C# - Windows Identity Getting Confused Between Users?
Mar 1, 2011
We are observing some strange behaviour in our web server logs where where the Identity of the currently logged in user seems to be getting swapped with another user. I will describe our set up before explaining further.
We are running an asp.net web site (v3.5 of the framework) on 2 Windows 2008 web servers and use forms authentication.They are load balanced using a separate server running Apache 2.2 on Linux (Cent OS 5). The load balancing simply attaches a cookie to a user and directs them to a particular server for each subsequent request.
We notice on occasion patterns in the log like this (details obfuscated)
First Log Entry
UserName - customer1@x.com
UserId - 1111
WebPage - page1
IP - ip1
Time - 2010-06-29 12:56:20.750
SessionId - h3uyz2fsdfegugjy452sdz0far.........
We are using forms authentication using the standard asp.net forms authentication framework (the standard login control and we implemented a custom membership provider).
The UserName is the Windows identity retrieved using "HttpContext.Current.User.Identity.Name" The UserId is the database Id set in the session. The sessionId is retrieved using "HttpContext.Current.Session.SessionID"
As you can see the same Windows identity is the same for 2 different users, under different IP addresses and with different session id's, hitting the site about the same time. We checked and the IP's were from totally different locations. The wrong windows identity seems to be getting recorded. UserId 2222 should have a different username recorded.
Since it happens very occasionally, the code is standard and has not changed substantially for some time we don't "think" it is a coding error. We presume either a problem with the load balancer or some problem in the web server. I have never heard of such problems in asp.net before.
The forms authentication entry in the web.config is
authentication mode="Forms"
forms loginUrl="LoginPage.aspx" name=".ASPXFORMSAUTH"
View 3 Replies
Similar Messages:
Mar 8, 2011
The site is running on my local IIS 6.1. I Would like to add some features to pull information from our AD. My AD code works on many other projects and on my dev server. Here are my attempts at writing out the username:
Response.Write("1. " + this.Request.LogonUserIdentity.Name);
Response.Write("2. " + Request.ServerVariables["Auth_User"]);
Response.Write("3. " + WindowsIdentity.GetCurrent().Name.ToString());
The results I get are:
NT AUTHORITYIUSR
administrator
NT AUTHORITYNETWORK SERVICE
How can I get at the actual windows username like ourdomain/username
View 5 Replies
Feb 9, 2010
I have an asp.net web app that uses forms-based authentication, a SqlMembershipProvider (using an encrypted password format), and a SqlRoleProvider. I need to know if it's possible to administer the users (create new users, assign them to roles, etc.) from a windows application - the powers that be don't want any administrative functionality in the web app itself.
Here is the membership provider definition from web.config:
[code]....
So, obviously, I have a Sql Server database that contains the users and roles for the web app. I'd like to create a separate windows app that references the web app assembly, and use the configured MembershipProvider, RoleProvider, and machineKey to create users, assign users to roles, etc. If that's not possible, I can duplicate the configuration settings from web.config within the windows app. But I don't know how to do this either.
View 3 Replies
Feb 20, 2010
I have a web application using Forms authentication provided by AD. I would like to know if it's possible to use EWS to send mail as the currently logged in user without having to supply credentials, or; would I be required to set up an account with impersonating access which will send mail on behalf of the currently logged in user?
View 1 Replies
Mar 8, 2010
In my web application, an users identity is verified at the page load using his n/w credentials.Now i have this 'Adding Attachment' functionality which us creating the problem. I have to store the file in a different server which have access to only one userid. I guess i hv to impersonate the cuurent user with the other user id for this functionality alone
View 11 Replies
Jul 30, 2010
I want to know if this kind of authentication is possible.
We have an Active Directory account and that account we are using to log in to windows. I have a simple system that needs authentication using the IIS log in box (i dont know what do you call this but what I know is it only comes out when Anonymous user is unchecked in the IIS configuration.) Now, I want this box to appear before my page and the user will be authenticated and be compare to the user who logged in to the windows. If the user who have been authenticated is the same as the user who logged in to the windwos then we will let him in if not he must be denied in accessing the page.
The first problem I have in my mind is how to code it in asp.net to make an authentication when he will try to access my page.
Second is, let us say we have succeeded to show the authentication box, how can I get the username from the log in box and compare it to the user who logged on in windows. Of course we can get the user id of the logged in user from the windows using User.Identity.Name but how about the username from the log in box.
Note: I will not use log in forms even using https. Just the log in provided by the IIS according to the configuration.
View 1 Replies
Nov 1, 2010
I have a web application with a login form. A user enters a user name and password. If they exist in the database the user is authenticated using these two lines:
[Code]....
The problem is that when a user logs in at first he is logged in as himself. When navigating on the web application for a while the user assumes the identity of another logged in user. This happens all the time. In my web.config the authentication mode looks like this:
[Code]....
The site does not use ASP.NET session variables. Instead each page initializes a Singleton class, which stores itself in a static class variable, always accessing the users data already read from the database. The Singleton implementation is:
[Code]....
Could the problem with assuming another logged in users "session" be related to static classes in my application or a Forms Authentication configuration or a configuration in IIS (e.g. is it possible for users to have their own process?).
View 12 Replies
Jan 23, 2011
I have an requirement to implement single sign on solution using SAML 2. I had a look at a tirdparty toolkit in componentspace, but I would prefer some microsoft components.
the features provided in componentspace toolkit can be done using some Microsoft .NET libraries itself. identify the microsoft way to do this?. I looked at the Windows Identity Foundation SDK, but it is now supported only for .NET 3.5. My web application is built on .NET 2.0.
Is there any alternative for Windows Identity Foundation in .NET framework 2.0?
View 2 Replies
Feb 7, 2011
In IIS 7.5 server I have a website apps.mydomain.com. Site binding for this website is:
IP: All Unassigned
Port: 80
Host name: apps.mydomain.com
In DNS there is an ip address pointing to apps.mydomain.com. Site comes up fine when browsing to this hostname.
I want to get current windows logged in username from asp.net web apps. I enabled windows authentication and disabled anonymous. Using this ASP.Net code to test:
Response.Write(Page.User.Identity.Name);
However, browsing to http://apps.mydomain.com/site/ the application pool identity shows as the Page.User.Identity.Name value and not the current windows logged in username.
If I browse to http://servername/site/ then Page.User.Identity.Name will return current windows logged in username.
Is there something else I need to configure to get the current windows logged in username when using host header?
web.config:
<?xml version="1.0"?>
<configuration>
<system.web>
<authentication mode="Windows"/>
</system.web>
</configuration>
App pool config (left out "handlers" for brevity, there's a 30000 char limit):
[Code]....
View 2 Replies
Jan 4, 2011
I have this web application where I need the currently logged in windows user Identity. I server on which I deployed this application does not support virtual directories. And I am not sure if that server is configured for "Integrated Windows Authentication."
I tried using:
System.Security.Principal.WindowsIdentity.GetCurrent().Name;
Request.ServerVariables["AUTH_USER"];
HttpContext.Current.User.Identity.Name;
All these work and retrieve the appropriate currently logged in windows username when the application isn't deployed. But when I deploy it on this particular server, these methods do not give me nothing.
View 4 Replies
Feb 1, 2010
I'm writing an ASP.net application that uses Windows Identity Foundation. My ASP.net application uses claims-based authentication with passive redirection to a security token service. This means that when a user accesses the application, they are automatically redirected to the Security Token Service where they receive a security token which identifies them to the application.
In ASP.net, security tokens are stored as cookies.
I want to have something the user can click on in my application that will delete the cookie and redirect them to the Security Token Service to get a new token. In short, make it easy to log out and log in as another user. I try to delete the token-containing cookie in code, but it persists somehow.
How do I remove the token so that the user can log in again and get a new token?
View 2 Replies
Feb 21, 2011
I have a webpage stored on a local server (Site A) which when I browse to it is given my windows account details, this site then checks within AD to get my email address. My email address is then passed to another website (Site B) and consumed. The Website A is set in IIS to Integrated Windows Auth Only, WebSite A has
<identity impersonate="false"/>
set in the web.config What I dont understand is what user is accessing AD from site A - with impersonate = false that is telling the site not impersonate the windows user, but this seems at odds with the setting in IIS.
View 3 Replies
May 12, 2010
I currently have a client with a SharePoint site that wants to incorporate an (already written) ASP.NET application within a webpart in the SharePoint site. The ASP.net application currently uses an IIS impersonation account to connect to the SQL database.
Some added functionality the client is requesting would require me to grab the user's windows login identity to use the SharePoint UserProfileWebService to query the PropertyPages for that specific user. Because the (already written) ASP.NET application uses impersonation, when I grab the WindowsIdentity.GetCurrent().Name, I get the impersonation account and not the actual user's account.
Is there a way to keep the current setup (impersonation account on IIS to connect to SQL) and still grab the logged in user's credentials? Or would a better way about this be to change IIS to consume the Windows Identity of the logged in user and encrypt the connection string in the web.config?
View 2 Replies
Nov 1, 2010
"My application (ASP.NET) writes certain files in folders on my servers. In IIS 6.0 I used to give write access to IUSR account so that IIS can write to the folder. Now what I see is my application pool runs under App Pool Identity account. That is good but users are able to create files in the folders without App Pool Identity user being given specific permission to do so.
View 2 Replies
Feb 10, 2011
I've been trying to set a STS project in my solution following these steps on Channel 9. Right after hitting "Finish", I get an exception saying: The system cannot find the file specified. (Exception from HRESULT: 0x80070002). After installing, uninstalling, rebooting, and so on, I still get the error.
My OS is Windows 7 Enterprise x64, both Visual Studio 2010 and Visual Web Developer 2010 Express are installed in my machine, the WIF SDK 4, the runtime 6.1 and the Identity Training Kit from January 2011.
View 2 Replies
Apr 1, 2011
f I put the description meta tag in the cshtml for my page (below any code block), and I'm using a _SiteLayout page, the tag gets inserted at the bottom of the rendered page. How do I ensure that the meta description tag gets inserted into the <head> section. Is there a helper I'm missing
View 3 Replies
Feb 16, 2011
'm learning about reporting in VS2008 (no we haven't moved to 2010 yet!), and I like the idea of rdlc files because it seems you can deploy the report as part of a web app rather than mess around deploying it to a report server. Is this correct?We develop tiered apps that use LINQ to SQL, and the .dbml and LINQ queries are in a separate project to the web application. Also, depending on whether we are developing an internet or intranet web app, it will either reference that project directly, or call its methods via a WCF service. However I can't seem to hook up my rdlc to either. From what I've read, this could be because we create "web application" projects and not "web site" projects. So my question is, is it possible to create an rdlc report within a "web application" project and have it use either a business object or a WCF service as its data source?If I try and create a data source in my web app project, it simply creates an XSD, and don't know what to do with this! If I go through the report wizard, all I can do is choose a database data source (i.e. from what's listed in the VS2008 server explorer) - there is no option to choose an "object" or "service" data source, like you can when the rdlc resides in a report project.
View 2 Replies
Jan 30, 2011
get the below error. My application was working fine until I probably modified something, but don't know what.
Server Error in '/' Application.
Method is only supported if the user name parameter matches the user name in the current Windows Identity.
Description: An unhandled exception occurred during the execution of the current web request. review the stack trace for more information about the error and where it originated in the code.
Exception Details: System.Configuration.Provider.ProviderException: Method is only supported if the user name parameter matches the user name in the current Windows Identity.
Source Error:
An unhandled exception was generated during the execution of the current web request. Information regarding the origin and location of the exception can be identified using the exception stack trace below.
Stack Trace:
[ProviderException: Method is only supported if the user name parameter matches the user name in the current Windows Identity.]
System.Web.Security.WindowsTokenRoleProvider.GetCurrentWindowsIdentityAndCheckName(String userName) +2195661
System.Web.Security.WindowsTokenRoleProvider.GetCurrentTokenAndCheckName(String userName) +36
System.Web.Security.WindowsTokenRoleProvider.GetRolesForUser(String username) +61
System.Web.Security.RolePrincipal.IsInRole(String role) +182....
View 1 Replies
Aug 9, 2010
My website security is configured with "Windows Integrated Security" only (anonymous is disabled).
I also want to set a specific account to run the w3wp.exe process using the
Application Pool Identity to a domain account.
Running directly from the server works without any problem but from remote computers I always get the authenticaion window then the 401.1 error (after 3 attempts).
It seems that its the combination of "Windows Integrated Security" along with the "Application Pool Identity" that causes the problem. When I disable one of the two it works properly.
My server is Windows Server 2003 R2, running IIS 6.0.
View 1 Replies
Jun 28, 2011
In the IIS, it shows that the web app (i'm using) is using an application pool that uses NETWORK SERVICE account for identity. But when I debug/run my web app, User.Identity.Name shows that my windows user login instead. I checked my web.config file, and it does not have Impersonate enabled. In fact, I set it to false, and it still shows the same.
View 1 Replies
Aug 18, 2010
I have a ASP.NET Website project and I need to list all the users and their groups on my Windows system. I have set the identity impersonation to true and provided the username and password of the admin in the web.config. Where do I start?
Update:
I have the following code at the moment -
var machine = new DirectoryEntry("WinNT://<IP ADDRESS>");
foreach (DirectoryEntry child in machine.Children)
{
// get the child's group(s).
}
When I debug, I can see the list of users in machine.Children. How do I find the group(s) that this user belongs to?
View 2 Replies
Jan 28, 2010
I need to look for an example of a web application, preferably ASP.NET but any otherweb language will do, that lets Mac and Windows users change their AD password.
Any technique, application, or source code will be great.
P.S: our Macs are not connected to AD and we also have Windows users.
View 1 Replies
Jan 1, 2011
I am developing a asp.net application and i am using SQL Server 2008. I took a IDENTITY column as Record_ID for detail table where i will have trillions of records per year. So just want to ask whats the largest number record id (identity) column can hold and in ASP.NET which data type i should use to handle record id as i am using this id as a reference to update the table data. I don't want to end up being trapped some day.
View 1 Replies
Jun 14, 2010
On our production servers, the admins created a WebUser active directory account which is users for anonymous access to IIS and is also used to authenticate database access with our SQL Server instances using Integrated Security=SSPI in the connection string and identity impersonate="true" in the web.config.
I've often come across situations where I would like to or even need to use forms authentication. However, I using forms authentication, Integrated Security seems to use the logged in user's credentials to authenticate against the database. In these cases I have changed the connection string to use the credentials of a SQL Server users instead. I would prefer to not have a hard coded username and password in the connection string or rather worse in code. Is it possible to use forms authentication just for user authentication for users and windows authentication with the IIS user for database access? What would be the best practice in such a situation?
View 1 Replies
Jan 5, 2010
I am trying to create an Intranet application and I want my users to be able to log in with their windows account. However my organisation has over 150000 employees but I only want the 10-12 people in my department to be able to log in.
How do I do this? Do I need to store the 10-12 users in a database?
View 2 Replies
