New Topic

Welcome to the ASPSecured Help File

This help file will explain how ASPSecured works. You will learn how to use ASPSecured and also how to integrate this into other applications.

Support
If you have any trouble, at any time, please contact us at support@asp-programmers.com . We pride ourselves in making sure that you can get ASPSecured to work on your server.

Customizations
If you are not the most experienced developer and would like for us to customize ASPSecured or perform your integration just let us know. We have a full programming staff that can be yours. Contact us at sales@asp-programmers.com for more details.

Upgrades
At any time you can also upgrade your current version to the next level. Please visit us online for more information. http://www.asp-programmers.com

Visit us at asp-programmers.com for latest ASPSecured updates.


Setup ASPSecured

ASPSecured User Guide

Welcome the the ASPSecured User's Guide, a manual on security management, and protecting pages on your website.

ASPSecured is very simple to install and manage. If you need any help, we are always available at support@asp-programmers.com


Installation

In order to successfully install ASPSecured you will need to make sure that you have downloaded the latest version. The installation of ASPSecured is relatively simple. We know that many of you are newbies and also experienced developers looking for a quick out of the box solution.

You only have to configure two items.

1) The conn.inc file, which you will find in the zip file. Click here for instructions on how to setup the conn.inc file. After you have this set, browse to your site and the secureadmin.asp file in your Internet Explorer Browser.

2) Once you have the secureadmin.asp running, you will see some basic settings in the settings tab. Here is a list of the settings and what they do.

a) Site Name - you can specify any site name you would like. This will appear on the top whenever you are logged into the administration

b) Denied Page - this is the page users will be redirected to when they cannot login successfully or they do not have access to a page

c) Inactive Page - this is the page users will see when their account is not active

d) Expired Page - as the above pages, you will see this when a users account is expired

e) Mail Component - we have added many of the popular components.

f) E-mail From Address - this is the address that your e-mail will come from. This is especially true for the mass e-mails that go out.

g) Mail Server Address - this is the location of your mail server. If you are using the CDONTS mail component, which is the default component on NT when smtp is enabled, you do not have to specify the mail server address.

h) Field Settings - Why be restricted to only a few questions on the signup sheet and on user accounts. Here we have 5 fields. You can choose whatever you would like to have.

i) License Key - this is the key that is provided to you in order for ASPSecured to know what features are available for you.

j) Name - this is the name that is provided to you with the License Key information. Please make sure you enter in your name exactly how it was sent to you in the confirmation e-mail.

3) To test the installation and make sure that your installation is correct please go to http://www.yoursite.com/directory/secureadmin.asp

Once this is completed, you will need to ftp or upload these files to a directory on your site. We recommend using a folder other than the root folder. For example; http://www.yoursite.com/usersadmin

Please visit http://www.asp-programmers.com for the most recent version.


Database Settings

There really is not much you have to do in order to configure the ASPSecured database. Most people will have trouble setting the permissions on the server. This is usually the problem that will give the error message "Database Read Only"

What you need to do is place the database, aspsecured.mdb, in a folder on your site that has read/write/modify permissions. Most virtual hosting companies will provide you with a cgi-bin. You may use this directory.

If you do not have a pre-assigned directory from your hosting company then what you want to do is ask your hosting company or server administrator to:

Give the IUSR_SERVERNAME account modify permissions to the folder and its contents.

On NT4 this is change permissions and on NT 5 you can just click on the checkbox for modify.

You also want to set the directory to not allow browsing.

If you are using Microsoft FrontPage you can just right click on the folder and set this option. If you do not use FrontPage then please ask your hosting company or server administrator to set this for you.

You will need to set the conn.inc file. Click here for for instructions.


Connection String

Connection String Settings (conn.inc)

The config.inc file is where you will set the connection to your database. This should be simple. Before you test your administration page please make sure that you have set the proper permissions to the database. Click here for instructions.

What you want to do when you set this is make sure that you are setting the connection string from the directory where you have all of your files stored.

Here is the connection string:

Session("ASPsecureme")="Driver={Microsoft Access Driver (*.mdb)};DBQ=" & Server.MapPath("../cgi-bin/secureme.mdb") & ";"

The above connection string is set like this because off the root folder of the site, the files for aspsecured are all in a sub folder named security.
/

/security/

/cgi-bin/aspsecure.mdb

As you can see, if you are in the security folder you need to first get back to the root folder and then get into the cgi-bin.

If all if your aspsecured scripts were in the root folder of your site, and your database was in the cgi-bin, you would then set your connection string to:

Session("ASPsecureme")="Driver={Microsoft Access Driver (*.mdb)};DBQ=" & Server.MapPath("cgi-bin/secureme.mdb") & ";"

You would only have to specify the folder name because you are already in the root folder of the site and you have to access only one folder.

If you still have trouble getting your connection string configured correctly, please contact us at support@asp-programmers.com


Settings Menu

Settings Menu Overview
This is the section where you will define where some of your aspsecured pages are stored, mail server settings, e-mail subjects, signup page and forgot your password settings.

General Settings

Here is a list of the general settings and what they do:

  • Site Name: This is the name of your site. This will appear in the administration and will also appear in the subject of signup and forgot your password e-mails.
  • Denied Page: This is the page users will be taken to, after login, when they do not have access a particular page.
  • Inactive Page: This is the page users will be taken to, after login, when their account is not active.
  • Expired Page: This is the page users will be taken to, after login, when their account is expired.

Mail Settings

Here is a list of the general settings and what they do:

  • Mail Component: This is the type of component that your server uses. If you do not have a component and your server does have SMTP installed, then you most likely have the default component for NT installed, CDONTS..
  • E-mail Address From: This is the e-mail address from that will be used when mass e-mails are sent out. This is also a setting that you can use for any customization you might make.
  • Mail Server Address: Some mail component, do require that you specify the mail server. Please use this for the location of your server.

Field Name Settings
Here is a list of the general settings and what they do:

The add a new user form and also the signup form have 5 fields you can customize. These are just normal text fields. You can name them anything you would like.

License Settings
This section has two settings. The first is the name that was given to you with your license information. The second is the license key that was provided to you with your name. In order to unlock the proper features, you must enter in this information.

New User Signup Settings
The first option is whether or not you want to show the New User Signup link on the login page. If you choose yes, then on the login page will be a link for users to register to the site. First you choose the name of your site. This is what will appear in the e-mail after a user signs up to the site. Next set the message users will get in the e-mail and then set the location of the confirmation page. Lastly, set the link users will get to come back to the site after they have registered and get the e-mail.

Forgot Your Password Settings
The first option is whether or not you want to show the Forgot Your Password link on the login page. If you choose yes, then on the login page will be a link for users to have their e-mail sent to them. First you choose the name of your site. This is what will appear in the e-mail after a user looks up their password. Next, set the message users will get in the e-mail and then set the location of the confirmation page. Lastly, set the link users will get to come back to the site after they have received their password.


Page Protection

1) Page protection is probable the best feature of ASPSecured. You only have to include a few lines at the top of any ASP Page and you are all set. Here is a sample of code you can use to protect your page.

THIS IS THE CODE TO USE FOR FREEWARE, LITE, AND PRO USERS

<%@ LANGUAGE = VBScript.Encode %>
<%

session("securedbyuser") = "tom"

session("securedbygroup") = "groupa,groupb,admins"

session("pagename") = "Products and Services"
session("loginpage") = "/secured/login.asp"

%>

<!--#include virtual="/secured/secured.asp"-->

THIS IS THE CODE TO USE FOR SOURCECODE USERS. THE ONLY DIFFERENCE IS THE FIRST LINE

<%

session("securedbyuser") = "tom"

session("securedbygroup") = "groupa,groupb,admins"

session("pagename") = "Products and Services"
session("loginpage") = "/secured/login.asp"

%>

<!--#include virtual="/secured/secured.asp"-->

Explanation for all of the settings

  • The session("securedbyuser") = "tom" will secure this page to the user with the username tom. If you wanted to add more users then you would just separate the users with commas. Here is an example.

    session("securedbyuser") = "tom,harry,mike,bob,ed"
  • The session("securedbygroup") = "users,admins" will secure the page to any users that are in the users group and also the admins group. If you want just one page then you would just have one group listed. If you have a page secured to a user, and also a group, and the user does not have access to the group the user will still have access to the page.
  • The session("pagename") = "Products and Services" is the name of the page that will be stored in the database with the tracking. It's recommended that you use short page names. You can list the actual page name if you would like.
  • The session("loginpage") = "/security/login.asp" determines where the login page is located. Many times, depending on your site, you might want to have different login pages for different protected pages. So, just make as many copies of the login page you need, modify them, and you are all set.
  • The <!--#include virtual="/secured/secured.asp"--> needs to be set so that ASPSecured knows where to find the login code. Set this to your location.

If you do not want to secure a page to a set of users you would not place anything in the quotes. The same would go for the groups.

Please Note: Any user that logs into a page, whether it is protected to a user or to a group, will first have to have an account that is Active and also not Expired. If a users account has any of these statuses, they will be redirected to the proper page.


Product Name

Session Variables

ASPSecured is very easy to customize your site. It is also very easy to integrate into other ASP applications. We have a few different session variables we use. They are as follows:

  1. Display logged in user's userid on any ASP Page:
    • The variable is session("secureduserid")
    • To display the userid in a html page use <%=session("secureduserid")%>
    • When already inside ASP code, you may also use response.write session("secureduserid")
    • To use this variable in a sample SQL statement could look something like:

      SQL = "SELECT * from users where username = "&session("secureduserid")
  2. Display logged in user's username on any ASP Page:
    • The variable is session("securedusername")
    • To display the username in a html page use <%=session("securedusername")%>
    • When already inside ASP code, you may also use response.write session("securedusername")
    • To use this variable in a sample SQL statement could look something like:

      SQL = "SELECT * from users where username = '"&session("securedusername")&"'"
  3. Display the groups that the logged in user has access to:
    • The variable that stores the groups is session("securedgroups")
    • This variable will display all of the groups seperated by commas. To strip out the commas you would use code that looks like this:

      <%
      mygroups = split(session("securedgroups"),",")
      for each x in mygroups
      response.write x
      response.write "<br>"
      next
      %>
      This will display each group the user is assigned to and will display each one on its own line. You may do this different ways, this is just one of them.


HTML Administration

ASPSecured is a great component because of the simple logic that allows for site management and administration.

The following section will provide you with step by step instructions on how to use the administration and what each feature does.

ASPSecured is very simple to install and manage. If you need any help, we are always available at support@asp-programmers.com


User Menu

User Menu Overview
The user menu is the default screen that is displayed when logged into the administration. This is also where you will manage all of the user accounts in the system.

Each of the user accounts will be listed in the screen. At any time you can search for a user's account by just typing yout search query's in the search box and clicking on submit.

The users menu has sub-menu items. These sub-menu items will allow you to view just expired users, inactive users, and also to add a new user.

When you click on a users account you will have the ability to edit all of the users details.

Group permissions are set within the users account.

Adding Users
Click on the sub-menu link for add user. You will be prompted with the form to add the user. The 5 extra fields will be labeled with whatever labels are set in the settings section. When adding a user you do not have to enter in all of the fields.

If you want set the user to be active, then you would click on the active radio button. If you would like the user not to be active then you would click on the no radio box.

If you would like for the user account to expire, just enter in a date. The date format must me mm/dd/yy. Once the user has been created you will be able to add group access to the user.

Associate Group Access
Once you have the user account created, go into the users edit mode. Do this by clicking on the users name in the list iser screen. At the bottom of the users account details, you will see two boxes. The first box lists all of the available groups that the user can be assigned to. For each group you would like to assign the user to, click on the group name so it is highlighted, and then click on the small button in-between the two boxes. You will see your selections on the right side. To remove any groups from the right side, just click on it and you will be prompted to remove that group from the users details.

Deleting User Accounts
To delete a user's account, just go into the edit mode of the particular account. At the top of the screen, you will see a sub-menu item labeled, "Delete this User." Just click on that link and the account will be deleted from the system.

Inactive and Expired Screens
These screen are identical to the user list screens except that only certain user accounts will be shown. To edit any of the accounts, just click on the username.


Group Menu

Group Menu Overview
Each of the group are listed on the screen. At any time you can search for a group by just typing your search query's in the search box and clicking on submit.

The groups menu has sub-menu items. These sub-menu items will allow you to view just expired groups, inactive groups, and also add a new group.

When you click on a group you will have the ability to edit all of the groups details.

Adding Groups
Click on the sub-menu link for add group. You will be prompted with the form to add the group.

If you want set the group to be active, then you would click on the active radio button. If you would like the group not to be active then you would click on the no radio box.

If you would like for the group account to expire, just enter in a date. The date format must me mm/dd/yy. Once the group has been created you will be able to add group access to the group.

Deleting Groups
To delete a group, just go into the edit mode of the particular group. At the top of the screen, you will see a sub-menu item labeled, "Delete this Group." Just click on that link and the group will be deleted from the system.

Inactive and Expired Screens
These screen are identical to the group list screens except that only certain groups will be shown. To edit any of the accounts, just click on the group name.


Mass E-mail

Mail Email Menu

Mail Users Overview
This section will allow you to send out mass emails to users and groups that are in your database.

Send By Users
To send an e-mail to all of the users in your database choose users from the drop down box at the top of the screen.

If you would like to send out e-mail to all of the users in your database then just do not fill out the search query box. This will search all users. If you would like to search for a specific user then enter in the users username. Otherwise enter in your search terms. For example; Maybe you want to e-mail all the users in your database who's username starts with the letter "a". Just enter in "a" in the search box. The drop down box is labeled "Send E-mail By"

When sending e-mails to users, you do have the ability to send your e-mail to either all users, active users, or inactive users. After this is completed you need to complete the e-mail content section.

Send By Group
To send an e-mail to all of the users that are associate to a specific group in your database choose groups from the drop down box at the top of the screen. The drop down box is labeled "Send E-mail By"

If you would like to send out e-mail to all of the users in your database then just do not fill out the search query box. This will search all users. If you would like to search for a specific user then enter in the users username. Otherwise enter in your search terms. For example; Maybe you want to e-mail all the users in your database who's username starts with the letter "a". Just enter in "a" in the search box.

When sending e-mails to users, you do have the ability to send your e-mail to either all users in that group, active users, or inactive users. After this is completed you need to complete the e-mail content section.

E-mail Content
This is where you will specify the content of your e-mail. First enter in your subject. This will be the subject line of the e-mail when it is sent out. Second, enter your message. You can type a message or enter in html.

When you are completed, click on "Submit" to be taken to the verification screen. That's where you will be able to verify how many users the e-mail will go to and also what the message is. When you are completed, you can then click on "Submit" one last time to send the e-mail out.


Tracking Menu

Tracking Overview
This section will provide you with the ability to know when users are visiting pages on your site.

How it works
When you add protection code to your pages, there is a variables that you can add, which will track the user logging into your site, the time, the users ip address, and also the page name. Below is a sample of the code you will use to track users. For the full protection code please click here to see the settings for protecting pages.

session("pagename") = "Products and Services"

This will track the users information in the database when they login. You will see the username, the time, the user's ip address, and the page "Products and Services".

If you do not want to use the tracking features, then just do not set this variable in the login settings.

Features
When viewing the tracking information you have a few options.

  1. The first option is to view all of the users in your database or choose a user from the drop down list.
  2. You can choose how many records to view on a page.
  3. You can sort the list, by clicking on the column headings. Just click on the heading and it will sort automatically.
  4. Lastly, you can download what you are looking at on-screen, by just click on the download link in the sub-menu options


.topic 20000
This is the Description Text for this form. Check out the What's this help assigned to the controls.

.topic 20001
This is Program Options Group

.topic 20002
Context Sensitive Help for this program option 1

.topic 20003
Context Sensitive Help for this program option 2

.topic 20004
Context Sensitive Help for this program option 3

.topic 20005
Context Sensitive Help for this program option 4