Securing ASP Data Access

Preparing the Metabase (2)

Next, the script calls CreateClass, passing the name of the new class, "DataAccessMethods". CreateClass is a simple function, which attempts to create the new class and returns TRUE if it succeeds. The functional part of the code is:

Set NewClassObj = SchemaObj.Create ("Class", ClassName)

If the class was created successfully, then the script will create the properties themselves, adding each one to the class only if it has also been successfully created. In each case, the script will call CreateProperty and AddToClass for each new property. It does this through a subroutine called CreateProperty_Plus_AddToClass, the purpose of which is basically to save typing and prevent potential spelling errors that would bomb the script.

The script also adds two predefined properties to the DataAccessMethods property. The first is KeyType, which the metabase uses to determine the class of a key within the metabase; generally speaking, all classes make use of this key. The second is AdminACL, which determines the security permissions that will be applied to a given instance of the class.

Finally, the script creates class DataAccessStorage, a class specially created to hold the key folder that contains each of our DataAccessMethod keys. The only properties of this class are KeyType and AdminACL, which will allow us to set the security permissions for the root container.

Here is the condensed code from CreateProperty.

Set NewPropertyObj = SchemaObj.Create ("Property", PropertyName)
If Trim(Syntax) = "" Then Syntax = "string" ' default is String
NewPropertyObj.Syntax = Syntax ' Set the syntax; must do pre-save
NewPropertyObj.SetInfo ' save to the metabase
NewPropertyObj.Inherit = True ' Set attributes by inheritance
NewPropertyObj.SetInfo ' save to the metabase

First, CreateProperty defines NewPropertyObj, the new property object, by calling the Create method of SchemaObj, which we defined earlier. At this point, nothing has changed in the metabase. Before the new property can be saved, its syntax must be defined. While there are many syntax types, "string" is sufficient for our purposes here, and so we use it as the default syntax. After setting the syntax, the script then performs a SetInfo on the object. This stores the item in the metabase. After the property has been saved once, changes can be made to its other settings, such as inheritance. Don't forget to use SetInfo again to save any changes you make at this point.

Now, let's move on to the code in AddToClass.

Set NewClassObj = GetObject ("IIS://" & MachineName & "/Schema/" & ClassName) 'Get the class object
'Get the optional properties list
OptPropList = NewClassObj.OptionalProperties
cnt = UBound(OptProplist)

'Add the new property to the array
ReDim Preserve OptPropList(cnt+1)
OptPropList(cnt+1) = PropertyName

'Write the values to the metabase
NewClassObj.OptionalProperties = OptPropList

As before, GetObject will retrieve the class object we want to add our properties to. Next, OptPropList is set with the value of the class object's OptionalProperties property.

All this talk of properties, property lists, and optional properties has probably got your tongue tied in knots. Just think of OptionalProperties as an array that contains the list of properties that are part of the class, which happens to be a property of another object altogether. "I love properties! I'll have the properties, properties, properties, properties, invoked methods, and properties!" (I refuse to take credit for this odd naming convention; you can blame the nice folks at Microsoft for it, but it certainly gives us an interesting insight into why they call it a meta-base.)

Now that we've got that little confusion out of the way, the next step is to set cnt to the upper bound of the OptPropList array. We do this so that we can extend the array by one in the following code. ReDim Preserve adds an additional element to the array, leaving existing values intact. This gives just enough room to add the new property name to the list. Once that's done, the script reassigns OptPropList to the OptionalProperties property. (Here we go again!) And, finally, there is one more call to SetInfo to save the whole sordid mess to the metabase.

If that didn't confuse you as much as it did me the first time around, you can take a look at RemoveFromClass, another function I included that didn't get used here. There is also a wealth of information about ADSI and the IIS metabase on the Microsoft Developer's Network web site. To learn more about extending the IIS Schema, visit the Microsoft web site at:

The result of the preceding section and script is that the IIS metabase has now been successfully prepared to store the special data types that will be used to hold the connection string, user name, and password for the database. Next, we'll write those values, first using MetaEdit, then using ASP.

You might also like...


About the author

Thomas C. Carpe United States

I have been working in IT since 1993. I founded CarpeDiem Business Internet Systems in 1995. In 2000 we incroporated and took on two partners. Its really a grat lot of fun, and I enjoy working o...

Interested in writing for us? Find out more.


Why not write for us? Or you could submit an event or a user group in your area. Alternatively just tell us what you think!

Our tools

We've got automatic conversion tools to convert C# to VB.NET, VB.NET to C#. Also you can compress javascript and compress css and generate sql connection strings.

“Hofstadter's Law: It always takes longer than you expect, even when you take into account Hofstadter's Law.”