Microsoft FrontPage 2000 Server Extensions Resource Kit

Advanced Administrative Tasks

Adapting FrontPage Server Extensions for Large Web Presence Providers

If you are an administrator at a very large Web presence provider (WPP) where the environment is highly customized, you can adapt the The Microsoft® FrontPage® Server Extensions to fit your custom solutions.

This adaptable implementation of the FrontPage Server Extensions is known as lightweight server support. Lightweight server support is designed for WPPs who have many thousands of Webs and who have the resources to create custom solutions. Typically, such WPPs create custom code for automating the process of setting up and maintaining customer accounts.

If you are running the FrontPage Server Extensions in lightweight server support mode, it is assumed that custom solutions at your site take into account any and all necessary security measures. Because the FrontPage Server Extensions do not contribute any security functionality when running in a lightweight server configuration, the security of your web environment depends completely upon your custom solutions.

By configuring the FrontPage Server Extensions to use lightweight server support, large WPPs can scale the FrontPage Server Extensions to meet the demands of a high volume, highly customized environment. Implementing the FrontPage Server Extensions' lightweight server support affects the way you:

• Set up FrontPage Server Extensions
• Set up users
• Modify CGI variables
• Handle requests to the server

Setting up FrontPage Server Extensions

The procedure for setting up the FrontPage Server Extensions for lightweight server support depends on the platform of your Web server.

Enabling lightweight server support for UNIX

If you are running a Web server based on UNIX:

Install the FrontPage Server Extensions, creating the /usr/local/frontpage/version4.0 directory and a single _vti_bin directory.

Create the file /usr/local/frontpage/version4.0/enablelws.txt, owned by root. The presence of this file indicates to the FrontPage Server Extensions that lightweight server support is enabled on this computer.

If you have one FrontPage-extended web per user, all on the same virtual server (such as http://www.largewpp.com/community1/user2), update the _vti_inf.html file in the root directory by adding FPNoRootWeb="n", where n is the level of each user's content directory. For example, for User2, at http://www.largewpp.com/community1/user2, you would set FPNoRootWeb=2.

If each of your customers has their own virtual server, do not set FPNoRootWeb.

Enabling lightweight server support for Windows

If you are running a Web server based on Windows:

Install the FrontPage Server Extensions, creating the \Program Files\Common Files\Microsoft Shared\Web Server Extensions\40 folder and a single _vti_bin subfolder.

In the registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\Web Server Extensions\Ports\4.0, create a value with the name LWSFilterDll and a string value set to the path of your custom DLL. This DLL should have an entry point with the following signature:

BOOL __cdecl FPIsLWSEnabled( LPEXTENSION_CONTROL_BLOCK *pecb);

FrontPage calls this routine for each server request to determine whether lightweight server support is active for that request. So, for example, if all of your FrontPage-extended webs use lightweight server support, this routine always returns TRUE, and FrontPage Server Extensions run in lightweight server mode for all of your FrontPage users.

If you have one FrontPage-extended web per user, all on the same virtual server (such as http://www.largewpp.com/community1/user2), update the _vti_inf.html file in the root directory by adding FPNoRootWeb="n", where n is the level of each user's content directory. For example, for User2, at http://www.largewpp.com/community1/user2, you would set FPNoRootWeb=2.

If each of your customers has their own virtual server, do not set FPNoRootWeb.

The FrontPage Server Extensions cannot use Microsoft Index Server when they are running in lightweight server mode. Therefore, if your IIS Web server is running Index Server, set the configuration variable NoIndexServer=1 in the registry. For more information about this configuration variable, see NoIndexServer.

Setting up users

If you have custom code that automates the process of setting up new users, you should add code that sets up users to use the FrontPage Server Extensions. For each FrontPage user, create the following under the root directory of the user's web:

• services.cnf file, with a forward slash (/) as its contents, in the directory _vti_pvt
• _vti_cnf directory
• _vti_txt directory (for full-text search index)

For example, on a UNIX server, an account for User1 contains the following:

Your server code must use custom environment variables to allow the FrontPage Server Extensions to map server requests to the proper user directories.

Modifying CGI variables

The FrontPage Server Extensions will check for environment variables to work with your custom server. You can customize your server to handle the environment variables that FrontPage Server Extensions are checking for. To customize your server, you must modify and recompile server code, create a custom Apache module, or create an ISAPI filter. See your Web server's documentation for information about modifying variables.

FrontPage Server Extensions use some standard CGI variables, as well as a few custom variables, which you must add.

Standard CGI Variables

FrontPage Server Extensions use the following standard CGI variables:

SERVER_NAME

Determines the URL of the site being managed with FrontPage. Used during link management and when setting the base URL in pages that are generated by browse-time FrontPage components.

SERVER_PORT

Determines the URL of the site being managed with FrontPage. Used during link management and when setting the base URL in pages that are generated by browse-time FrontPage components.

SCRIPT_NAME

Determines the subweb associated with the current request, such as /user1/_vti_bin/shtml.exe, or for a FrontPage 2000 nested subweb, /user1/service/_vti_bin/shtml.exe.

PATH_INFO

Identifies the extra information in a URL after the CGI script. Used by FrontPage browse-time FrontPage components.

PATH_TRANSLATED

Indicates a mapped version of PATH_INFO, taking the custom directory mapping algorithm into account. For example, if http://www.largewpp.com/user1 is stored in c:\users\u\s\user1, then PATH_INFO is /user1/, and PATH_TRANSLATED should be set to c:\users\u\s\user1\.

Customizing environment variables for UNIX

In addition to the standard CGI variables, you must add the following FrontPage-specific variables on a UNIX platform:

FRONTPAGE_LWS_PATH (required)

Indicates to the FrontPage Server Extensions that they are being invoked in a lightweight server environment. The FrontPage Server Extensions will not check for FrontPage-specific server configuration information; nor will they check for server-specific configuration information, such as httpd.conf or the IIS metabase.

Set this variable to a directory that can generate all file names within the target web. For example, if http://www.largewpp.com/user1 is stored in c:\users\u\s\user1, then FRONTPAGE_LWS_PATH should be set to c:\users\u\s when authoring against that web.

FRONTPAGE_LWS_SSL_PORT (optional)

Identifies the other port on a SSL server. For example, if an authoring request comes in on port 443, FRONTPAGE_LWS_SSL_PORT might be set to 80.

FRONTPAGE_LWS_LANGUAGE (optional)

Identifies the default language to use for error messages and generated pages. Corresponds to the FrontPage default language server setting.

Customizing environment variables for Windows

If your Web server is a Microsoft Internet Information Server, you must create an ISAPI filter that processes requests to the server. This ISAPI filter should set the variables as described for UNIX, but append the string HTTP_ to the beginning of script variables, as shown:

HTTP_FRONTPAGE_LWS_PATH
HTTP_FRONTPAGE_LWS_SSL_PORT
HTTP_FRONTPAGE_LWS_LANGUAGE
HTTP_FRONTPAGE_LWS_PATH_TRANSLATED

In addition, you must create the following variable:

HTTP_FRONTPAGE_LWS_SCRIPT_NAME

Overrides SCRIPT_NAME CGI variable for FrontPage Server Extension support.

Handling requests to the server

Using the custom environment variables, you can implement support for FrontPage in your custom Web server code.

Your custom code must modify the Web server so that it intercepts all requests to */_vti_bin/* directory and does the following:

• Uses either the virtual server name (www.user1.com) or to the script name (/user1/_vti_bin/shtml.exe) to identify the target web.
• Validates requests:
• Only web administrators can make requests to /_vti_bin/_vti_adm.
• Only web authors and web administrators can make requests to /_vti_bin/_vti_aut.
• Only web browsers, web authors, and web administrators can make requests to /_vti_bin.
• Invokes a single copy of the _vti_bin executables with the appropriate environment variable settings. These could be either the actual executables or, on UNIX, the setuid shims developed for the FrontPage Apache patch support (apache_fp).

In addition, your custom code must intercept and disallow all requests (GETs and POSTs) to */_vti_* and */_pvt/* directories, except those to */_vti_bin/*. These directories contain files that are used only by the server extensions and should not be accessible to any browsers.

Under the lightweight server configuration, FrontPage Server
Extensions do not contribute any security functionality. Therefore,
your custom Web server code is responsible for setting the
necessary restrictions to Web resources.