I cant get a .Net 4 website to windows auth
I'm running IIS 6.0 with a .Net 4.0 website
If I set Basic auth it validates and works.
Note the difference between an application and a website, the website does not work, but the application does
If I set the default website to have an application to the same place windows auth works
if I set the website to windows auth it will prompt for my username password, and fail 3 time and then say unauthorised. It does not lock my account
I have enabled .Net 4 on teh web server extensions.
I have run aspnet_regiis.exe
I have set it to its own app pool, a shared app pool with the application (not website) that works. To use the app pool that worked on the apllication to be solely on the website
I've set the asp.Net version to be 4.
I've looked in the webserver logs and it has this
2011-07-11 04:10:17 W3SVC1459592338 172.XX.XX.XX GET / - 123 - 172.XX.XX.XX Mozilla/4.0+(compatible;+MSIE+6.0;+Windows+NT+5.2;+SV1;+.NET+CLR+1.1.4322;+.NET+CLR+2.0.50727;+.NET+CLR+3.0.04506.30;+.NET+CLR+3.0.04506.648;+.NET+CLR+3.5.21022;+.NET+CLR+3.0.4506.2152;+.NET+CLR+3.5.30729;+.NET4.0C;+.NET4.0E) 401 2 2148074254
2011-07-11 04:10:23 W3SVC1459592338 172.XX.XX.XX GET / - 123 - 172.XX.XX.XX Mozilla/4.0+(compatible;+MSIE+6.0;+Windows+NT+5.2;+SV1;+.NET+CLR+1.1.4322;+.NET+CLR+2.0.50727;+.NET+CLR+3.0.04506.30;+.NET+CLR+3.0.04506.648;+.NET+CLR+3.5.21022;+.NET+CLR+3.0.4506.2152;+.NET+CLR+3.5.30729;+.NET4.0C;+.NET4.0E) 401 1 0
2011-07-11 04:10:23 W3SVC1459592338 172.XX.XX.XX GET / - 123 - 172.XX.XX.XX Mozilla/4.0+(compatible;+MSIE+6.0;+Windows+NT+5.2;+SV1;+.NET+CLR+1.1.4322;+.NET+CLR+2.0.50727;+.NET+CLR+3.0.04506.30;+.NET+CLR+3.0.04506.648;+.NET+CLR+3.5.21022;+.NET+CLR+3.0.4506.2152;+.NET+CLR+3.5.30729;+.NET4.0C;+.NET4.0E) 401 1 0
Event log is no help
any iedas???
after some major searching I found this MS support page. It led me to work out that the authentication type was not set, i set it to NTLM and it all worked
cscript adsutil.vbs set w3svc/WebSite/root/NTAuthenticationProviders "NTLM"
Where WebSite is the ID of your webste taken from IIS
Related
I have two domains A and B, with a user Administrator in each. Both admins have different objectGuids, SIDs and passwords. There's an IIS 8.5 in B configured with Windows Authentication (Methods Negotiate/NTLM, Extended Security disabled, Kernel mode auth enabled). Domain B trusts domain A (one-way trust).
When I now open IE as A\administrator, and connect to the IIS in B, the IIS returns to me that the user logged in is B\administrator (should be A\administrator).
This is my code:
public class UserController : ApiController
{
// GET api/<controller>
public User Get()
{
var usr = ((WindowsIdentity)User.Identity).User;
return new User() {
Name = User.Identity.Name,
SID = usr==null?"":usr.ToString()
};
}
}
Also, the same is in the IIS log:
2018-05-07 09:19:10 172.17.41.31 GET /winauthtest/User - 80 B\Administrator 172.17.42.11 Mozilla/4.0+(compatible;+MSIE+7.0;+Windows+NT+10.0;+WOW64;+Trident/7.0;+.NET4.0C;+.NET4.0E) - 404 0 2 31
Is this intended behaviour or a bug, and if it's a bug, where to report the bug?
Can I fix it by changing Windows Authentication settings, or what else could I do about it?
Do you know any other possibility to get the true SID of the user that is accessing my IIS?
OMG, I had the same problem and your problem gave me a hint as to why this is happening. So, running my project in Chrome gives me the wrong domain, while opening in Edge gives me the correct domain. I have my project set up using Windows Authentication and it seems Chrome is in some way blocking Windows Authentication.
This link gives more info.
https://specopssoft.com/blog/configuring-chrome-and-firefox-for-windows-integrated-authentication/
In the end, another of my coworker had the same issue and we couldn't fix it properly. It would misbehave randomly. The only solution that seemed to work was restarting the PC.
I'm trying to set up OpenAM with CDSSO, but I cann't find the right setup.
My environment looks like this:
OpenAM:
version: 10.0.0
few tomcat
behind loadbalancer 10.10.10.10:8000
availble by http://abc.xxx.com which redirects to http://sso.yyy.com or by http://sso.yyy.com
Apache with web agent
apache version: Apache/2.2.15
web agent version: Version: 3.0-04, Revision: 9150
host have access to 10.10.10.10:8000, but not to http://abc.xxx.com or http://sso.yyy.com
accessed via http://efg.xxx.com
End user / browser
have access to http://sso.yyy.com, but not to 10.10.10.10:8000
Tested configurations
Try 1
In web agent configuration I setup
com.sun.identity.agents.config.cdsso.cdcservlet.url[0]=http://10.10.10.10:8000/opensso/cdcservlet
in browser I have redirect to 10.10.10.10:8000/opensso/cdcservlet
Location: http://10.10.10.10:8000/opensso/cdcservlet?goto=http%3A%2F%2Fefg.xxx.com%3A80%2F&
in web agent log is
am_web_do_cookie_domain_set(): setting cookie iPlanetDirectoryPro=;Path=/.
is_server_alive(): Connection timeout set to 2
am_web_get_url_to_redirect: The goto_url and url before appending cdsso elements: [http://efg.xxx.com:80/] [http://10.10.10.10:8000/opensso/cdcservlet?goto=http%3A%2F%2Fefg.xxx.com%3A80%2F]
process_access_redirect(): get redirect url returned AM_SUCCESS, redirect url [http://10.10.10.10:8000/opensso/cdcservlet?goto=http%3A%2F%2Fhttp://efg.xxx.com%3A80%2F&].
process_access_redirect(): returning web result AM_WEB_RESULT_REDIRECT.
process_request(): returning web result AM_WEB_RESULT_REDIRECT, data [http://10.10.10.10:8000/opensso/cdcservlet?goto=http%3A%2F%2Fhttp://efg.xxx.com%3A80%2F&]
am_web_process_request(): Rendering web result AM_WEB_RESULT_REDIRECT
am_web_process_request(): render result function returned AM_SUCCESS.
Try 2
In web agent configuration I setup
com.sun.identity.agents.config.cdsso.cdcservlet.url[0]=http://sso.yyy.com/opensso/cdcservlet
in browser I have
403, You don't have permission to access /
in web agent logs is
am_web_do_cookie_domain_set(): setting cookie iPlanetDirectoryPro=;Path=/.
am_web_get_url_to_redirect: unable to find active Access Manager Auth server.
process_access_redirect(): get redirect url returned AM_FAILURE, redirect url [NULL].
process_access_redirect(): returning web result AM_WEB_RESULT_FORBIDDEN.
process_request(): returning web result AM_WEB_RESULT_FORBIDDEN, data []
am_web_process_request(): Rendering web result AM_WEB_RESULT_FORBIDDEN
am_web_process_request(): render result function returned AM_SUCCESS.
Questions
Is it possible to perform such a configuration?
In newer version of OpenAM (12.0.0 › OpenAM Administration Guide) I find
OpenAM Conditional Login URL (Not yet in OpenAM console)
CDSSO examples: com.forgerock.agents.conditional.login.url[0]= login.example.com|http://openam1.example.com/openam/cdcservlet, http://openam2.example.com/openam/cdcservlet, com.forgerock.agents.conditional.login.url[1]= signin.example.com|http://openam3.example.com/openam/cdcservlet, http://openam4.example.com/openam/cdcservlet
what does it mean "Not yet in OpenAM console". Can I set this directry in OpenDJ?
Is this configuration will work on older versions of OpenAM?
Is for web agent work failover similat to https://docs.oracle.com/cd/E19636-01/819-6101/auto20/index.html?
Thanks in advance
kawu
Answer to 1) Yes that's possible. I don't see why you would need conditional login URL feature, 3.0-04 agent might not even support this feature (question 3) If agents can not access CDCServlet or LoginURL feature you need to disable the probing for it ... see OPENAM-3294 You are using LB for OpenAM, so no need for Agent failover.
I have created an SharePoint- hosted app and using office API’s within the start page. The app is added in exchange and enter image description hereapp web links are referred in appmanifest.xml.
1) On click of link, page renders as expected in OWA every time except for 1st time, following error occurs .
"App Error Something went wrong and we couldn't start this app. Please
try again later or contact your system administrator." console log
shows:“Uncaught Sys.ArgumentNullException: Sys.ArgumentNullException:
Value cannot be null.Parameter name: conversationId “ in
outlook-web-16.00.js:
It works as expected in subsequent calls.
2) The app doesn’t load in outlook client. Following error occurs in Microsoft Office Alerts :
App Error This app could not be started. Close this dialog to ignore
the problem or click "Restart" to try again. P1: Apps for Office P2:
15.0.4719.1001 P3: 0x80010105 P4: following is displayed in fiddler: X-MSDAVEXT_Error: 917656; HTTP/1.1 401 Unauthorized ........ ..
Access+denied.+Before+opening+files+in+this+location%2c+you+must+first+browse+to+the+web+site+and+select+the+option+to+login+automatically.
.....
All suggestions are highly appreciated.
This issue appears when we debug outlook apps in debug mode and the app exceeded the allotted time to load required office 365 js files into your app.
One thing i am doing to avoid this issue, in the browser you are using to authenticate using o365 account, check the box to login automatically to save time and load client js files faster post authentication step.
I've been a .Net developer for some years now and quite a bit of experience connecting my ASP.Net and winform applications to web services. Recently I started working with Navision, specifically 2009 R2.
I have created a number of applications for ASP.Net and Winforms that connect to Navision's web services successfully and was recently asked to look into developing a Windows Phone 8.1 application to replace an existing application that runs on tablet pcs, and thats where its all gone horribly wrong...
After reading up and a few cases of trial and error, it seems that when I open Visual Studio 2013 and create a Windows Phone 8.1 Runtime application, it has no way of adding a Web Reference or Service Reference to the Navision Web Services.
I started again with w Windows Phone 8.1 (Silverlight) application and at least I get the option to add a Service Reference.
I added the Service Reference that point to my Web Service but the web service requires that the user set a set of credentials (a Windows Domain user account) and at no point was I prompted to enter these. Ok, maybe they're set at runtime...
After following a post in an Microsoft blog that covers connecting to Navision web services using Silverlight 3, I had most of my code in place, but there was still no option to enter any user credentials. It seems that there's a difference between regular Silverlight and the version used in the Windows Phone development environment.
The following code is a method taken from my test application...
protected void ConnectToNav()
{
try
{
string serviceURL = "http://192.168.0.50:7047/DynamicsNAV/WS/TestCompany/Page/svcUser";
svcUser_PortClient userService = new svcUser_PortClient("svcUser_Port", new EndpointAddress(serviceURL));
userService.ClientCredentials.UserName.UserName = #"Domain\User";
userService.ClientCredentials.UserName.Password = #"Password";
userService.ReadMultipleCompleted += delegate(object sender, ReadMultipleCompletedEventArgs e)
{
display(e.Error.Message);
if (e.Result.Length > 0)
{
display("10 Users:");
for (int i = 0; i < e.Result.Length; i++)
{
display(e.Result[i].ToString());
}
}
};
List<svcUser_Filter> filters = new List<svcUser_Filter>();
userService.ReadMultipleAsync(filters.ToArray(), null, 10);
}
catch (Exception ex)
{
display(ex.Message);
}
}
public void display(string s)
{
this.OutputTextBox.Text += s + Environment.NewLine;
}
and this is the error that gets returned...
The remote Server returned an unexpected response: (401) Unauthorized. In Silverlight, a 404 response code may be reported even when the service sends a difference error code.
I'd love to hear from anyone that has either got this working, or know of any good reference for this and how to get it working.
I would recommend using Windows Phone Runtime for easy of migration going forward. What you could do is use ASP.NET Web API and consume the NAV web service in that, while you then call the Web API from your Windows Phone app. Would this work for you?
Here's a good resource on ASP.NET Web API.
I am trying to use System.Net.WebClient in a WinForms application to upload a file to an IIS6 server which has Windows Authentication as
it only 'Authentication' method.
WebClient myWebClient = new WebClient();
myWebClient.Credentials = new System.Net.NetworkCredential(#"boxname\peter", "mypassword");
byte[] responseArray = myWebClient.UploadFile("http://localhost/upload.aspx", fileName);
I get a 'The remote server returned an error: (401) Unauthorized', actually it is a 401.2
Both client and IIS are on the same Windows Server 2003 Dev machine.
When I try to open the page in Firefox and enter the same correct credentials as in the code, the page comes up.
However when using IE8, I get the same 401.2 error.
Tried Chrome and Opera and they both work.
I have 'Enable Integrated Windows Authentication' enabled in the IE Internet options.
The Security Event Log has a Failure Audit:
Logon Failure:
Reason: An error occurred during logon
User Name: peter
Domain: boxname
Logon Type: 3
Logon Process: ÈùÄ
Authentication Package: NTLM
Workstation Name: boxname
Status code: 0xC000006D
Substatus code: 0x0
Caller User Name: -
Caller Domain: -
Caller Logon ID: -
Caller Process ID: -
Transited Services: -
Source Network Address: 127.0.0.1
Source Port: 1476
I used Process Monitor and Fiddler to investigate but to no avail.
Why would this work for 3rd party browsers but not with IE or System.Net.WebClient?
I have seen a similar issue, where the Integrated / NTLM security will only work if you are accessing the host by machine name or localhost. In fact, it is a [poorly] document feature in Windows that is designed to protect against "reflection attacks".
Basically, you need to create a registry key on the machine that is trying to access the server, and whitelist the domain you are trying to hit. Each host name / FQDN needs to be on it's own line - there are no wildcards and the name must match exactly. From the KB Article:
Click Start, click Run, type regedit, and then click OK.
In Registry Editor, locate and then click the following registry key:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\MSV1_0
Right-click MSV1_0, point to New, and then click Multi-String Value.
Type BackConnectionHostNames, and then press ENTER.
Right-click BackConnectionHostNames, and then click Modify.
In the Value data box, type the host name or the host names for the sites that are on the local computer, and then click OK.
Exit Registry Editor, and then restart the computer.
http://support.microsoft.com/kb/956158/en-us
Have you tried ...
new NetworkCredential( "peter", "password", "boxname" );
You might also try ...
var credCache = new CredentialCache();
credCache.Add( new Uri ("http://localhost/upload.aspx"),
"Negotiate",
new NetworkCredential("peter", "password", "boxname"));
wc.Credentials = credCache;
Also, according to this it may be that IIS is configured wrong. Try replacing "Negotiate" with "Basic" in the above and checking your IIS config for the website. There's also a bunch of possible causes here.
Try going into IE's options and explicitly add the site to the Intranet Zone. Then re-run the program. You should also not run the program from an administrator login. This may trigger the Enhanced Security Configuration for Internet Explorer.
It could explain why you can hit the site with Firefox and Opera, but not with IE or WebClient.
Without knowing your IIS deployment, and assuming that you have the correct authorization rules for upload set in IIS (e.g. the right allow* ACL's on the right dirs you are trying to upload content to, etc), first thing I would try is to set UseDefaultCredentials to true instead of explicitly set Credential. (Maybe you think you are accessing the server with the Credentials you are setting but that's not the case? That would be possible if this works.)
This is a very common scenario, so I would focus on IIS authorization rules for the directory in which you are trying to upload the file, the actual ACL's on that directory. For ex. is your site impersonating or not? if it is, then you have to have actual ACL's on that dir, otherwise whatever account app pool is running on.