application is copyright 2002 Corporate Web Solutions Ltd.

All trademarks of products, services, company or organizational names, logos, phrases, service marks, service logos, and/or slogans are trademark(s) or registered trademark(s) and/or service mark(s) of the respective holder(s), where applicable.