Security :: LDAP Throws Invalid Credentials With Valid Credentials Supplied?
Feb 1, 2011
I'm working on an ASP.NET project for the first time in about three years; in the meantime I've been working with Python/Django, PHP and Obj-C. Anyways, picked it right back up... except something that is totally killing me right now, and I have a feeling it must be staring me in the face:
I'm trying to bind to an LDAP server, for the purpose of authenticating users. The way it works here is, you bind on your own credentials, use that to find the Distinguished Name of the user you're authenticating, then you bind again on their DN and their password. If the bind is successful, the password was correct and the user can be authenticated.
Here's the problem - the first bind (on the fixed credentials, the ones with the ability to search for users and their subtrees) works fine. The search works fine. The second bind fails, no matter what, with the LDAP error INVALID_CREDENTIALS. This happens even when completely valid credentials are supplied.
Here's the code, with the usernames and passwords redacted, of course...
I'm setting up a new site on a new server. I created the site in the IIS manager and pointed it to my site directory. But, I now receive this error each time I try to navigate to the site.
I didn't receive this error on the other server, so I'm a little confused. I looked this up, but most of the information I've found is about configuring the users that people have setup. But, this site won't be secured like that. No one will need to log in.
I have to post my request to the web page [URL] and this require 3 credentials namely account id ,username and password and i have to pass the some data for the fields in the page
I am using windows authentication for security in my webpage. Now i want is that if user opens a webpage and then sit idle for 15 minutes and after that try to use webpage , i can ask him for credentials.
have been facing a problem in passing credentials to a web service. I have searched a lot on it and found solution but they didn't work for me coz the scenario with me little different I believe.The situation is like this. I have a 3rd party web service "https://3rdpartyserver/virtualdirectroy/service/service.aspx".So when I try to browse the service in IE it takes me to the login page ("https://3rdpartyserver/virtualdirectroy/Loginpage.aspx"), when I enter usename and password in it and hit Log In button it takes me to the service where all the web methods are listed
Is there any way,in Visual Studio,to specify credentials to test a web page with rather than having to go through the process of logging in every time?is there some common technique to testing with different roles and logins?It's just really tedious to constantly have to login and navigate to a specific page to test.
In my environment, we use Active Directory as our password repository. I'm writing an app that uses the users windows session (windows auth) to authenticate the user. This is working well, but I need to provide a way for users to log in as a different user. I setup a web form to accept a username and password. My question is this, I need a secure way to validate the user's credentials against AD. I cant have the credentials passed as clear text. Ive come across the impersonate user functions, but i'm leary because you have to pass a clear text password into the password field. I know I could also use LDAP, but without a certificate, I know plain LDAP is relatively insecure. Can someone point me in the right direction of a more secure solution to query AD with the credentials?
I have an intranet web application, where i have windows authentication = true in web.config. I hear from end users that the website is aksing for their login credentials and they don't like it. By the way i am getting theusername from HttpContext.Current.User.Identity.Name and Domain Name from Mid(UserNameID, 1, InStr(UserNameID, "") - 1).In IIS, anonymous access is unchecked and Integrated wnidows authentication is selected.
I am building a web application that is limited to one database, thus I cannot use the handy ASP.NET config tool. I am attempting to use SqlClient to authenticate users from a user table I added to my database. Here is the code I have thus far:
In my application, I have users request accounts, and then an admin goes in to approve or reject the account. When the admin approves the account, the create user wizard is used. After the user is created, I set the new user's role, and update a few other items in my database for user tracking, and send out an email to notify the new user of their account status. Here's the kicker: Once this new user is created, the admin, is now logged in as the new user. How is this happening? And how do I stop it? Here is my CreatedUser code, scrubbed of non-pertinent code. [Code]....
We have an IIS/ASP web page from a vendor that we have just dropped onto a webserver within our company. The ASP pages do not come with any sort of authentication built in, so I am trying to configure the site to prompt for credentials before being accessible. I would like the site to prompt for the credentials in all cases (ie. I don't want Internet Explorer to pass through the credentials of the logged in user). I want authorization to this site to be allowed only to members of a certain security group with Active Directory.
Is there a way to do this? I'm not really an IIS guy, nor an ASP developer, so I'm kind of feeling my way through the dark here.
Based on some searching, I have tried adding the following to the web.config file:
[Code]....
I have also installed the IIS URL authorization role service, and have tried playing around with the authentication settings within IIS, to no avail.
Does anyone know a good tutorial for building a custom login control I've tried looking for one that suits my needs with no success. I want to be able to store credentials and other information in an XML file
I am currently developing a web site for our Student Council so members can check in and view the work they've done, sign up for tasks, etc. They will authenticate using their username provided by the school district's AD servers. How can I make it so that only their data shows up when they use their username?
I am using Asp.Net application for calling an existing Java webservice. Recently the web service is configured with Security certificates. Now I need to call the webservice using "https:URL .." and by passing the credentials i.e. UserId and Password.
When I call the webservice using [URL] I get the below error. Is the change in my code is causing this error?
Error:Client found response content type of 'text/html; charset=iso-8859-1', but expected 'text/xml'. The request failed with the error message: --
500 Internal Server Error
Internal Server Error
The server encountered an internal error or misconfiguration and was unable to complete your request. contact the server administrator, you@your.address and inform them of the time the error occurred, and anything you might have done that may have caused the error. More information about this error may be available in the server error log.
I am the web developer at a medical clinic. I have 2 scenarios going on:
First, I have a physicians only component of our employee portal to allow access to only physician shareholders or physician non-shareholders. My structure is built like:
Physicians Only Administration Affiliations Calendars Compensation Minutes
The Affiliations folder is only going to be accessible by the physician shareholders. Therefore, I have security roles set for Physicians Only and Affiliations. When I test, the security is set correctly on the folders. However, when I try to login as different people, all with different roles, I have to login with user name and password, twice, before the system allows me in.
Secondly, I have secured areas within the employee portal also. However, when I navigate to them, the system doens't usually prompts me to login. If it does prompt me to login, it too, is on the second try. So how does it know who I am? And more importantly, how do I get the system to actually prompt the user to login with their credentials?
I need to do the following 1. Authenticate from Active Directory 2. Get Email List of all users from active directory
I have user credentials when system authenticates user but later on when I need to get the list of email from active directory I don't have user credentials for creating Directory Entry. I don't want to store credetials in Sessionstate or something and I don't want to use Admin Account. Plz suggest some solution so that I can connect to active directory for getting other information after authentication.
I want to apply some better security measures to an existing web application. Currently, my connection string contains the user name and password in plain text. I'm also using a custom membership provider, which stores user names and passwords in the web.config file as plain text [URL] I would like to secure this information using an algorithm such as SHA1.
Is the above possible? Basically i need it as I am creating a site where users can upload files to a shared network drive which is secure and has a system account
When a user clicks on upload file, If possible I would like the page to automatically kind of log in with the system account, copy the files and then log off. I know I could achieve something similar mapping a drive but would prefer not to do that for these reasons;
- Security risk if the mapped drive for some reason isnt removed by the code
I'm trying to write a simple login page, that will allow my users to login to my site using their Active Directory credentials (using their username / password we give them through AD).
I want to do 2 things with the login:
1. I want to check the username / password against our AD and verify the person is a valid user within the directory.
2. I also want to store the entry within a global variable so when the user fills out one of the forms within the site it can Insert the data into a SQL table i have running.
** we are using this site to do Setup Change Request Forms / Termination forms etc. and I just want to verify the person signing off on the form is the person logged into the machine -- use it as an "electronic signature per say".
I'm using a vb.net 2.0 approach - as i only have access to visual studio 2005 and i'm more of a vb programmer then a c#.
If anyone has any examples or can walk me through how to go about writing out this page that would be great.
I have an ASP.net 2.0 application on an IIS6 server with a second server running SQL.
The problem I have is that I can't use Integrated Windows Authentication to authenticate against the SQL server, instead the IIS passes its machine name (DOMAINMachineName$) to the SQL server. Of course I can add the necessary permissions to the machine name account on SQL, but I want to use the local user credentials in Integrated Windows Authentication to authenticate against SQL.
I have tried to find some reading/articles online but apart from a basic understanding I can't find the details I need to implement into my application. All I have found is that IIS doesn't pass the credentials onto a remote machine when using Integrated Windows Authentication, and Kerberos should be used instead. I have no experience of Kerberos or how to use it in ASP.net so I am hoping it can be done using Integrated Windows Authentication or be pointed to some good easy to understand articles on using/implementing Kerberos.
