| AJS 4.x
Manual | Note! This Manual is for the "Windows authentication" version, which is designed to work with existing Windows server or Active Directory accounts and Windows authentication. If you want to create accounts by yourself and store their credentials in your own HTTP Commander XML database, you need to download the "Forms authentication" version! This Manual is for the Windows authentication version only! | Web file manager Free Installation assistance Manual Home page

HTTP Commander common FAQ

- How can I update my existing installation with the latest version without losing config and settings?
- I got a "Request for the permission of type 'System.Web.AspNetHostingPermission... error
- I can't install the application. Is there anybody why can help me?
- How can I restart the application?
- How can I change the logo or top header?
- How to branding of e-mail for sending public links?
- How does HTTP Commander control user's count?
- How can I use HTTP Commander with SSL?
- Can the first loading process be faster?
- Can I make the application faster (increase performance)?
- Loading of folders/files list is very slow (specially for a network folder) and takes several seconds.
- If I map a folder I get the error "The folder you entered does not appear to be valid..."?
- I got an "Access to path '...' is denied" error.
- I got The page cannot be found error (error 404) when I open http://localhost/HTCOMNET/default.aspx or any other page.
- I see the page with ASP.NET tags at the top e.g. "<%@ Page Language="C#" %>".
- I got a "Required permissions cannot be acquired" error.
- I got a "Request for the permission of type 'System.Security.Permissions... error.
- I got a "Internet Explorer cannot download Download.ashx from [domainname]" error while a file was being downloaded.
- I got a "Server Application Unavailable" error.
- I got the Error "500.19" at web.config file ("modules" section).
- I've opened "Silverlight" file uploader tab but the window is empty.
- Does HTTP Commander support Web garden or Web farm?
- Is HTTP Commander supports file solutions like DFS folders, UNC folders, ABE, NAS?
- How Can I configure documents management features like Google docs, MS Office and OpenOffice online edit?
- Can I pass some settings in URL?
- How can I add Static Content Role service at IIS7?
- When I am authenticated for "Download/Upload from/to Google", I got the "The site "http://yourdomainname.com" has not been registered." error.
- How do I protect configuration files (prevent them to be retrieved by users)?
- Can I use SSO?
- When I become authorized in Microsoft OneDrive I receive the "'evt_Login_onload' is undefined" error.
- The Default.aspx page is incorrectly displayed.
- I got the Error HTTP 403.18 - Forbidden when open files from Images/resources_1.5 folder.
- I got the error The parameter is incorrect when open file list
- Why Microsoft Office still opens my document (View / Edit → Edit in MS Office) as read-only?
- Error on download/upload with Dropbox or Box: Could not load file or assembly 'Newtonsoft.Json, Version=7.0.0.0...
- How to disable WebDav feature?
- Page reloaded when file list is scrolled up in Chrome browser on Android.

Windows authentication version related questions

- How can I hide files/folders that the user does not have rights to read?
- How can I create a "dropbox" for users (student can upload their own files but can't view other students files)?
- Every time I insert my login and password in the authentication window I get a "You are not authorized" error.
- Why would I need to use Basic authentication instead of Windows?
- May I use network folders with Windows Integrated Authentication?
- I can't create access for a group or to a home folder.
- Can I setup access only for single OU (Organisational Unit) of domain?
- Can I use application in DMZ and what ports for firewall should I open?
- Loading of folders tree is very slow and needs a few seconds.
- Can I use Forms authentication (Form at the web page) instead of standard browser popup authentication window?
- How do I clear windows authentication on Log out?
- After changing my username in Active Directory/WinNT I can still login to HTTP Commander, but then I don't see any of the folders.
- When opening - request of authorization occurs 2 (or more time) and after login form for Forms version opens.
- How can I display some text when user logs into Http Commander (at the time when popup login window appears)?

How can I update my existing installation with the latest version without losing config and settings?
Answer: Please refer to the Upgrade section of documentation.
I got a "Request for the permission of type 'System.Web.AspNetHostingPermission... error
Answer: Problem related to latest Windows 2008 security. You need to unblock HTTPCommanderAJSx.x.x.zip (Distribution archive) file because it came from another PC (Internet) and then extract it to HTCOMNET folder again. Restart the application after this (Close w3we.exe process). See Installation section how to unblock files.
I can't install the application. Is there anybody why can help me?

Answer: You can run diagnostics and look for known problems. If you can't run the application or configure folders, we offer free installation assistance for both trial and commercial licenses. You can get help via email, instant messenger or via remote access to your server. You only need a few minutes to get online help.

How can I restart the application?

Answer: To restart the application, click the "Restart" button in the Admin panel. Also to restart the application, you can make some changes in the Web.config file (e.g. add a spacer in any comment). The Application will restart automatically.
For full application restart (only if you have some system errors!):

- Stop all w3w.exe processes;
- Delete C:\WINDOWS\Microsoft.NET\Framework\[.NET version]\Temporary ASP.NET Files\HTCOMNET folder.

How can I change the logo or top header?

Answer: You can add a logo to the toolbar or to the top panel (at the top of file manager window)
Click here to read more about setting your logo.

How to branding of e-mail for sending public links?

Answer: see Branding manual.

How does HTTP Commander control user's count?

Answer: HTTP Commander controls user session count and unique user's names. A new session is created for every visitor. Each user can have a few sessions if he doesn't clicked logout button. But after 1 hour, the session is closed automatically. To terminate existing sessions by yourself, you need to restart the application.

How can I use HTTP Commander with SSL?

Answer: HTTP Commander works both with http and https protocols. http protocol works out of box. To enable https protocol, you need to install an SSL certificate on IIS. The instructions below describe how to order a certificate from a globally recognized certificate authority (recommended option) and how to create a self-signed certificate.

A self-signed certificate will allow you to use the https protocol, but the web browser will warn that the certificate is not valid since it comes from an unknown authority. To get a certificate that passes verification, you need to either order a certificate at a globally recognized certificate authority, or establish a trusted authority inside your corporate network.

Order certificate at a globally recognized certificate authority

As an example we consider ordering a certificate at Thawte. You may choose any other authority you trust.

- Select a certificate for your web site: SSL certificates.
- Generate a Certificate Signing Request as described in Key and CSR Generation Instructions. You'll need it later.
- Click the Buy button to order the chosen certificate. You'll fill out a number of web forms in the process. At one step you'll have to specify the Certificate Signing Request.
- Track the status of the certificate in Thawte Certificate Center.
- Install the SSL certificate according to Thawte manual.
- Backup the certificate (optional).

Install Self-Signed certificate

- For IIS 5, 6
  - Download the Microsoft IIS resource kit (supports IIS 5,6) at http://www.microsoft.com/downloads/details.aspx?FamilyID=56FC92EE-A71A-4C73-B628-ADE629C89499&displaylang=en.
  - Install the IIS resource kit on the server.
  - Run Start-> Programs-> IIS Resources-> Self SSL-> SelfSSL
  - See the instructions about how to run the command to create your own SSL.
    Run the command: selfssl.exe /N:CN=DOMAINNAME /K:1024 /V:7 /S:1 /P:443
  - Now you can open https://localhost/HTCOMNET/ in a browser.
  - To disabled non-SSL connections, open IIS manager, expand the web site tree, right-click the HTCOMNET application, select "Properties", open Directory Security tab, click "Edit...", check "Require secure channel (SSL)".
- For IIS 7 and above
  - Open IIS manager, select the server node in the connections tree
  - Open the Server Certificates feature
  - On the actions pane click the "Create Self-Signed Certificate" link
  - Specify a friendly name of the certificate in the opened dialog box. That may be any name. Click OK button.
  - The certificated is created, you should see it in the Server Certificates list.
  - Select the web site that contains HTTP Commander in the connection tree
  - Click the Bindings link on the actions pane
  - In the Site Bindings dialog click the Add button.
  - Select https protocol in the type box in the "Add Site Binding" dialog box
  - Select the SSL certificate you created earlier in the "SSL certificate" box
  - Change any other settings in the dialog box, if changes are needed, click the OK button.
  - Click the Close button to close the Site Bindings dialog.
  - You're done now, you can use the https protocol to connect to HTTP Commander.

A self-signed certificate is untrusted by definition. The web browser will warn you about the problem when you try to open a web site with untrusted certificate.

Screenshot

WebDAV over https with invalid certificate works unreliably. While web browser will warn you about the problem and allow you to proceed, WebDAV may refuse to connect to the web folder with a misleading error message. You may circumvent the problem by installing self-signed certificate into the trusted authorities container on the client machine.

Install untrusted certificate into trusted authorities container

1. Open Internet Explorer with administrative rights

2. Open target site using https

   Screenshot

3. Confirm that you want to proceed in spite of the security problem.

   Screenshot

4. Click "Certificate Error" Security report on the address bar, then click the "View certificates" link in the pop-up window.

   Screenshot

5. Click the "Install Certificate" button in the certificate properties window.

   Screenshot

6. Click "Next" in the Certificate Import Wizard. On the next step, "Certificate Store", select "Place all certificates in the following store", in the "Certificate store" field select "Trusted Root Certification Authorities". Click "Next".

   Screenshot

7. Click Finish to close the Certificate Import Wizard.

8. Click "Yes" in the security warning dialog box.

   Screenshot

Can the first loading process be faster?
Answer: The HTTP Commander has AJAX and 100% Java Script interface so it works rather quickly like a local application. When a visitor logons the HTTP Commander for the first time, it takes some time to load *.js, *.css and *.svg (image/svg+xml mime type) files. Such files are stored in a browser cache for some months, so the next logons will be much quicker.
Starting from version 4.0 Http Commander have caching enabled by default for /Images, /Scripts folders and for styles.css. styles-min.css files. Max-Age used to control caching of these resources and it set to 365 days by default.
Caching is not enabled for whole application to prevent caching of downloaded files.
If you want to disable caching, you need to find and remove following sections from web.config file : <staticContent> <clientCache cacheControlMode="UseMaxAge" cacheControlMaxAge="365.00:00:00" /> </staticContent> <caching enabled="true" enableKernelCache="true"> <profiles> <clear /> </profiles> </caching>
Please note, that profiles of caching section is cleared to make IIS correctly send Cache-Control header in response. If this section is not cleared, IIS still adding no-cache attribute to Cache-Control header.
You can make even the first loading process faster if you enable gzip compression in the IIS settings. With gzip enabled, the loading is 4-5 times faster. You need to enable gzip for static and dynamic content (*.js, *.css and *.svg (image/svg+xml mime type) files). See article how to enable compression in IIS 7 (Win 2008) or for IIS 6 (Win 2003).
Download the trial HTTP Sniffer to test if the compression works successfully.
Screenshots for IIS 7, 8

Can I make the application faster (increase performance)?
Answer: Yes. There are a few things that can help you make the application faster. You can do all or just some of them:

- It is recommended to enable gzip compression
- You can setup content expiration for the Images\ folder so images will be loaded for the user once and requests "if-modified" will not be sent again during the next logon. This can increase performance in some cases because application uses many images. To setup content expiration: For IIS 7, 8: expand the HTCOMNET\Images\ folder, then in the right panel open "HTTP Response Headers". Choose action "Set common Headers..." and set content expiration on 2020 year (for nearest 10 years). For IIS 6: open HTCOMNET\Images\ folder settings at IIS, open "HTTP Headers" tab and set "Expire on" 2020 year (for nearest 10 years).
- You can disable the tree view or make it not auto collapsible. This makes the application faster because no requests for tree updates are needed. To disable tree set the "HideTree" parameter in the Application settings to "false" or set the parameter "TreeView" value to "NotAutoExpandable".
- Don't use a lot of columns for the files grid at "DisplayedDefaultColumnsInList" parameter of Application settings. Rendering files grid takes some time at the users side if there are many files in the folder.
- Note! Don't test application performance with Internet Explorer 8. This version works ineffectively with java scripts and HTML objects. More popular browsers like FireFox, Chrome, IE 9 are a few times faster.

Loading of folders/files list is very slow (specially for a network folder) and takes several seconds.
It could be related to usage of NTFS alternate streams by HTTP Commander to store/read custom metadata on files and folders.
They used to store such information as Labels, Comments, File history, downloads counting and custom details fields.
By default HTTP Commander configured to display in file list some information stored in metadata for each file, e.q. existance of comments or other metadata and labels. If you do not plan to use mentioned functionalities feel free to disable them by configuring following parameters:

- DisplayedDefaultColumnsInList - Remove "downloads" and other custom fields (like comments, description) which are stored in metadata from the list of available columns in file list. By default they are not included.
- EnableFilesFoldersLabels - Set the value to false.
- ShowFileMarkWhenExistsDetails - Set the value to false.

Configuring these parameters is enough to disable load of metadata for each file during load of file list for folder, which may significantly speed up loading for network folders.
While you still will be able to see downloads count (if download counting is enabled), comments, description and other custom metadata fields in file properties window and in file details panel.
If I map a folder I get the error "The folder you entered does not appear to be valid..."?
Answer: First, try to map folder "https://demo.element-it.com/examples/demowindows/hcwebdav" (without quotes). If it doesn't show the error and asks for credentials then it works (You can use demo/demo credentials). If mapping demo folder works but it doesn't map your application link, then the problem is with the application or WebDAV configuration. Check web folders mapping setup or contact us.
You cannot map folders in Server OS like Windows 2003, 2008 or 2012 by default. So, please test mapping from a non-server PC. If you want to map to Server OS then you need to do some steps:

- For Server 2008, 2012, 2016: Click Start->Administration Tools->ServerManager->Features->Add Features-> check 'Desktop Experience' and click 'Install' button
  Screenshots

- For Server 2003: Start "WebClient" service at Administration Tools->Services and change Startup type to Automatic.

I got an "Access to path '...' is denied" error.
Answer: The problem is related to the NTFS permissions. Check the NTFS permissions for HTCOMNET, data and your main content folders. See the NTFS Permissions section of the Documentation.
I got The page cannot be found error (error 404) when I open http://localhost/HTCOMNET/default.aspx or any other page.
Answer: If you are sure that the path http://localhost/HTCOMNET/default.aspx exists but you are still getting the error, it means that the IIS doesn't execute ASP.NET code.
Reasons:
1. You should allow ASP.NET 2.0 or 4.0 running in Web service extension list. See "Application Install" section of the Documentation.
2. This problem occurs if your IIS was installed after the .NET framework installation. Reinstall the .NET framework or execute the following command as administrator:

On a 32-bit system:

    %windir%\Microsoft.NET\Framework\v4.0.21006\aspnet_regiis.exe -i

On a 64-bit system:

    %windir%\Microsoft.NET\Framework64\v4.0.30319\aspnet_regiis.exe -i

I see the page with ASP.NET tags at the top e.g. "<%@ Page Language="C#" %>".
Answer: ASP.NET has not started on the server and you have opened pages like clear HTML. See the "Application Install" section.
I got a "Required permissions cannot be acquired" error.
I got a "Request for the permission of type 'System.Security.Permissions... error.
Answer: Both errors can be related to "Full trust" level. Check if "Full trust" is enabled for HTCOMNET application. For windows 2008, 2012, 2016 see the "Application Install" section.
For windows 2003 open the file C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\CONFIG\web.config and add the code below, save the file.
<location allowoverride="true" path="Default Web Site/htcomnet"> <system.web> <trust level="Full" originurl="" /> </system.web> </location>
Also, check the permissions for "NETWORK SERVICE" or "IIS APPPOOL\DefaultAppPool" user on the HTCOMNET folder as well. See the NTFS permissions section.
I got a "Internet Explorer cannot download Download.ashx from [domainname]" error while a file was being downloaded.
Answer: If you are using SSL, check Internet Explorer settings: Tools-> Internet Options-> Advanced-> Security-> uncheck "Do not save encrypted pages to disk". By default this option is unchecked. If the option is checked, the files cannot be saved from any SSL website.
I got a "Server Application Unavailable" error.
Answer: There are two reasons for such error:

1. The problem can appear because ASP.NET 2.0 and ASP.NET 1.1 applications are being used by the same pool. Check all your applications in IIS and set one application pool for the applications running under ASP.NET 2.0 and another pool for applications running under ASP.NET 1.1.
2. There are not enough NTFS permissions to HTCOMNET folder. See the NTFS permissions section of the Documentation.
3. There can also be some other reasons. You can try to restart the application.

I got the Error "500.19" at web.config file ("modules" section).
Answer: This error can occur if you are using IIS 7 or 8 and you have disabled some features of web.config to delegate. In most cases it occurs with the "modules" feature. You should open IIS, click the server root in the left tree. At the right panel, open "Feature Delegation", then Select "Modules" and change its delegation type to "Read/Write". If you have the error with other features, then set the delegation type for the other features.
Screenshot

I've opened "Silverlight" file uploader tab but the window is empty.
Answer:

- If you are running IIS 6 (windows 2003), you need to check if MIME type is added for Silverlight .xap files in IIS. See Application install in IIS 6 section.
- If you see the Silverlight installation button or a dialog window, and nothing is happening after Silverlight is installed, click F5 to refresh a browser.

Does HTTP Commander support Web garden or Web farm?
Answer: No. HTTP Commander is running but does not work correctly if you have web garden or web farm enabled in IIS. Check if you have enabled web garden in the application pool settings and disable it or create a new pool for HTTP Commander. You should use only one worker process for the application.
Is HTTP Commander supports file solutions like DFS folders, UNC folders, ABE, NAS?
Answer: Yes, it supports DFS, UNC, ABE, NAS and most other file related Windows Server technologies. First you would set up the folder in the Admin panel. Then type the path to the DFS folder like \\domain\foldername or UNC like \\servername\share\folder. If you set up UNC remote folder at the remote server or your DFS folders stores folders at remote servers then check if Basic authentication is enabled in IIS settings, not Windows integrated (For Domain network it is possible to use Windows Integrated authentication : May I use network folders with Windows Integrated Authentication?)! See why Basic authentication should be used.
For Domain network it is possible to use Windows Integrated authentication : May I use network folders with Windows Integrated Authentication? For ABE see more info here.
How Can I configure documents management features like Google docs, MS Office and OpenOffice online edit?
Answer: All info related to documents management features is described in the Application settings section.
Can I pass some settings in URL?
Answer: Yes, you can pass some settings in the URL:

- Use "Default.aspx?Language=English" to pass default language.
- Use "Default.aspx?folder=foldername" to open a specific folder first.
- Use "Default.aspx?file=path/to/file" to open a folder with the file and highlights it.
- Use "Default.aspx?isEmbeddedtoIFRAME=true" to show interface for iframe mode (with small icons).
- Use "Default.aspx?hideTree=true" to hide (or show by default if value is "false") tree panel with folders on left side (see HideTree parameter).
- Use "Default.aspx?TreeView=disabled", "Default.aspx?TreeView=enabled" or "Default.aspx?TreeView=notautoexpandable" to change view of tree panel with folders on left side (see TreeView parameter).
- Use "Default.aspx?defaultGridView=thumbnails" or "Default.aspx?defaultGridView=detailed" to show file list in thumnails or detailed mode
- Use "Default.aspx?Mobile=" to show the mobile interface (Smartphones) by default.
- Use "Default.aspx?Standard=" to show the standard interface (non Mobile) by default.

How can I add Static Content Role service at IIS7?
Answer:
To add Static Content role go to
Start -> Administrative Tools -> Server Manager -> Roles.
Find in the right list the Web Server (IIS) role and click the Add Role Services link.
In the new window check Static Content, and then click Next and then Install button.
Screenshots

When I am authenticated for "Download/Upload from/to Google", I got the "The site "http://yourdomainname.com" has not been registered." error.
Answer:
Open your account management page at Google where the yourdomainname.com domain is registered and on the MangeDomain page, specify your domain in the Target URL Path prefix field.
Screenshots

How do I protect configuration files (prevent them to be retrieved by users)?

Answer: HTTP Commander stores configuration data on the server in a number of files. For security reasons, it is recommended to prevent users from retrieving them, since they expose sensitive information about the application. Configuration files are: web.config, HttpCommanderSettings.config, .xml file in the Data folder. web.config, HttpCommanderSettings.config files are protected by default. .xml files in Data folder are protected via the following section in web.config file (in case of trouble make sure these settings are present in the configuration file).

    	<location path="Data">
    		<system.web>
    			<httpHandlers>
    				<add path="*.xml" verb="*" type="System.Web.HttpForbiddenHandler"/>
    			</httpHandlers>
    		</system.web>
    		<system.webServer>
    			<!-- Setting only for IIS 7 and 7.5 -->
    			<security>
    				<requestFiltering>
    					<fileExtensions>
    						<add fileExtension=".xml" allowed="false" />
    					</fileExtensions>
    				</requestFiltering>
    			</security>
    		</system.webServer>
    	</location>

In IIS 7 and above, configuration is restricted to web.config file. For IIS 5, 6 you need to proceed one step further to complete the setup. Map the .xml file name extension to ASP.NET as described in KB815152, Edit Script Mappings in Internet Services Manager section. Apply the setting to the HTTP Commander virtual directory.

To test the settings, try to download the configuration files with a browser (http://server/HttpCommander/Data/Accounts.xml). You should see

Screenshots
IIS 6 response

IIS 7 response

Can I use SSO?

HTTP Commander includes examples of Single Sign-On (SSO) both for Basic authentication and authentication via Form (for Active Directory users).

Summary

- HTTP Commander with Windows authentication (Windows or Basic authentication in IIS, and ASP.NET impersonation is turned on)
  You may delegate authentication to the application by means of asynchronous HEAD request to Default.aspx page. The request should possess valid credentials.
- HTTP Commander with Forms authentication (Anonymous and Forms authentication in IIS). The application may use its' own account database (Accounts.xml file in Data directory) — Forms authentication mode or use windows accounts — "Forms with Windows users" authentication mode.
  There are two options to delegate authentication to HTTP Commander.
  - Pass the user name and password to the Default.aspx page in query string or in POST request. For example, HttpCommander/Default.aspx?username=User1&password=Passw*rd.
  - Forms authentication across applications
- Shibboleth authentication. HTTP Commander delegates authentication to Shibboleth. See Shibboleth integration for more details.

Details

In all cases except Forms authentication across applications, you should have valid credentials to authenticate in HTTP Commander. Thus SSO topic breaks up into two subtopics: obtaining credentials and authenticating in the Web file manager.

- Basic authentication on the other site: If you have a web site configured for Basic authentication, then you can pass these credentials to HTTP Commander so users will be authenticated in it as well. To authenticate in HTTP Commander, you need to send an AJAX request with credentials to the application. HTTP Commander distribution archive includes an example page BasicLoginExample.html in the Manual folder.

  To enable SSO you need:

  - Add the HttpCommanderAuthModule module in IIS 7 or 8 to your main web site:
    - Copy the Manual\owa\module\HttpCommanderAuthModule.dll file to the Bin folder of your main site.
    - Open IIS Manager and navigate to the site. In Features View double-click Modules. On the Modules page, in the Actions pane, click Add Managed Module. In the Add Managed Module dialog box, in the Name box, type a name for the managed module, e.g. HttpCommanderAuthModule. In the Type box, enter exactly the following: HttpCommander.HttpCommanderAuthModule. Click OK. (Note. If you see warning as on the 2nd screenshot click "Yes")
      Screenshots

      Or you can add in the file web.config of site in the section system.webServer/modules a line
      <add name="HttpCommanderAuthModule" type="HttpCommander.HttpCommanderAuthModule" />.
      Screenshot

  - Open for editing the BasicLoginExample.html file. Copy its content to any page of your site where users will start HTTP Commander. File includes openHTTPCommander(URL) javascript function. Replace URL with correct HTTP Commander URL like 'http://yoursite/HTCOMNET/Default.aspx'.
  - Contact Element-IT technical support if you have troubles with this.

  Details — how it works

  Let's explore openHTTPCommander JavaScript function in BasicLoginExample.html file. First, it sends asynchronous HEAD request to the current web page, that is BasicLoginExample.html. We add an "r" parameter to the current page with random value. The request URL should look like this "BasicLoginExample.html?r=0.061323485323896254". The value of the parameter does not matter, it's needed to force the browser to send the request instead of returning a cached response. JavaScript sets a special "X-HttpCommander-Auth" header that is processed by the HttpCommanderAuthModule. When the module encounters the "X-HttpCommander-Auth" header in the request, it returns the user name and password of the logged in user with "X-HttpCommander-Auth" header to the client. JavaScript code reads the "X-HttpCommander-Auth" header from the response, gets the user name and password of the user logged into the web site. Using these credentials, JavaScript sends asynchronous an HEAD request to Default.aspx page of HTTP Commander. If the logged in user is allowed access to HTTP Commander, authentication procedure succeeds. Web browser opens HTTP Commander and log ins automatically.

- Forms authentication on the other site: If you have a login page where users type their name and password, then you can pass these credentials to HTTP Commander so users will be authenticated in it as well. To authenticate the user, you need to send an AJAX request with the credentials to the application. HTTP Commander has a working example page testSSO.html in the application root folder for user login via Form on page. You can look at the code of the page and move it to your login Form or contact us to get help.
  For testSSO.html page the only thing you need is to set anonymous authentication in IIS:

  - Copy and rename the file \testSSO.html (for example to login.html) into a directory of your site.
  - Configure anonymous access for this file. If you use ASP.NET, in IIS for this file enable only Anonymous Authentication, and also in the web.config file add in configuration section next section:

        <location path="your_new_name_for_testSSO.html">
            <system.web>
                <authorization>
                    <allow users="*" />
                </authorization>
            </system.web>
        </location>

    Screenshots

  - Open for editing the file testSSO.html. Find the line:
    onclick="openHttpCommander(
    and replace Default.aspx with URL of HTTP Commander (for example http://yourdomainname/HTCOMNET/). Save the file.
    Screenshots

  - Check if it works. Open in a browser the testSSO.html page from your site. Enter valid credentials and login. If everything was correct, then HTTP Commander will be opened.
    Screenshots

When I become authorized in Microsoft OneDrive I receive the "'evt_Login_onload' is undefined" error.
Answer: This error can arise in Internet Explorer. For its elimination add in "Trusted sites" (on Security tab in IE options) the following urls:
https://auth.gfx.ms
https://live.login.com
https://signup.live.com
The Default.aspx page is incorrectly displayed.
If Default.aspx page is displayed incorrectly, as on a screenshot below
Screenshot

please check the following:

- Whether it is allowed to display CSS in the browser
- Whether check there is an Images folder with nonblank contents, Styles-min.css file in directory with HTTP Commander and whether is to them access (NTFS rights)
- Open in browser Images/resources_1.5/css/ext-all-notheme.css url
  If you thus see Error HTTP 403.18 - Forbidden, then see FAQ I got the Error HTTP 403.18 - Forbidden...
- Open page in Chrome browser, press F12 and click on Console tab in Developer tools. Look, whether there are errors and what

I got the Error HTTP 403.18 - Forbidden when open files from Images/resources_1.5 folder
This error means that in IIS installed URLScan ISAPI Filter and it is configured so that not allowed URLs in which path there are folders having in the name of a dots (parameter AllowDotInPath=0).
For the solution of this problem see how to configure URLScan Tool below.
For IIS7 and later:
Check URLScan ISAPI filter settings in IIS if it is installed.

- Open IIS console: Control panel->Administrative tools ->
  Internet Information Services -> click on root -> find ISAPI filters
  Screenshot

- Double click on ISAPI Filters icon and in the opened list find the filter which name begins with UrlScan.
  If such filter it isn't found, UrlScan isn't installed, otherwise pass to the following step.
  Screenshot

- Pass into the folder with UrlScan executable file (by default, it is c:\Windows\system32\inetsrv\urlscan\) and open UrlScan.ini file for editing (for example in notepad).
- In UrlScan.ini file find parameter AllowDotInPath and if value of this parameter not equally 1, set for it value 1 (AllowDotInPath=1), save UrlScan.ini file and restart IIS.
  Screenshot

- For more info see How to configure URLScan Tool

For IIS6 :
Check URLScan ISAPI filter settings in IIS if it is installed.

- Open IIS console: Control panel->Administrative tools ->
  Internet Information Services (IIS) Manager -> expand root -> Right click on Web Sites folder ->
  select Properties -> click on ISAPI filters tab
  Screenshot

- In the opened list find the filter which name begins with UrlScan. If such filter it isn't found, UrlScan isn't installed, otherwise pass to the following step.
- Pass into the folder with UrlScan executable file (by default, it is c:\Windows\system32\inetsrv\urlscan\): select UrlScan filter in list, click Edit button and in the opened window see value of Executable field
  Screenshot

- Open UrlScan.ini file for editing (for example in notepad)
- In UrlScan.ini file find parameter AllowDotInPath and if value of this parameter not equally 1, set for it value 1 (AllowDotInPath=1), save UrlScan.ini file and restart IIS.
  Screenshot

- For more info see How to configure URLScan Tool

I got the error The parameter is incorrect when open file list
This error can arise when reading to the network folder if the site in IIS with HTTPCommander works at a 64-bit platform, and in settings of a pool indicated value True for the Enable 32-Bit Applications parameter.
Specify False value for the Enable 32-Bit Applications parameter in advanced settings of a pool and restart it
(Application Pools → htcomnetpool → Advanced Settings)
Screenshot

See about Wow64FsRedirection in FindFirstFile article.
Why Microsoft Office still opens my document (View / Edit → Edit in MS Office) as read-only?
First of all check settings of work with WebDav and read article Using MS Office and OpenOffice to work with documents.
Also check before opening of the document, having refreshed the file list, whether it is opened by other user (an icon The file is locked on the right):
Screenshot

Also check NTFS persmissions for a read-write for a pool of applications and the user who opens the file.
And in addition check the file for block (the Unblocked button in properties of the file) and if it is blocked, remove block (privileges of the administrator are necessary):
Screenshot

If the problem isn't fixed clear Microsoft Office WebDAV cache in registry on computer of user.
Microsoft Office reads WebDAV server options when connecting to server first time and stores them for later use.
The Microsoft Office WebDAV cache is stored under the key:
HKEY_CURRENT_USER\Software\Microsoft\Office\<version>\Common\Internet\Server Cache\
To clear cache just delete all keys under this key.
Also set OpenDocumentsReadWriteWhileBrowsing DWORD Value to 1 on a user machine under the key
HKEY_CURRENT_USER\Software\Microsoft\Office\<version>\Common\Internet.
Note! After change registry keys restart computer or WebClient service.
Error on download/upload with Dropbox or Box: Could not load file or assembly 'Newtonsoft.Json, Version=7.0.0.0...
Screenshot

Solution: in Web.config file replace Newtonsoft.Json assembly version 7.0.0.0 to 10.0.0.0. See Update from 3.2 and below.
How to disable WebDav feature
There are 2 ways to completely disable WebDav feature in HTTP Commander.

1. With settings on settings tab in Admin Panel.
   You will need to set to false the values of following parameters:
   - EnableMSOfficeEdit
   - EnableOpenOfficeEdit
   - EnableWebFoldersLinks
2. Edit web.config file of HTTP Commander and remove from modules section ( system.webserver -> modules and at system.web - > httpModules sections) following module:
   <add name="FileWebDavModule" type="HttpCommander.FileWebDAVServer.FileWebDavModule, FileWebDAVServer" precondition="integratedMode" />

Page reloaded when file list is scrolled up in Chrome browser on Android.
This issue is fixed in HTTP Commander 4.5 an later. Here are steps to fix this issue on version prior 4.5:

1. Open Default.aspx page in text editor .
2. Search for body tag
3. Append to body tag following code:
   `<% if(isMobileBrowser) { %> style="overflow-y: hidden;" <% } %>`
4. Result should look like this:
   `<body id="pageBody" class="<%= pageBodyStyle %>" onload="<%= Utils.GetSetTimeOutScript() %>" <% if(isMobileBrowser) { %> style="overflow-y: hidden;" <% } %>>`

How can I hide files/folders that the user does not have rights to read?
Answer: This feature is controlled by Windows Server. You need to use ABE (Access based enumerations) for share. For Windows 2003 go to Microsoft website and download ABE utility (small .exe file). Windows 2008, 2012 and 2016 have ABE installed. In both Windows 2003, 2008, 2012 and 2016 ABE is disabled by default. To enable it go to share properties and enabe ABE. In HTTP Commander you then create share. You should type your real share path like "\\servername\sharename". Don't use a full folder path like "c:\foldername" becouse ABE won't work in this case! After ABE is enabled, HTTP Commander will show only the files which user has rights to read and will not show other users files (if there are no read permissions).
How can I create a "dropbox" for users (student can upload their own files but can't view other students files)?
Answer: First, you need to create the folder on your server file system and configure users NTFS permissions. It is possible to configure the NTFS permissions for students to enable them to create or modify their own files and to disable reading other users files from this folder. You can also configure to enable teachers to view all files. So this folder will be as dropbox there students can upload their own works and teachers can view their works. For this folder it is recommended to enable ABE to hide files which the user does not have rights to read (other students files).
In HTTP Commander you can share this folder with students and teachers groups. You can disable some actions you don't want in right "permissions" window. HTTP Commander supports NTFS so users won't be able to modify or view other users files if it is disabled by NTFS. Also if ABE is enabled, then files which the user does not have rights to read will be hidden.
Every time I insert my login and password in the authentication window I get a "You are not authorized" error.
Answer:

- Check if the logon user has read NTFS permissions for the HTCOMNET folder. See NTFS permissions section of the Documentation.
- Try inserting the domain name prefix e.g. "domainname\username".
- For Basic authentication, check that you set the correct default domain name at Basic authentication settings at IIS. See "Application install" section of the Documentation.
- For Windows 2003 server, you need to be sure that you have opened the full URL with Default.aspx page in a browser i.e. http://localhost/HTCOMNET/Default.aspx. You can add "Default.aspx" page in default list in IIS.

Why would I need to use Basic authentication instead of Windows?
Answer:
You can use Windows Integrated authentication (our demo works under this auth.). But if you want to use Windows authentication, you will have some limitations:

- You can make access only to the local files stored on the same server (You can not use folders stored at remote servers).
  However if you web server is member of Domain, you can configure Delegation for correct work withNetwork Shares when Windows Integrated Authentication enabled.
- Dynamic user group membership detection won't work if the application is installed at a non domain controller (But you can make it work if you will use static file as AD info storage. See ADAccountsFilePath key).
  However it is still possible to get list of user groups from Windows auth token when Windows Integrated authentication used.
- On some Android-based devices browsers don't support Windows authentication but work great with Basic.

As conclusion : We recommend to use Windows Integrated Authentication when Web server is joined into Domain and delegation can be configured.
For standalone web server we recommend to use Basic auth if you plan to use Network Shares in HTTP Commander and Windows Intergated Authentication if all folders will be local to the web server. If you worry about sending password as a clear text while Basic authentication, you can use SSL.
May I use network folders with Windows Integrated Authentication?
Answer:
Yes, you can use Network folders with Windows Integrated authentication when Web server is member of Domain. But you will need to configure Delegation.
On the domain controller for your Web server’s domain, complete the following steps:

- Click Start, click Administrative Tools, and then click Active Directory Users and Computers.
- Expand domain, and then expand the Computers folder.
- In the right pane, right-click the computer name for the Web server, select Properties, and then click the Delegation tab.
- Click to select Trust this computer for delegation to specified services only.
- Ensure that Use Kerberos only is selected, and then click OK.
- Click the Add button. In the Add Services dialog box, click Users or Computers, and then browse to or type the name of the File server that is to be used in HTTP Commander. Click OK.
- In the Available Services list, select the CIFS service. Click OK.

It may take some time for new settings to take effect.
I can't create access for a group or to a home folder.
Answer: You need to check if the application reads groups correctly. You can see group list in Diagnostics.aspx page.
If the group list is empty in the diagnostics page or some error happens:

- Check if Basic authentication is enabled in IIS settings, not Windows integrated.
- Check permissions for a user to read its own membership info. See how to grant permissions at ReadWindowsUsersGroupMembership key description.

Can I setup access only for single OU (Organisational Unit) of domain?
Answer: Yes, you can. Set UseUniversalWayToReadGroups parameter in the Application settings to "false" and for LDAPContainer parameter value of LDAP path of needed OU (like "LDAP://OU=staff,DC=HOMEELEMENT-IT,DC=COM" ("staff" OU of "homeelement-it.com" domain). In such a case for the logon user, groups will be detected only from this OU (you can run Diagnostics.aspx to see groups list of logon user.)
Can I use application in DMZ and what ports for firewall should I open?
Answer: Yes, you can. You can install the application at the server in DMZ. Open HTTP(80) and HTTPS(443) ports. If you want to use Active Directory groups membership and home folder info then open LDAP port 389 and set UseUniversalWayToReadGroups parameter in the Application settings to "false" and for the LDAPContainer parameter, the value of the LDAP path to your domain controller.
Loading of folders tree is very slow and needs a few seconds.
Answer: It can be because of reading user group membership info and AD home folder. This needs some time because code connects to AD. You can disable this feature by ReadWindowsUsersGroupMembership parameter or play with UseUniversalWayToReadGroups and ldapContainer parameters at Application settings.
Can I use Forms authentication (Form at the web page) instead of standard browser popup authentication window?

Answer: yes. You have a number of options.

Solution 1. testSSO.html page

HTTP Commander distribution includes testSSO.html file for this purpose. You need to configure anonymous authentication for this page in IIS Manager:

Screenshots

Note! If you've renamed the testSSO.html file, then you need to modify file name in the corresponding section in web.config as well:

Note This solution only works in the Windows version of HTTP Commander. IIS authentication on the target web application (HTTP Commander) should be set to Basic or Windows.

Details - how testSSO.html works

testSSO.html page presents the user with an HTML form where they will enter their user name, password, and select the language of the HTTP Commander interface. After clicking on the Login button, JavaScript code sends an asynchronous HEAD request to Default.aspx page — the main page of the HTTP Commander application. JavaScript code authenticate in the Default.aspx page using the credentials supplied by the user. Note that Default.aspx page should be configured for Basic or Windows authentication, Forms authentication will not work here. If authentication succeeds, the web browser is redirected to the Default.aspx page. Since the browser already authenticated in that page (and hence to the application), the user is logged on to HTTP Commander. If authentication fails, the user sees an error message and is presented with the same login form on testSSO.html.

Simply put, testSSO.html page provides an HTML logon form for a web application requiring Windows authentication.

Solution 2. "Forms with Windows users" authentication mode

- Open the Admin panel in the Http Commander web interface.
- Change the value of the AuthMode parameter to "Forms with Windows users".
- Revise NTFS permission.

Solution 3. Proxy server in front of Http Commander.

You may configure a proxy server to handle authentication using web form (cookie-based authentication) while the web application is using windows authentication.

Some our customers using MS ISA Server successfully replaced Basic authentication with Forms by ISA settings. Read more info at http://technet.microsoft.com/en-us/library/bb794733.aspx. See also our article Publishing HTTP Commander through Forefront Threat Management Gateway 2010.

How do I clear windows authentication on Log out?

Answer: Contemporary web browsers cache credentials a user supplied to authenticate to a web application. Unfortunately, they do not provide an interface to clear authentication data on demand (with the exception of Microsoft Internet Explorer). Web browsers clear authentication data when you close the browser, but they normally do not clear them when you simply close the tab. The practical result of this issue is that the Log out button in Http Commander does not in fact log the user out in any browser except Internet Explorer. After log out you may continue to use Http Commander under the same user you used to log in the last time. You'll not be asked to authenticate again. The only reliable method to log out is to terminate the browser process.

Http Commander implements a workaround to this problem. That is it makes the browser to forget user credentials. The user has to authenticate in the application after logout to continue using Http Commander. You need to go through a few configuration steps to activate the solution.

Step 1. Enable anonymous authentication for ForceLogout.aspx

- For Windows Server 2008, 2012, 2016
  - Locate the HTTP Commander application in IIS Manager, switch to Context view.
  - Locate ForceLogout.aspx, right-click on in, select "Switch to Features View".
  - Open Authentication feature.
  - Enable Anonymous authentication, disable all other authentication types.
- For Windows Server 2003
  - Locate ForceLogout.aspx file in IIS manager, right-click on it, select Properties.
  - In the Properties dialog, open the File Security tab, click the Edit button in Authentication and access control group.
  - In the Authentication Methods dialog, check "Enable anonymous access", uncheck all other check boxes.

Step 2. Specify basic authentication realm in IIS

- For Windows Server 2008, 2012, 2016
  - Open IIS Manager, click the Http Commander application on the tree panel.
  - Open the Authentication feature.
  - Select basic authentication (it should be enabled).
  - Click Edit on the Actions panel.
  - Specify the value of the realm field.
  - Click OK to close the dialog.
- For Windows Server 2003
  - Open IIS Manager, open properties of the Http Commander application.
  - Open the "Directory Security" tab.
  - Click the Edit button in the "Authentication and access control" area.
  - Specify the value of the realm field.
  - Click the OK button to close the "Authentication methods" dialog.
  - Click the OK button to close the Properties dialog.

You may use any non-blank string for the realm parameter, for example, name of the server machine. The point is you must specify the same value in both IIS manager and in Http Commander settings.

Step 3. Specify BasicAuthenticationRealm parameter in Http Commander

- Open the Admin panel in Http Commander.
- Click the "Show hidden parameters" button on the top panel if hidden parameters are not shown.
- Set the BasicAuthenticationRealm parameter in the main section to the value you've assigned in IIS.
- Click the "Save settings" button.

After changing my username in Active Directory/WinNT I can still login to HTTP Commander, but then I don't see any of the folders.
Answer: This problem can arise because of caching the mapping between the SID and the user name in a local cache on the computer.
For obtaining more detailed information and problem elimination, see http://support.microsoft.com/kb/946358.
When opening - request of authorization occurs 2 (or more time) and after login form for Forms version opens.
Answer: This problem is because Anonymous Authentication is enabled in IIS. It is necessary to disable it.
To check it, you can open IIS or launch diagnostics page (Authentication mode section).
See also Manual configuration authentication mode.
How can I display some text when user logs into Http Commander (at the time when popup login window appears) instead of white screen?
Answer: You can create separate html page which will be available without authentication and redirect to Default.aspx page immediately after load of this page.
This will result to render page with your custom text while users enter their credentials. For example you can explain which credentials should be entered , which users are allowed, what users will see after login, etc.
How to do that:

1. Create new html page in root folder of Http Commander. For example, index.html
2. Edit contents of that page to display some useful information.
   Include following meta tag into head section of the page to automatically load default.aspx page:
   <meta http-equiv="refresh" content="1;url=default.aspx">
   Example:
   <!DOCTYPE HTML PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="refresh" content="1;url=default.aspx" /> <title>Welcome to Web file manager</title> </head> <body> Hello, welcome to web file manager. Please login with your domain account ! </body> </html>
3. Configure Anonymous access to newly created index.html file:
   - For IIS 7, 7.5, 8, 8.5, 10 (Windows 2008, 2012, 2016):
     - Open the IIS console: Control panel-> Administrative tools-> Internet Information Services
     - Expand "Web Sites", "Default web site", "HTCOMNET".

     - Right-click the "HTCOMNET" virtual folder and select "Switch to content view" in the context menu. In the list of files in the middle panel, select the "index.html" file and click the "Switch to features view" option. Now you may change settings pertaining to the "index.html" file. Click the "Authentication" feature on the central pane.

       - Enable "Anonymous Authentication" and "ASP.NET Impersonation". Disable other items.
         Screenshot

   - For IIS 6 (Windows 2003):
     - Open the IIS console: Control panel->Administrative tools-> Internet Information Services->Expand "Web Sites", "Default web site", "HTCOMNET"folder.
     - In the right panel, right-click the "index.html" file and select "Properties" in the context menu.
       In the index.html properties dialog box, open the "Directory Security" tab, click the "Edit.." button.
       Check the "Enable anonymous access" option and uncheck the "Basic authentication" and "Windows Integrated" options.
4. Use link to htcomnet/index.html file to display contents of index.html page during login process.