FrontPage Server Extensions Make IIS Administration Easier

If you're just getting started with Microsoft FrontPage, chances are you've been looking at the FrontPage 98 Server Extensions. But if you're working in a fast-paced, feature-driven environment where customers are clamoring for forms that write to and read from a database (without programming) and Web sites that can have innumerable nested sub-Webs (each with a separate administrator, authors, and users), then take a look at the FrontPage 2000 Server Extensions. Both versions of the FrontPage Server Extensions are now available for most popular servers on several platforms (including UNIX) and in several languages. Let's look at what server extensions do, the differences between them, where you can get them, and my experience in migrating from the FrontPage 98 to the FrontPage 2000 Server Extensions. For commonly used FrontPage terminology, see the sidebar "A Few FrontPage Terms," page 2.

What Can FrontPage Server Extensions Do for You?
For a long time, server administrators seemed to think that FrontPage was only an HTML editor and had nothing to do with Microsoft Internet Information Server (IIS). However, FrontPage is also a Web-site publishing and management tool that comes with some fine Web-management capabilities (e.g., role-based permissions and both local and remote administration tools). For the IIS administrator, the FrontPage Server Extensions let you create Web sites and assign permissions for who can browse, author, and administer them in just a couple of mouse clicks. The extensions create all the directories for you and set all the permissions. At that point, FrontPage administrators can take care of the sites themselves. Best of all, you can administer your FrontPage Web sites from any FrontPage client anywhere in the world.

For the content author, FrontPage comes with some essential features such as Automatic Hyperlink Fix-Up, which lets you move or delete files from a Web site and automatically update every reference to those files. For example, you can move all your pictures to the images directory, and they all still appear on their pages. Themes (professionally designed page elements and color schemes) let authors easily create custom graphics, text, and layout environments for customers. Authors can use wizards to set up well-behaved, ready-to-use Common Gateway Interface (CGI) programs such as the forms processor, the forum processor, and the site search engine without a programmer.

The forms processor can receive forms data, create confirmation pages dynamically, write to one or more file databases with several possible formats, and forward filled-out forms to an email address.

FrontPage-generated forums are popular, especially as self-serve classified-ad engines. The search engine is local to its Web site and doesn't require any server-side administration.

The FrontPage Server Extensions power these features. The server extensions (whether FrontPage 98 or FrontPage 2000) handle three types of tasks:

FrontPage is one part editor and three parts server extensions. Development tools such as Microsoft Visual InterDev receive a lot of press for their server-side parts, but Visual InterDev uses the FrontPage Server Extensions. The reason for this widespread use of the FrontPage Server Extensions is that CGI handles the server extensions' functions. CGI is an international standard, and all Web servers support it, so FrontPage clients can publish their Web sites and content to any server (e.g., IIS, Apache, O'Reilly, Netscape) that has the FrontPage Server Extensions installed. I still have an old Apache server running that hosts a lot of ISP personal Web sites. My Web authors publish to it all the time, and they have no idea that it's not IIS.

Before the FrontPage Server Extensions, the common practice had been to let customers use FTP to update their Web sites. Because setting unique permissions on every subdirectory is time-consuming and because users could create subdirectories, some administrators set one group of permissions (read, write, and execute) for an entire Web site. This lack of control and lax security provided a perfect environment for the customers to accidentally lose or delete their Web content. Customers could even write content to somebody else's site.

The FrontPage Server Extensions help solve these problems. First, FrontPage sets the appropriate permissions on every directory and file in a FrontPage Web site when it creates the site. It creates hidden private directories for components such as the CGI programs, so the author isn't in danger of accidentally deleting some required component. Next, FrontPage lets me, the administrator, assign role-based permissions (e.g., browse only, author, administer) on each FrontPage Web site and sub-Web individually. As the FrontPage administrator, I can let an author update content on a particular Web site, but not create new Web sites. Of course, I can also override the default settings and set custom read, write, and execute permissions. And finally, I can author and administer my FrontPage Web sites from any FrontPage client anywhere in the world.

A Few Words About Security
The server extensions raise two main security concerns: How well does authentication work, and can an unauthorized user attack the server through the server extensions? The FrontPage Server Extensions in FrontPage 98 use Basic authentication over the Internet (the browser ships the password in cleartext). With FrontPage 98 and Microsoft Internet Explorer (IE) 4.0, you can use Windows NT Challenge/Response authentication if you're in an NT domain in an intranet setting. The FrontPage 98 Server Extensions and Basic authentication provide the same level of security as FTP but without the hands-on administration that FTP requires to secure the content directories. If you need better security than Basic authentication for FrontPage 98, you can set up the Web site and FrontPage so that all authoring uses Secure Sockets Layer (SSL).

The FrontPage 2000 Server Extensions support NT Challenge/Response authentication over the Internet, as does IE 5.0 and the other Microsoft Office 2000 applications. This authentication makes these extensions more secure than either FTP or FrontPage 98. This capability poses some very exciting possibilities, which I'll discuss in a future article. If NT Challenge/Response authentication isn't secure enough for you, you can still add SSL.

The FrontPage Server Extensions' vulnerability is very low. The FrontPage client uses HTTP to communicate with the server extensions just like a browser. FrontPage implements a remote procedure call (RPC) on top of the HTTP power-on self test (POST) request, which goes to the Web server. This request lets the FrontPage client send and request documents, update the tasks list, add new authors, and so on. The Web server sees POST requests addressed to the FrontPage Server Extensions' CGI programs and directs those requests through the Internet Server API (ISAPI—you can find out more about ISAPI and CGI at http://www.w3.org). Because the server extensions accomplish all editing and publishing within the HTTP protocol, the FrontPage Server Extensions offer malicious users nothing exotic to take advantage of. And FrontPage correctly communicates between client and server through proxy servers and firewalls.

From a security perspective, letting a POST request invoke an executable that resides outside the domain of the Internet server that is making the request isn't desirable. So, when the FrontPage client sends a POST request to the Internet server, the URL of the CGI program the client is requesting is local to that Web site. This process preserves security in the Web server. Therefore, each Web site needs to have separate server extensions, Web applications, and CGI programs and scripts.

How Server Extensions Work
To save space on the hard disk, rather than create multiple copies of the server extension executable files in every Web site, FrontPage installs stub copies of the server extensions in each FrontPage Web site. (A stub is a tiny executable program that calls another larger program. In this case, the stub calls the FrontPage Server Extensions program that resides in a single directory in the Microsoft SharedWeb Server Extensions directories on the HTTP server machine. The stub versions reside in the _vti_* directories of each FrontPage Web site and sub-Web. This approach saves a lot of space on the hard disk without compromising the Web sites' autonomy or server security.

The FrontPage Server Extensions stub directories and the other private directories that FrontPage uses to store the Web site information all start with an underscore (_). Authors don't manipulate the content of these directories directly; FrontPage uses them for private information about the site. (You can see these directories in the Microsoft Management Console—MMC—under the FrontPage Web site and in the FrontPage client when you select the View hidden directories check box on the View, Web Settings, Advanced tab.) FrontPage also keeps the following information in these private FrontPage directories (i.e., the directories that start with an underscore) in each Web site:

The FrontPage Server Extensions install automatically on a sub-Web when a FrontPage administrator creates it, but an NT administrator must install the FrontPage Server Extensions on the server.

Administrative Tools
FrontPage 98 and FrontPage 2000 offer many administrative interfaces. Both versions have a command-line version and an HTML interface. As Screen 1 shows, FrontPage 98 uses the FrontPage Server Administrator to administer individual FrontPage Web sites. To find the Administrator, click Start, Programs, Windows NT 4.0 Option Pack, Microsoft Internet Information Server, FrontPage Server Administrator. FrontPage 2000 replaces FrontPage Administrator with a snap-in for the MMC.

When I use the FrontPage client to open Web sites or sub-Webs, I can create new sub-Webs under an existing Web domain (also called a virtual server), set role-based permissions on the site, create content, and browse the Web. I can also select users and groups who can browse the site. (The logon window appears automatically, but these users must already have an account on the server's NT domain.) Only the NT server administrator can add new users to the NT domain, which is a shortcoming of this system: Large members-only sites probably don't want to use the FrontPage browse permissions. I use Microsoft Site Server to handle authentication on my members-only sites, but the authors publish their content using the FrontPage Server Extensions.

What's New in FrontPage 2000
The FrontPage 2000 Server Extensions are fully backward compatible: They do everything the FrontPage 98 Server Extensions do. All existing Web sites continue to function as before.

FrontPage 2000 has several new administrative functions. In addition to the server extensions upgrade, check and fix, and authoring controls, you can perform the following tasks from the MMC:

The new FrontPage 2000 UI combines the FrontPage Explorer (i.e., for content management) with the FrontPage Editor to create one uniform desktop that performs all tasks. In FrontPage 98, there were some awkward moments when content authors couldn't find the function they wanted because they were in the wrong tool (e.g., putting a short name on a page in Navigation view in FrontPage Explorer to get it to show up on a navigation bar in the Editor).

Web content authors get easy-to-use, no-programming-required database capabilities. Using the Database Connection Wizard, they can connect to a text file database, a Microsoft Access database, or a system (e.g., Data Source Name—DSN) database and send submitted forms directly to that database. The wizard makes binding the form fields to the database table fields a snap. You can use the Database Results Wizard to set up pages that retrieve and display the contents of a database in table, list, or drop-down form.

Of course, you can create custom Microsoft SQL Server databases and even send parameters and field values in your queries. Previously, you needed to use a tool such as Visual InterDev to interact with databases. Now, FrontPage uses wizards to walk content authors through the process of creating or linking to a database and binding the form fields to table columns in just a few minutes.

Finding the Server Extensions
The FrontPage Server Extensions are available from a variety of sources. Here are some of the places where you can obtain them:

FrontPage 98 Server Extensions. You can find the FrontPage98 Server Extensions in the following places:

You can get the answers to your questions about the FrontPage 98 Server Extensions by browsing the Microsoft FrontPage 98 Resource Kit at http://officeupdate.microsoft.com/frontpage/wpp/serk98. The downloads are at http://msdn.microsoft.com/workshop/ languages/fp/98exts/license.asp. If you decide to go with the FrontPage 98 Server Extensions, download the 98b patch, too. You can obtain the details about what's in the patch and download it from http://officeupdate.microsoft.com/ downloaddetails/fp98bupd.htm.

FrontPage 2000 Server Extensions. You can find the FrontPage 2000 Server Extensions in two places:

The server extensions available in Office 2000 Premium are in the Office Server Extensions (OSE) on CD-ROM number 3. To install the OSE, select Install the Office Extensions from the Autorun menu. The difference between the FrontPage Server Extensions and the OSE is important: The OSE use the FrontPage Server Extensions as a foundation, then add collaboration features such as Web discussions, subscriptions, and notification to the basic FrontPage Web administration and management features.

The OSE are primarily for intranet applications. The FrontPage Server Extensions work on the intranet, the Internet, and a variety of OSs and Internet servers (other than IIS). The Office 2000 Server Extensions rely on Microsoft Data Engine (MSDE), OLE DB, and Active Server Pages (ASP) technologies, so they only work on IIS. The OSE also leverage functionality found only in IE 5.0 and other Office 2000 products (e.g., Access).

Migrating to FrontPage 2000 Server Extensions
I've been testing the FrontPage 2000 client against the FrontPage 98 Server Extensions for about 4 months. Everything has worked smoothly. Existing sites worked as usual when I published the FrontPage 2000 client-generated content. One problem I encountered occurs when Front-Page 98 authors and FrontPage 2000 authors work on the same site. FrontPage 2000 navigation bars have a new option that creates links to the Child pages under the Home page in the FrontPage navigation structure. This option is great, but FrontPage 98 doesn't support it. Some strange things happened to the site navigation bar, depending on which author had most recently updated the Web site. I also had trouble with the navigation view. Sites created in FrontPage 98 lost their navigation structure when someone opened them in FrontPage 2000, which could be a problem if the site had a lot of content. The solution was for everyone to use the same version of FrontPage—everyone opted to upgrade to FrontPage 2000.

Upgrading to FrontPage 2000 Server Extensions
Installing the FrontPage 98 Server Extensions is fast and painless. If you're running IIS 4.0 and the Option Pack, you already have them on the server, even if you aren't using them. If you want to install the FrontPage 2000 Server Extensions, you must first install the Option Pack—so you'll have the FrontPage 98 Server Extensions anyway.

The FrontPage 2000 Server Extensions install and update in two steps:

When I upgraded from the FrontPage 98 Server Extensions to the FrontPage 2000 Server Extensions on my development server, I simply ran the fpse2k_x86_eng.exe program that I had downloaded from the Web site. I followed the wizard, gave it my initials, and accepted the license agreement and the default directory for server extensions. The program copied files and updated Web sites for quite a while, then asked to restart the server. When the server came back up, the setup program finished the installation. A message appeared recommending that I install the server extensions on my Web servers.

To update the server extensions, run the Internet Service Manager (ISM) from Start, Programs, Windows NT 4.0 Option Pack, Internet Information Server, Internet Service Manager, which will bring up the MMC with the IIS snap-in. Right-click the server machine name, and choose Upgrade Extensions from the Task menu. Updating all the FrontPage Web sites in the virtual server can take a while depending on how many Web sites are on it. Save the MMC console settings. The upgrade process upgrades all the sub-Webs under the selected virtual server. If you have multiple virtual servers defined in your server machine, you'll need to repeat this process for each one. If you haven't upgraded the server extensions on a Web site, you'll see a message on the Server Extensions tab in the Properties window of the Web site telling you that you need to upgrade the server extensions on the Web site.

The FrontPage 2000 upgrade process preserves all existing role-based permissions. The process also downgrades browse-only access permissions of any group (on the server) that contains the IUSR_computername Anonymous account. The FrontPage 98 Server Extensions are more liberal with permissions, regularly assigning many roles to the Everyone group.

If you access the FrontPage Server Administrator (fpsrvwin.exe) from the Start menu (Start, Programs, Windows NT 4.0 Option Pack, Microsoft Internet Information Server, FrontPage Server Administrator) after you install the FrontPage 2000 Server Extensions, you'll receive a message telling you that a newer version of the server extensions exists on the machine. From now on, you'll use the FrontPage snap-in in the MMC to configure the extensions and to perform the administrative functions that come with FrontPage 2000.

The FrontPage Server Extensions snap-in shows up as a new tab on the Properties sheet both for the server machine, as Screen 2, page 5, shows, and for the virtual Web sites, as Screen 3 shows.

Testing the New Server Extensions
Because every version of FrontPage Server Extensions is backward compatible, older Web sites won't notice any difference when you upgrade to the new extensions. My customers who use the FrontPage 98 client haven't noticed any difference in the performance of their Web sites, their navigation bars, their themes, Web content, forms, forums, or search pages. The new FrontPage 2000 forms that submit their content directly to the database are a real hit; users can easily make pages that let them retrieve information from the database.

FrontPage 98 Explorer also has some new features (e.g., new values in the FrontPage Web Settings Parameters tab). And the Permissions window under Tools now has a Computers tab in addition to the Settings, Users, and Groups tabs.

Web content authors who are using FrontPage 2000 are delighted at the pages they can create. The FrontPage 98 Server Extensions gave me fewer customer crises; the FrontPage 2000 Server Extensions promise to make me a very popular Web diva.