Impersonation Fails On First Try But Succeeds On Second?
Jun 3, 2010
We are using RDLC's in a Asp.net web application. For reasons beyond our understanding, the first call to the database server fails with the following error:
An error has occurred during report processing. Cannot open database "TryParkingIt2" requested by the login. The login failed. Login failed for user 'EXTRANETOurServerNameHere$'.
Run the report again, it works.
Update Click the button the first time, it fails. Click the button again, it works. The account being impersonated is a domain account. Also, this error occurs on all five different report pages, which is why I didn't include any code.
a couple weeks ago, my ASP.NET website stopped sending user comments which I implemented by emailing those comments to my email account through Gmail SMTP server [URL]. I opened the project on my development machine and again it fails to send the email after a couple minutes with the following exception message:
Failure sending mail
Unable to read data from the transport connection: net_io_connectionclosed.
I'm using Gmail's SMTP with port 465, and MailClient.EnableSSL = True.
The weird thing is my Office Outlook 2007 is using the same settings and it doesn't have any problems sending mail using the same Gmail account.
Environment is IIS 7 integrated pipeline, ASP.NET 4.0. I have a .aspx page configured without anonymous authentication and with windows authentication:
When I request the page, a normal Windows auth (NTLM/Negotiate) challenge response happens, and ultimately the page is returned.I have an HttpModule in which I handle the PostAuthorize event. As expected, this event is only raised once the challenge-response authentication has succeeded and access to the page has been authorized.However, the Request.IsAuthenticated property is false; and HttpContext.Current.User.Identity reflects an unauthenticated user (.Name returns the empty string). Interestingly, Request.ServerVariables["LOGON_USER"] does return the value of the authenticated Windows user.I'd have thought that once the user was authenticated (and authorized, for that matter), the request would reflect being authenticated; and the User / Identity for the request would have been properly set.
To me this should be much easier, but I can't seem to retain the values that are put in the Insert template upon a validation failure or when the sql fails. This will prevent the user from having to retype everything agin in the event of a failure.
As you can see I am using the Sub Insert_Click and not using an insert through the wizard. so the fields are unbound textboxes on the form. There are 2 dropdowns that provide choices for the other fields.
I pasted in the code using the text only option becuase the format was getting messed up. I probably need more background on why the fields are blanking out.
I modified the ASP.NET login control to also allow specifying UserRole ('Employee' or 'Volunteer'). Users are authenticated via a call to a webservice written by our client, which accepts username/password/role and returns true or false.If role is 'Employee' it represents an active directory user. The application should impersonate the user with the given username/password.If role is 'Volunteer' the application should run under a set Windows account whose username/password are known in advance (i.e. hard-coded in web.config file).
I need to pass a NetworkCredential object with the credentials of the currently impersonated user to a web service from an asp.net application.My code looks like this:
The masterpage of my site is using a control that reads data from a network share. To make this work on all pages I'm having to enable impersonation for the whole site. But what I want to do is only enable it for the pages that actually read/write to the share. Eg:
We are in the process of building ASP.NET windows auth application. Where user need to interact with other internal system using the same single sign on. To interact application DB the system relies on App Pool account, for this we are every time doing the imporsanation to before every DB call. We can not have all useres added to DB, or create an SQL account. Which requires password and user to store in Web Config. We can encrypt it again you encrypt with what and etc ..So we have one windows account wihich same windows account used for our app pool as well.
I would like to know from the team is what is the best way to do the DB connection in this case?What is the implcations if we imporsanate the DB calls based on the app pool account ? Is it a best practice? I have read it creates its own thred and stuff, Do we need to worry ?
On http://msdn.microsoft.com/en-us/library/w070t6ka(v=VS.100).aspx there is an example on how to do impersonation with .net 4.0. We have used this example in a class that inherits IDisposable for ease of use. However, when we use this class in a asp.net web application, we notice a slight but steady increase of Pool Paged Bytes in performance monitor. After a week, the application crashes.
I've tried different implementations of the impersonation-class, using http://msdn.microsoft.com/en-us/library/w070t6ka(v=VS.90).aspx and http://support.microsoft.com/kb/306158 as reference, but they all show the same leak.
Where does this leak come from? Is there a problem with the windows api? We are running Windows 2008 R2.
This is our current version of the impersonation class:
public class Impersonator : IDisposable { public Impersonator(string username, string domain, string password) { if (!ImpersonateValidUser(username, domain, password))[code]....
And this is the performance monitor graph of two webservers using different versions of the class:
When we disable the class, and use global impersonation via web.config, those lines are completely flat.
Update,I have made a test-application that successfully reproduce the problem. It can be downloaded here:
I noticed impersonation is turned on by default in MOSS web configs. I tried disabling it but the web app returns an error. So my question, is it possible to disable impersonation in MOSS? If it is possible are there any special considerations I should be aware of?
If you're interested in why I need to do this...I need to have a custom web part (developed with SmartPart) talk to a separate SQL server using the application pool rather than the current user (Kerberos is enabled). If I set the authentication mode to NTLM I get NTAuthority/ANonymous login errors from my SQL connection. If I turn Kerberos on, the currently logged in user's credentials are passed. If I hard code the user id and password in the connection string it seems to ignore it and default to whichever security model is in place (NTLM or Kerberos).
I've added the identity tag for impersonation. I've configured my site under IIS 5.1. The identity i've added is my domain username/password. But when I run any exe file from my asp.net file, it still runs under "aspnet" user name.
I am trying to use impersonation on an IIS server while I access Active Directory data. The following code works fine on the localmachine but when I put this same code on an IIS server I get an error: System.DirectoryServices.DirectoryServicesCOMException: An operations error occurred.
If I remove the top 4 lines and add my ID and passcode to the DirectoryEntry, everything works fine. I would prefer to not have my id and passcode anywhere on the web. Any ideas on how to fix this? Dim impersonationContext As System.Security.Principal.WindowsImpersonationContext
I am using impersonation in my ASP.NET application to access network resources. It works fine when I run on my computer, however when I setup the site on IIS6, it does not work. Is there some extra configuration, I need make in IIS for it?1. I created an account "TestUser" with the privilege as "act as operating system" on a server that has the resources which I want to access.2. The impersonation works fine on my computer, when I run from visual studio. My computer is on the network under same domain where the "TestUser" is created.
Summary: One of our web applications requires write access to C:WindowsTemp. However, no matter how much I weaken the NTFS permission, procmon shows ACCESS DENIED.Background (which might or might not be relevant for the problem): We are using OLEDB to access an MS Access database (which is located outside of C:WindowsTemp). Unfortunately, this OLEDB driver requires write access to the user profile's TEMP directory (which happens to be C:WindowsTemp when running under IIS 7.5), otherwise the dreaded "Unspecified Error" OleDbException is thrown.
I am running ASP.MVC 2 with LINQ2SQL on IIS 7.5. I have enabled Windows Authentication with ASP.NET Impersonation. Application pool is running on different domain account [AsiaTestWebUser] is part of windows group [AsiaTestUserGrp]When i enable Asp.net impersonation on MVC web site. Once i hit LogOn from the default page , it's throwing me with below error message
So I have an ASP DOT NET web service which needs to impersonate Windows Authenticated users. This web service calls into a Com Api to perform database operations.
It seems like the Impersonation does not persist into the Com Api. Is this because the Com DLL is loaded into its own memory space and treated as a separate process? Also what would be some ways to deal with this issue and persist the Impersonation into the Com Api Dll?
Moving the functionality of the Com Api into the dot net code is not an option at this point. Also the Com Api was written in C++.
I'm trying to enable passthrough or impersonation authentication inside an ASP.NET website that uses the TFS2010 API.I've got this working correctly with Cassini, however with IIS 7.5 (Windows 7) something is going wrong.I found this blog post on the subject, and tried the following:
ExchangeServiceBinding binding = new ExchangeServiceBinding(); binding.Credentials = new NetworkCredential(username, password); binding.Url = "http://servername/ews/exchange.asmx";
The above web services throws Unauthorized Access Error (Error : 401) for newly created users.I would like to know how to impersonate this user for accessing this exchange web services.
I'm having problems with impersonation in WCF. Namely, I'm calling a named pipe service from within ASP.NET with impersonation turned on. This fails (due to permissions on the pipe blocking anyone from the network). So, is there any way I can make the call outside of the impersonation context? I don't need to be impersonating to make this call, but can't see any way of doing this.
PS. I need to do this declaratively, through config...
I have an Intranet which is on IIS 7.0. I want to authenticate my users and know who is logged in. What options do I have to set in IIS Authentication part that my users do not need to type their user name and password to login to Intranet. I have set the Authentication to Basic and Impersonation, but it is asking user name and password.
