Introducing IIS 7 Microsofts Next Generation Web Server

Introducing IIS 7: Microsoft’s Next Generation Web Server

IIS 6 Today : A Proven Platform Proven Scale My. Space - 23 Billion Page* Views/Month Microsoft. com - 10 k Req/sec & 300 K Connections Match. com 30 million page view daily Proven Security No critical IIS 6 hotfixes since RTM as of 5/20/07 Proven Trust 54% of Fortune 1000 use IIS (port 80 software. com) A solid foundation to build on.

Security Progress for IIS Two security patches for IIS 6 since RTM (>3 yrs) 2002 2003 4/15 Server 2003 RTM 2004 2005 (Web. DAV Do. S) 2006 (ASP) 06/11 06 -034 10/12 04 -021 IIS 6 6/11 4/10 02 -018 02 -028 IIS 5 8 10/30 02 -062 5/28 03 -018 4 4 7/13 04 -021 8 IIS 4 4 < Critical = Critical X = Rollup with X updates 4 Notes • MS 02 -011 & 012 not included: updates SMTP service only • ASP. NET adds: 1 – v 2. 0 2 - v 1. 1 3 - v 1. 0

Internet Information Services (IIS) 7. 0 More than a Web server, Internet Information Services 7. 0 provides an accessible, extensible platform for developing and reliably hosting Web applications and services IIS 7. 0 Enhancements Modular Architecture Extensible Design Integrated with. NET Manageable Built in Request Tracing Create Streamlined Servers Reduced Attack Surface Rapid Application Deployment Extend/Modify IIS Features Fast Diagnostics

Microsoft. com on IIS 7 Beta 3 of Windows Server 2008 since June 12 Great Compatibility 99%+ ASP and ASP. NET worked One application encountered breaking change out of 260 Classic ASP mode and App. Cmd And loved New UI, death of metabase, shared config, failed request tracing etc. http: //blogs. technet. com/mscom/archive/2007/09/07/the-tasty-morsels-found-in-dogfoodmscom-ops-top-10 -changes-in-iis 7 -0. aspx

Extensible Design

IIS 6 Architecture - Request Processing Authentication NTLM Basic Anon Monolithic implementation Install or nothing… … CGI Determine Handler Static File ASP. NET ISAPI … PHP Send Response Log Compress Extend server functionality only through ISAPI…

IIS 7 Architecture - Request Processing Authentication NTLM Basic Server functionality is split into ~ 40 modules. . . Anon Authorization … Resolve. Cache. CGI … Determine Static File Handler Execute. Handler ISAPI … … Update. Cache Send Response Send. Response Log Compress Modules plug into a generic request pipeline… Modules extend server functionality through a public module API.

View Default Running Modules C: WindowsSystem 32inetsrvconfig

The Many Benefits of IIS 7’s Modular Design IIS 6 IIS 7 Benefits Architecture Monolithic Modular Customize, Extend, Streamline Setup Most Features Minimal installed installation for (many disabled) designated role Increased Security Extend Features ISAPI filters and Add modules ISAPI and handlers in extensions native or managed code Easier to develop application and administration features Customize UI Possible, but not common. Much easier for developers to provide new admin features Extensible, modular, based on. NET

Extensibility IIS 6 extensibility limited to ISAPI filter and extensions UI modifications in MMC are challenging Difficult to extend IIS 6 Schema Web service activation using http only IIS 7 Native or manage code modules and handlers Easy to add your apps to UI Simple to extend IIS 7 schema Instrument apps to integrate with IIS 7 tracing Host web services using non-http protocols

Instantly you can tell it is new. . .

The New IIS 7 Manager Completely redesigned IIS Manager Task-oriented Context sensitive ‘Actions’ pane Tabs are replaced with Icons Allows IIS & and ASP. NET configuration Icons instead of tabs Provides managed extensibility Add new management and IIS features Application configuration can integrate into UI View health and diagnostics within the UI Built in remote administration over https Manage 1 or 1000’s of sites

demo Introducing the IIS Manager

. NET Integration

Integrated Application Pool architecture based on IIS 6 Familiar settings for recycling, health monitoring, and process identity are unchanged Two pool types in IIS 7 Integrated (default) Allows use of managed code to provide pipeline services for all requests Example: . NET Forms authentication for Perl Integrated is the default for new pools Classic Works same as IIS 6 Ensures. NET compatibility

. NET Integration Simplifies security and administration Leverage the power of. NET for all content with managed global modules Forms Authentication URL Authorization. NET Caching. NET Role and Membership Providers New APIs manage both IIS 7 and. NET Enables Xcopy deployment scenarios

IIS 6 ASP. NET Integration ISAPI-based Implementation Only sees ASP. NET requests Authentication NTLM Basic Feature duplication Anon … Determine Handler CGI aspnet_isapi. dll Static File Authentication ISAPI … Send Response Log Compress Forms Windows … Map Handler ASPX Trace … …

IIS 7 ASP. NET Integration Basic Authentication Anon Two App Pool Modes Classic (IIS 6) Authorization Integrated Mode Resolve. Cache … . NET modules / handlers aspnet_isapi. dll Execute. Handler … Static File ISAPI Update. Cache Send. Response plug directly into pipeline Authentication Forms Process Windows all requests … Full runtime fidelity Map Handler Compress Log ASPX Trace … …

Migrating to Integrated ASP. NET Handler and module configuration settings have moved: system. web/http. Handlers → system. web. Serverhandlers system. web/http. Modules → system. web. Servermodules Setting the “managed. Handler” precondition for a module means “execute only for ASP. NET requests”

Better Management

Built in Remote Administration Use IIS Manager from XP, Vista, Windows Server 2003/2008 No administration website required! Secure, firewall-friendly connection over HTTP/SSL Fully customizable Supports auto-deployment of new Administration features from server->client Can hide features remote user cannot edit

IIS 7 Configuration System Moved from Metabase. xml (and. bin) to Applicationhost. config File based configuration improves manageability XML – integrate with XML readers and APIs Config can be copied to other servers Easier to read Facilitates backup, restore and editing You now have choices about how to manage IIS configuration Centralized Configuration Delegated Administration Shared Configuration

Configuration System Contso. com root . NET + IIS 7. NET Framework Machine. config NET global settings Contoso. com Orders Site Root Web. config Global web. config ASP. net global settings <system. web>. NET settings. . IIS 7 Applicationhost. config Global settings and location tags . . <system. web. Server> IIS 7 Delegated settings. .

Delegated Administration Delegate control to site owners Site owners control designated settings without elevated server privileges Delegated settings written to Web. config files Site and/or application level Shared with ASP. net configuration XCopy deploy configuration and content Granular control over delegated settings allows precise locking Example: Require Windows Authentication - let site owner control turn on/off Basic.

Shared Configuration All web servers can share a single applicationhost. config Eliminates configuration replication in a web farm Easily stage and rollback config changes All administration tools are redirected to a common UNC path Does not replicate content First appearance in Longhorn Beta 3

Staging and Rollback IIS 7 XML App. Host. config IIS 7 UNC Version 1 IIS 7 Staging New Config Version 2 Easily manage multiple configuration versions for staging and rollback

demo A lap around administration

Automating IIS 7 Management APPCMD General purpose command line tool Query and control state, change settings, add sites and vdirs Managed Code API Microsoft. Web. Administration WMI Improved namespace for IIS 7 ADSI compatibility Powershell use with Managed API and WMI

IIS 7 Administration Tools simple cmd-line syntax powerful mgmt objects inline help & multiple outputs

Appcmd – Listing and Filtering C: > appcmd list sites SITE "Default Web Site" (id: 1, bindings: HTTP/*: 80: , state: Started) SITE "Site 1" (id: 2, bindings: http/*: 81: , state: Started) SITE "Site 2" (id: 3, bindings: http/*: 82: , state: Stopped) C: > appcmd list requests REQUEST "fb 0000008000000 e" (url: GET /wait. aspx? time=10000, time: 4276 msec, client: localhost) C: > appcmd list requests /apppool. name: Default. App. Pool C: > appcmd list requests /wp. name: 3567 C: > appcmd list requests /site. id: 1 Filter results by application pool, worker process, or site

Scripting: IIS 6 WMI Provider NOT CONSISTENT Set o. IIS = Get. Object("winmgmts: rootMicrosoft. IISv 2") ' Create binding for new site Set o. Binding = o. IIS. Get("Server. Binding"). Spawn. Instance_ o. Binding. IP = "" o. Binding. Port = "80" o. Binding. Hostname = "www. site. com" Create Site ' Create site and extract site name from return value Set o. Service = o. IIS. Get("IIs. Web. Service. Name='W 3 SVC'") str. Site. Name = o. Service. Create. New. Site("New. Site", array(o. Binding), "C: inetpubwwwroot") Set obj. Path = Create. Object("Wbem. Scripting. SWbem. Object. Path") obj. Path = str. Site. Name str. Site. Path = obj. Path. Keys. Item("") Create Virtual Directory Set o. Site = o. IIS. Get("IIs. Web. Server. Name='" & str. Site. Path & "'") o. Site. Start ' Create the vdir for our application Set o. VDir. Setting = o. IIS. Get("IIs. Web. Virtual. Dir. Setting"). Spawn. Instance_ o. VDir. Setting. Name = str. Site. Path & "/ROOT/bar" o. VDir. Setting. Path = "C: inetpubbar" o. VDir. Setting. Put_ Create Application ' Make the VDir an application Set o. VDir = o. IIS. Get("IIs. Web. Virtual. Dir. Name='" & str. Site. Path & "/ROOT/bar'") o. VDir. App. Create 2

Scripting: new WMI Provider CONSISTENT Set o. Service = Get. Object("winmgmts: rootWeb. Administration") ' Create binding for site Set o. Binding = o. Service. Get("Binding. Element"). Spawn. Instance_ o. Binding. Information = "*: 80: www. site. com" o. Binding. Protocol = "http" Static Create methods ' Create site o. Service. Get("Site"). Create _ "New. Site", array(o. Binding), "C: inetpubwwwroot" ' Create application o. Service. Get("Application"). Create _ "/foo", "New. Site", "C: inetpubwwwrootfoo"

Compatibility: ABO Mapper Provides compatibility for: scripts command line tools native calls into ABO IIS 6 ADSI Script Not installed by default Install IIS 6 Compatibility IISADMIN Can only do what IIS 6 could do… Can’t read/write new IIS properties Application Pools: managed. Pipeline. Mode, managed. Runtime. Version ABOMapper Request Filtering Failed Request Tracing Can’t read/write ASP. NET properties Can’t read/write web. config files Can’t access new runtime data, e. g. worker processes, executing requests application. Host. config

Built in Request Tracing

Tracing and Diagnostics View Detailed Errors in the Browser New errors provide prescriptive guidance Access Runtime State Info in Real-Time New APIs expose all runtime diagnostic information Ex. See all currently executing requests Rapidly Troubleshoot Faulty Applications Rules define ‘failures’ that triggers report of pipeline events Define by http result code and/or time taken Configurable per application or URL Quickly identify bottlenecks Developers can add custom events

demo Tracing and Diagnostics

Summary: The ISV Opportunity Managed code everywhere Integrated Pipeline IIS 7 Managed module starter kit http: //www. iis. net/downloads/ Add application specific UI to IIS Manager http: //www. iis. net/articles/view. aspx/IIS 7/Extending-IIS-Manager/How-to. Create-a-Simple-IIS-Manager-Module Simplified deployment, server farms Xcopy of config files, shared config, appcmd Reduced surface area Manage with delegate administration Diagnose with built in / extensible tracing Provide high availability host for web services

http: //IIS. net - new home for IIS Community! Go Live License available to public Download Center – Download IIS 7 Extensions such as new FTP server Tech. Center to easily find the info you need Advice and assistance in Forums Walkthroughs, examples, and code samples Online labs – test IIS 7 in your browser!

Best webcasts http: //www. microsoft. com/emea/itsshowtime/result_s earch. aspx? event=69

© 2007 Microsoft Corporation. All rights reserved. Microsoft, Windows Vista and other product names are or may be registered trademarks and/or trademarks in the U. S. and/or other countries. The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

Changes from IIS 6 Deprecated NNTP IIS 5 Worker Process Isolation Mode FPSE (compatible alternative on IIS. net) Metabase. bin/Metabase. xml IUSR_<servername> IWAM_ <servername> and IIS_WPG POP 3 No administration website