Hello,

I am really new to DNN, and I have a need to expose some basic functions in DNN through a web services.  I need to be able to add users, and retrieve data from specific modules and data tables.  The process of retrieving data is not a problem, but I can't find my way in creating a procedure in a service.asmx file that allows me to make a call to it, send it the basic info necessary in creating a user, and have it work.  I always get an exception.  I would really appreciate any help; I am on a time crunch.

Thank you all in advance.

Also,

If you're using a web service to create user information; be sure to secure it somehow, my favorite method is to skip securing it at the systems end by just encrypting the properties i send them.  This is the class I use; i converted one I found on the web in C# into VB and changed it a little so that it wasn't throwing errors when the string expired but instead said so in a property (throwing an error is more resource intensive).

The only security issue that would still remain would be "repeat submissions"...  In otherwords because there is no authentication happening; someone could sniff the text and send exactly the same string back.  The query string expiring helps all but immeadiate injection attacks...  my intention is also to create users - so i'm not concerned because a second submission of exactly the same values would just fail.

Imports System

Imports system.Collections.Specialized

Imports System.Security.Cryptography

Imports System.Text

Imports System.Web

Namespace RealSkydiving.SingleSignOn

Public Class SecureQueryString : Inherits NameValueCollection

Public ReadOnly Property IsExpired() As Boolean

Get

Return _isExpired

End Get

End Property

Public Property ExpireTime() As DateTime

Get

Return _expireTime

End Get

Set(ByVal value As DateTime)

End Set

End Property

Public ReadOnly Property EncryptedString() As String

Get

If IsExpired Then

Return ""

Else

Return HttpUtility.UrlEncode(encrypt(serialize))

End If

End Get

End Property

Public Sub New()

MyBase.New()

End Sub

Public Sub New(ByVal encryptedString)

End Sub

Public Overrides Function ToString() As String

Return EncryptedString

End Function

Private Const cryptoKey As String = "changethisinyourcode"

Private timeStampKey As String = "__TimeStamp__"

Private ReadOnly IV As Byte() = {240, 3, 45, 29, 0, 76, 173, 59}

Private _expireTime As DateTime = DateTime.MaxValue

Private _isExpired As Boolean

Private Function encrypt(ByVal serializedQueryString) As String

Dim buffer As Byte() = Encoding.ASCII.GetBytes(serializedQueryString)

Dim des As New TripleDESCryptoServiceProvider

Dim md5 As New MD5CryptoServiceProvider

Return Convert.ToBase64String(des.CreateEncryptor.TransformFinalBlock(buffer, 0, buffer.Length))

End Function

Private Function decrypt(ByVal encryptedQueryString) As String

Try

Dim buffer As Byte() = Convert.FromBase64String(encryptedQueryString)

Dim des As New TripleDESCryptoServiceProvider

Dim md5 As New MD5CryptoServiceProvider

Return Encoding.ASCII.GetString(des.CreateDecryptor.TransformFinalBlock(buffer, 0, buffer.Length))

Catch ex As CryptographicException

Throw New Exception("InvalidQueryStringException", ex)

Catch ex As FormatException

Throw New Exception("InvalidQueryStringException", ex)

Catch ex As Exception

Throw ex

End Try

End Function

Private Sub deserialize(ByVal decryptedQueryString As String)

Dim nameValuePairs As String() = decryptedQueryString.Split("&")

For i As Integer = 0 To nameValuePairs.Length - 1

Dim nameValue As String() = nameValuePairs(i).Split("=")

If nameValue.Length = 2 Then

MyBase.Add(nameValue(0), nameValue(1))

End If

Next

If MyBase.Item(timeStampKey) IsNot Nothing Then

_expireTime = DateTime.Parse(MyBase.Item(timeStampKey))

End If

End Sub

Private Function serialize() As String

Dim sb As New StringBuilder

For Each key As String In MyBase.AllKeys

sb.Append(key & "=" & MyBase.Item(key) & "&")

Next

'append timestamp

sb.Append(timeStampKey & "=" & _expireTime)

Return sb.ToString

End Function

End Class

End Namespace