How does VBScript communicate with IE popup dialog box?

I am very new to VBScript. I am working on a web application that
requires user authentication through digital certificates.

When the user attempts to log into his account from a web form, IE
pops up a dialog box with a list of digital certificates available to
this user. The dialog box looks exactly like this one:

http://farm1.static.flickr.com/167/442962234_ab4a756b8c_o.png

The user can select an appropriate certificate from that list. Now, I
would like to know in my VBScript which one has been selected by the
user, so that I can retrieve the selected certificate (and thus the
private key) and sign a token, which will be sent to the web server
for verification.

I have no idea how VBScript communicates with such kind of IE popups.

Any hint? Thanks a lot!

mr_unreliable
Sun Apr 08 18:11:55 CDT 2007

hi Antony,

In order to access the dialog selection from script, it has to
be found somewhere in the IE "object model".

I couldn't find it on my (ancient) win98 system, but I expect
that you are using something much newer.

Try looking up the object model on msdn, or if you have an
object viewer (ole viewer), look at the typelibs for mshtml.dll
and/or shdocvw.dll (or whatever microsoft is currently using
as the "guts" of IE).

cheers, jw
____________________________________________________________

You got questions? WE GOT ANSWERS!!! ..(but,
no guarantee the answers will be applicable to the questions)




antonyliu2002@yahoo.com wrote:
> I am very new to VBScript. I am working on a web application that
> requires user authentication through digital certificates.
>
> When the user attempts to log into his account from a web form, IE
> pops up a dialog box with a list of digital certificates available to
> this user. The dialog box looks exactly like this one:
>
> http://farm1.static.flickr.com/167/442962234_ab4a756b8c_o.png
>
> The user can select an appropriate certificate from that list. Now, I
> would like to know in my VBScript which one has been selected by the
> user, so that I can retrieve the selected certificate (and thus the
> private key) and sign a token, which will be sent to the web server
> for verification.
>
> I have no idea how VBScript communicates with such kind of IE popups.
>
> Any hint? Thanks a lot!
>

Paul
Sun Apr 08 21:28:49 CDT 2007


<antonyliu2002@yahoo.com> wrote in message
news:1176009792.190120.282940@n59g2000hsh.googlegroups.com...
>I am very new to VBScript. I am working on a web application that
> requires user authentication through digital certificates.
>
> When the user attempts to log into his account from a web form, IE
> pops up a dialog box with a list of digital certificates available to
> this user. The dialog box looks exactly like this one:
>
> http://farm1.static.flickr.com/167/442962234_ab4a756b8c_o.png
>
> The user can select an appropriate certificate from that list. Now, I
> would like to know in my VBScript which one has been selected by the
> user, so that I can retrieve the selected certificate (and thus the
> private key) and sign a token, which will be sent to the web server
> for verification.
>
> I have no idea how VBScript communicates with such kind of IE popups.
>
> Any hint? Thanks a lot!

http://msdn.microsoft.com/workshop/author/dhtml/reference/dhtml_reference_entry.asp
The popup contains an IE document object.
From the URL above, click Dhtml object, and then click the select object.
You should find some sample code near the end of the page.
Groups.google.com is handy for searching the appropriate newsgroup for
sample code.
Search for a few words like internet explorer popup in a group like
*.scripting.vbscript

-Paul Randall

antonyliu2002
Mon Apr 09 14:05:44 CDT 2007

On Apr 8, 9:28 pm, "Paul Randall" <paulr...@cableone.net> wrote:
> <antonyliu2...@yahoo.com> wrote in message
>
> news:1176009792.190120.282940@n59g2000hsh.googlegroups.com...
>
>
>
>
>
> >I am very new toVBScript. I am working on a web application that
> > requires user authentication through digital certificates.
>
> > When the user attempts to log into his account from a web form, IE
> > pops up a dialog box with a list of digital certificates available to
> > this user. The dialog box looks exactly like this one:
>
> >http://farm1.static.flickr.com/167/442962234_ab4a756b8c_o.png
>
> > The user can select an appropriate certificate from that list. Now, I
> > would like to know in myVBScriptwhich one has been selected by the
> > user, so that I can retrieve the selected certificate (and thus the
> >privatekey) and sign a token, which will be sent to the web server
> > for verification.
>
> > I have no idea howVBScriptcommunicates with such kind of IE popups.
>
> > Any hint? Thanks a lot!
>
> http://msdn.microsoft.com/workshop/author/dhtml/reference/dhtml_refer...
> The popup contains an IE document object.
> From the URL above, click Dhtml object, and then click the select object.
> You should find some sample code near the end of the page.
> Groups.google.com is handy for searching the appropriate newsgroup for
> sample code.
> Search for a few words like internet explorer popup in a group like
> *.scripting.vbscript
>
> -Paul Randall- Hide quoted text -
>
> - Show quoted text -

This is really neat. Thank you so much, Paul. Let me peruse that page
and see if I can get inspired.

Many thanks to Mr. Unreliable for your great hint as well.

AL

antonyliu2002
Mon Apr 09 14:14:44 CDT 2007

On Apr 8, 9:28 pm, "Paul Randall" <paulr...@cableone.net> wrote:
> <antonyliu2...@yahoo.com> wrote in message
>
> news:1176009792.190120.282940@n59g2000hsh.googlegroups.com...
>
>
>
>
>
> >I am very new to VBScript. I am working on a web application that
> > requires user authentication through digital certificates.
>
> > When the user attempts to log into his account from a web form, IE
> > pops up a dialog box with a list of digital certificates available to
> > this user. The dialog box looks exactly like this one:
>
> >http://farm1.static.flickr.com/167/442962234_ab4a756b8c_o.png
>
> > The user can select an appropriate certificate from that list. Now, I
> > would like to know in my VBScript which one has been selected by the
> > user, so that I can retrieve the selected certificate (and thus the
> > private key) and sign a token, which will be sent to the web server
> > for verification.
>
> > I have no idea how VBScript communicates with such kind of IE popups.
>
> > Any hint? Thanks a lot!
>
> http://msdn.microsoft.com/workshop/author/dhtml/reference/dhtml_refer...
> The popup contains an IE document object.
> From the URL above, click Dhtml object, and then click the select object.
> You should find some sample code near the end of the page.
> Groups.google.com is handy for searching the appropriate newsgroup for
> sample code.
> Search for a few words like internet explorer popup in a group like
> *.scripting.vbscript
>
> -Paul Randall- Hide quoted text -
>
> - Show quoted text -

But, as a matter of fact, it looks like that page you referred to only
talks about SELECT objects right inside a web form. Does this have
anything to do with the kind of popups I am talking about?

http://farm1.static.flickr.com/167/442962234_ab4a756b8c_o.png

mr_unreliable
Mon Apr 09 14:53:45 CDT 2007

antonyliu2002@yahoo.com wrote:
> But, as a matter of fact, it looks like that page you referred to only
> talks about SELECT objects right inside a web form. Does this have
> anything to do with the kind of popups I am talking about?
>
> http://farm1.static.flickr.com/167/442962234_ab4a756b8c_o.png
>

I am a bit hampered running win98, but as best I can tell
the "certificate dialog" that you are concerned about
is found in "cryptdlg.dll", as a "standard" dll dialog.

By "standard" dialog, I mean that it's a normal dialog
"resource" in a format amenable to use with the "CreateDialog"
api call -- which involves a DlgProc for processing messages.

In other words, I believe that it is not an html dialog,
and as such does not have an object model accessible from
script.

If you really want to deal directly with such a dialog,
you will have to get much more sophisticated, and use
a tool such as "Spy" to detect the system messages going
back and forth, and maybe even "hook into" the message
stream to detect the certificate selected. This is
something that goes way beyond scripting.

Sorry, jw

antonyliu2002
Mon Apr 09 15:03:18 CDT 2007

On Apr 9, 2:53 pm, mr_unreliable <kindlyReplyToNewsgr...@notmail.com>
wrote:
> antonyliu2...@yahoo.com wrote:
> > But, as a matter of fact, it looks like that page you referred to only
> > talks about SELECT objects right inside a web form. Does this have
> > anything to do with the kind of popups I am talking about?
>
> >http://farm1.static.flickr.com/167/442962234_ab4a756b8c_o.png
>
> I am a bit hampered running win98, but as best I can tell
> the "certificate dialog" that you are concerned about
> is found in "cryptdlg.dll", as a "standard" dll dialog.
>
> By "standard" dialog, I mean that it's a normal dialog
> "resource" in a format amenable to use with the "CreateDialog"
> api call -- which involves a DlgProc for processing messages.
>
> In other words, I believe that it is not an html dialog,
> and as such does not have an object model accessible from
> script.
>
> If you really want to deal directly with such a dialog,
> you will have to get much more sophisticated, and use
> a tool such as "Spy" to detect the system messages going
> back and forth, and maybe even "hook into" the message
> stream to detect the certificate selected. This is
> something that goes way beyond scripting.
>
> Sorry, jw

OK, thanks.

But, no matter which cert is selected by the user from this popup
dialog box, my existing client side code successfully sends the cert
to my web application, which in turn can process the cert. I've
checked this many times, and it has been working perfect.

I don't have access to my work station right now. After I get home, I
will post the source code of the web form, and you can see how the
selected cert is sent to my web application.

The problem is that I am new to VBScript, I am not sure how to modify
it in such a way that I can get to know which cert is selected in
VBScript.

antonyliu2002
Mon Apr 09 20:29:24 CDT 2007

On Apr 9, 3:03 pm, "antonyliu2...@yahoo.com" <antonyliu2...@yahoo.com>
wrote:

> OK, thanks.
>
> But, no matter which cert is selected by the user from this popup
> dialog box, my existing client side code successfully sends the cert
> to my web application, which in turn can process the cert. I've
> checked this many times, and it has been working perfect.
>
> I don't have access to my work station right now. After I get home, I
> will post the source code of the web form, and you can see how the
> selected cert is sent to my web application.
>
> The problem is that I am new toVBScript, I am not sure how to modify
> it in such a way that I can get to know which cert is selected inVBScript.- Hide quoted text -
>

Well, I've checked the source code of my Login HTML page. There isn't
anything special in the source. It turns out that sending the cert to
the web application which requires client certificate is presumbably
done by IE itself.

You can see the source code at the following URL where I had a
discussion of this issue with Mitch Gallant.

http://groups.google.com/group/microsoft.public.platformsdk.security/msg/320c7eaf8edf7fe0?dmode=source&hl=en

Let me google a little bit about cryptdlg.dll and see if there is some
API available for polling the popup dialog box. Thank you very much.