Managing Access

Article
08/02/2007

Overview

Users in Microsoft Content Management Server 2001 (MSCMS 2001) are imported from the network and updated approximately every ten to fifteen minutes. Any valid login ID on the network is a potential MSCMS 2001 user. You may want to create a new Windows 2000 domain reserved for users.

Managing Internal Access

Ensuring subscriber access

After you have set up channels and subscriber rights groups, it is important to let subscribers know their entry points for the site, and to coordinate template with navigation programmers to create those entry points, if necessary.

If you plan to give subscribers different entry points according to their identities or design-time roles, be sure to send an e-mail message, or otherwise notify them of their own specific entry point. This can also be done through specific links at a single-entry point.

Managing External Access

Setting up guest access for non-staged sites

Before installing MSCMS 2001, you need to create a Windows 2000 account called "GuestUser" (or any name you prefer). The MSCMS 2001 Setup Guide steps you through this process. During the installation procedure, you can provide guest access whereby site visitors from outside your Windows 2000 domain can view parts of your site as a Guest.

To manage guest access, set up a "Guest" subscriber rights group, add the "GuestUser" account to the rights group, and give the group rights over those channels guests can view.

Generally, you want members of any subscriber rights group to have access to the channels that have been assigned to the Guest Users rights group. If a subscriber rights group has access to a few channels only, it may save time to assign those channels to the Guest User rights group.

Setting up visitor access

When creating an LDAP or Windows 2000 MSCMS 2001 Guest account, consider setting up user accounts for special types of visitors, with names such as Partner, Customer, Press, Contractor, or Investor, that reflect their relationship to your site. You must also set up subscriber rights groups for these visitors, and add the users to them. Distribute the user names and passwords for each visitor type to the appropriate people.

You can use these password-protected accounts to target sensitive information to certain site visitors, or to give customers or contractors access to pages from which they can download files.

Restricting external access

As an MSCMS 2001 administrator, take care to restrict external visitor access to certain parts of your site. If, for instance, the generic Guest account is allowed access to subscription pages, one guest could change subscription rights for all subsequent guests. The subscription.asp script, in the Shared directory, prevents Guest accounts from accessing the subscriptions pages; however, the main purpose of this .asp file is for changing subscriptions.

About Web search access (for dynamic sites)

MSCMS 2001 allows Internet search engines to index URLs that are accessible to guests. MSCMS 2001 permits Web indexing access to only those URLs that are accessible to guests.

You can also implement your own search feature by installing a search engine directly on the site. In this case, you can allow searches for authenticated access also.

Requirements for Web indexing

If you plan to have your site indexed by an Internet search engine, or use a Web crawler to allow users to do full-text searches on your site, this section explains the general requirements.

About Web indexing software

Web crawlers are used by most major Internet search services, as well as the site indexing applications that can be purchased for use on your own Internet or intranet site.

Most Web crawlers work similarly, taking the top-level pages submitted, and following all the links it finds. The collected information is stored, while the links are used to guide the crawler's search patterns. When potential customers look for your products or services through Internet search sites, the results of their queries are generated from the pages found by the Web crawler.

For a working demonstration of how searching capabilities can enhance an MSCMS 2001 Web site, visit www.microsoft.com/cmserver.

Redirection

MSCMS 2001 uses redirects that your Web crawler may or may not recognize. You will need to add the necessary HTML coding to templates to ensure that redirects are handled correctly by the Web crawler. Refer to the MSCMS 2001 Site Programmer's Guide for more information.

Setting the title of a page template

Most search engines display the title of the pages they index. For framed and frameless sites, this title is created by the page template's <TITLE> tags. To use the posting name as the document's title, the Publishing Application Programming Interface (API) Autosession object can be used within the page template:

<HTML>
<HEAD>
<TITLE><%=Autosession.ThisPosting.Name%></TITLE>
</HEAD>

Setting up for Indexing by a Web Search Engine

Setting up user access to Internet search engine results

MSCMS 2001 must have Default Guest Access allowed in order for public Internet search engines (Web crawlers) to index your site. If the Web crawler is pointed at the root page of a site that doesn't allow guest access, then the Web crawler will not be authenticated and will not index any pages. The Default Guest Access option can be provided using the MSCMS 2001 Server Configuration Application.

Indexing Your Site for Full Text Searching

You can provide a search link from your MSCMS 2001 site to Web indexing software. This will allow users to search for postings, or text contained in the pages associated with postings. MSCMS 2001 ships with Active Server Pages (ASP) scripts for Site Server that allow all searches to be authenticated by the user's rights. For example, a search for postings will return only the postings contained in channels the user has rights in. Full text searching also offers users two options for filtering results from a search. Full text search can:

search for postings in channels the user has rights in
search for postings in channels the user is subscribed to.

Indexing your site is a regular task. Depending on the Web indexing software you use, it may be possible to automate daily indexing. Whether indexing is automated or done manually, it's best to do the indexing outside of working hours, or any time when fewer people are using MSCMS 2001. Indexing every channel on your site will tax your server.

Setting the User Agent String

A Web crawler's User Agent String contains a keyword that identifies the Web crawler when making http GET requests. For example, when an Internet Explorer 5 browser does a search, it sends a string that indicates the request came from Internet Explorer 5.

If you are using a Web crawler to do authenticated (that is, using username and password rather than as guest) full-text searches on your site, you must add a keyword "MSCMS 2001" to its User Agent String, so that MSCMS 2001 can authenticate the Web crawler.

Creating a user account for authenticated Web indexing

Windows 2000 membership authentication

To index your site for full text searching, create an MSCMS 2001 user account for use by the Web indexing software. If all channels and their contents are to be crawled, create an administrator account for this purpose. This saves time, as administrators have access to all channels automatically and don't require subscriptions to channels. The Web indexing software will crawl your site using the administrator account you have set up. Security is maintained, as subscribers can search only within channels where they have rights.

Configuring the MSCMS 2001 User Account

Configure the Web indexing software to use the MSCMS 2001 user account and the domain the user account resides on. For example: MY_DOMAIN\USER_NAME.

Site Server and Active Directory membership authentication

If you are using Site Server's Membership Server or Active Directory for membership authentication, your Web indexing software uses an LDAP account to index your site. You can assign an administrator role to the LDAP user account. Giving the LDAP account administrator rights ensures the LDAP account has access to all channels on your site.

Configuring Internet Information Server for Web indexing

To allow full text searching, IIS must be configured for Basic Authentication.

Open the Microsoft Management Console for IIS.
Right-click the Web server that is hosting your MSCMS 2001 site and select Properties from the pop-up menu. The Web server's Properties dialog box opens.
Select the Directory Security tab.
In the Anonymous Access and Authentication Control area, click the Edit button. The Authentication Methods dialog box opens.
Select the Basic Authentication option, and click OK.

Configuring IIS for Web indexing on Site Server

If using Site Server, to allow full text searching, IIS must be configured as follows:

Open the Microsoft Management Console for IIS.
Right-click the Web server that is hosting your site, and select Properties from the pop-up menu. The Web server's Properties dialog box opens.
Select the Membership Authentication tab.
Select the Basic Authentication option, and click OK.

Precautions when indexing your site for full text searching

Take precautions to ensure no users other than MSCMS 2001 administrators have access to the machine where the Web indexing software has been installed. Because the Web indexing software uses administrator rights to crawl your site, it creates links to all postings on your site. Some Web indexing software packages display a sample paragraph from each page the postings point to. We recommend installing the Web indexing software on the same machine hosting your MSCMS 2001 server, and restricting access to it.

Note Be sure to save copies of your original files, in case you need to restore their original functionality.

Linking the search page to your MSCMS 2001 Web site

After the site index for full text searching has been generated, you need to provide a way for a user to search the index. The following file can be used as an example of how to use Site Server search:

\Server\Methods Systems Sample\Support Files\Includes\Search\Search.inc.

Web Crawler Information

This document contains general Web crawler information:

https://info.Webcrawler.com/mak/projects/robots/robots.html

This reference contains recommendations for helping search engines index a Web site:

https://www.w3.org/TR/REC-html40/appendix/notes.html#recs

Using the Kill Lock Command

While a user is working on an MSCMS 2001 object such as a page, that object is locked to prevent two users from working on the same object at one time. (Other users can work with a locked object in read-only mode.)

If a client machine was turned off while one or more objects were use, the object(s) may remain locked after rebooting. Use the Kill Lock command from the Tools menu in the Site Builder to end the lock.

If users consistently report being unable to work with an object they have rights to, kill the lock on it after making sure no user is currently working with it.

Caution Ensure that no one is using the page at the time Kill Lock is used. Killing the lock on a page currently in use can result in loss of data.