I still get the following error... If I pass my username and password through OpenDSObject() it works fine.
error '80072020'
/adsi/adtest1.asp, line 24
Main Topics
Browse All TopicsOk.. This one is driving me crazy! I am trying to solve a problem for our developers. I'm no programmer but I made a basic page to update the description field of a test user in AD. I want to have my credentials to pass through this page to make the AD changes ( I am a domain admin).
This page works if I make the following changes in IIS:
- I setup myself as the anonymous user and click on the page.
- It also works if I turn on just basic authentication and log in when prompted.
- When I pass my user info through the OpenDSObject() function.
This page does not work when I:
- Just enable Windows Integrated Authentication.
- Set the OpenDSObject() username and password to NULL which is supposed to pass the caller's credenitals. http://msdn.microsoft.com/
Things I have done:
- I have changed the Metabase to NTAuthenticationProviders=
- All this stuff: http://www.microsoft.com/t
Any help with this would be much appreciated!
CODE:
<%
strContainer = "cn=Users"
strName = "john smith"
Const ADS_PROPERTY_CLEAR = 1
Const ADS_PROPERTY_UPDATE = 2
Const ADS_PROPERTY_APPEND = 3
Const ADS_PROPERTY_DELETE = 4
Const ADS_SECURE_AUTHENTICATION = 1
'*************************
'* Connect to an object *
'*************************
oUsername=vbNullString
oPassword=vbNullString
Set objRootDSE = GetObject("LDAP://rootDSE"
Set openDS = GetObject("LDAP:")
If strContainer = "" Then
Set objItem = GetObject("LDAP://" & _
objRootDSE.Get("defaultNam
Else
Response.Write "LDAP://cn=" & strName & "," & strContainer & "," & objRootDSE.Get("defaultNam
Set objItem = openDS.OpenDSObject("LDAP:
End If
'*************************
'* End connect to an object *
'*************************
Response.Write "Was: <BR>"
Response.Write objItem.DisplayName & "<BR>"
Response.Write objItem.Description & "<BR>"
Response.Write "<BR>"
objItem.Put "givenName", "John"
objItem.SetInfo
objItem.Put "initials", "JS"
objItem.SetInfo
objItem.Put "sn", "Smith"
objItem.SetInfo
objItem.Put "displayName", "John Smith"
objItem.SetInfo
objItem.Put "description", "Generated by ADTEST1"
objItem.SetInfo
objItem.Put "physicalDeliveryOfficeNam
objItem.SetInfo
objItem.Put "telephoneNumber", "214-555-1212"
objItem.SetInfo
objItem.Put "mail", "jsmith@xxx.com"
objItem.SetInfo
objItem.Put "wWWHomePage", " "
objItem.SetInfo
Response.Write "Now: <BR>"
Response.Write objItem.DisplayName & "<BR>"
Response.Write objItem.Description & "<BR>"
objItem.PutEx ADS_PROPERTY_UPDATE, "otherTelephone", _
Array("VALUE1", "VALUE2", "...VALUEn")
objItem.SetInfo
objItem.PutEx ADS_PROPERTY_UPDATE, "url", _
Array("VALUE1", "VALUE2", "...VALUEn")
objItem.SetInfo
objItem.Put "streetAddress", "123 Main Street"
objItem.SetInfo
objItem.Put "l", " "
objItem.SetInfo
objItem.Put "st", "TX"
objItem.SetInfo
objItem.Put "postalCode", "75201"
objItem.SetInfo
'Response.Write VbCrLf & "**Non-standard value on Address Properties Page**"
'See Script Notes for information on setting this value.
'objItem.Put "c", "1"
'objItem.SetInfo
objItem.PutEx ADS_PROPERTY_UPDATE, "postOfficeBox", _
Array("VALUE1", "VALUE2", "...VALUEn")
objItem.SetInfo
objItem.Put "profilePath", " "
objItem.SetInfo
objItem.Put "scriptPath", " "
objItem.SetInfo
objItem.Put "homeDirectory", " "
objItem.SetInfo
'See Script Notes for information on setting this value.
objItem.Put "homeDrive", " "
objItem.SetInfo
objItem.Put "homePhone", "214-555-1212"
objItem.SetInfo
objItem.Put "pager", "214-555-1212"
objItem.SetInfo
objItem.Put "mobile", "214-555-1212"
objItem.SetInfo
objItem.Put "facsimileTelephoneNumber"
objItem.SetInfo
objItem.Put "ipPhone", "214-555-1212"
objItem.SetInfo
objItem.Put "info", "214-555-1212"
objItem.SetInfo
objItem.PutEx ADS_PROPERTY_UPDATE, "otherHomePhone", _
Array("VALUE1", "VALUE2", "...VALUEn")
objItem.SetInfo
objItem.PutEx ADS_PROPERTY_UPDATE, "otherPager", _
Array("VALUE1", "VALUE2", "...VALUEn")
objItem.SetInfo
objItem.PutEx ADS_PROPERTY_UPDATE, "otherMobile", _
Array("VALUE1", "VALUE2", "...VALUEn")
objItem.SetInfo
objItem.PutEx ADS_PROPERTY_UPDATE, "otherFacsimileTelephoneNu
Array("VALUE1", "VALUE2", "...VALUEn")
objItem.SetInfo
objItem.PutEx ADS_PROPERTY_UPDATE, "otherIpPhone", _
Array("VALUE1", "VALUE2", "...VALUEn")
objItem.SetInfo
objItem.Put "title", "Computer User"
objItem.SetInfo
objItem.Put "department", "IT"
objItem.SetInfo
objItem.Put "company", "XXX"
objItem.SetInfo
'See Script Notes for information on setting this value.
objItem.Put "manager", " "
objItem.SetInfo
objItem.SetInfo
%>
This Question has been solved and asker verified All Experts Exchange premium technology solutions are available to subscription members.
Experts Exchange has been collecting answers to technology questions since 1996…3 million and counting! If you have a question, chances are we already have your answer.
If you can't find the exact answer you're looking for, ask our exclusive community of 50,000 experts. You’ll get a personalized answer from a trusted professional.
Thousands of free tech tips, tricks, how-to’s and tutorials are available in our peer reviewed articles section. See for yourself how smart our experts are, no login required.
Access the answers to your technology questions today.
30-day free trial. Register in 60 seconds.
Members of the expert community talk about why the experience at Experts Exchange is different than what you will find anywhere else.

Try it out and discover for yourself.
30-day free trial. Register in 60 seconds.
Join the community of experts here and help other tech pros by answering question in your area of expertise. You can earn FREE access to all Experts Exchange's premium features and resources.
If you explicitly pass the user name and password, ADSI will use that information to bind to your active directory server, that could explains as to why your code worked. And if you pass a null password regardless of user name ADSI will use whatever security context your application is running under.
There are several places to check before kerberos authentication can take place.
(Please read the IIS, IE and active directory section)
http://support.microsoft.c
Also a couple more things to check:
1. "Account is sensitive and cannot be delegated" option for the user account is unselected
2. "Enable computer and user accounts to be trusted for delegation" in Local Security Policty
(or Domain Security Policty) is not accidentally disabled
3. All computers participating in delegation must have the same time settings. Then Time
Zone and "Automatically adjust clock for daylight saving changes" settings have the same
value on all computers where you are going to use Kerberos delegation.
And if you're using mozilla firefox browser, pelase take a look at this
http://blogs.sun.com/rolle
HTH
If I still can remember correctly. In (old) ASP, IIS impersonates the authenticated user by default. So if you have configured properly all the necessary setup for Windows authentication I don't think you need to do anything else in your IIS6.
I maybe have a few more suggestions for you but I think it'd be more helpful if you start from this document.
http://www.microsoft.com/t
Jharper,
I'm not sure if I could find any documentation better than I have posted above as this isn't really a programming issue anymore. And unfortunately I'm not a system admin myself, so I guess I can't further help you on this. You might want to post a new question in Win2K3 and IIS TA that links to here and hopefully someone there could give better suggestions.
Good luck!
Henry
After much investigation, I have concluded that our current environment does not support IIS double-hop authentication. We need to upgrade all of our remaining DCs to Windows 2003 and update to Windows 2003 Functional Level AD. I've just done this and I'll try to get this working again.
Reference 1:
http://www.microsoft.com/t
"Constrained delegation is restricted to services in a single domain. All domain controllers in the domain must be running Windows Server 2003, and the domain must be operating at the Windows Server 2003 functional level."
Reference 2:
http://www.microsoft.com/t
Table 1 Pass-through authentication configuration requirements
Authentication method Additional configuration for pass-through authentication
Basic with SSL
None
Kerberos via Integrated Windows authentication
Constrained delegation <--This is what we are attempting and it requires Windows 2003 Functional Level AD (See Reference 1).
NTLM via Integrated Windows authentication
Constrained delegation and protocol transitioning
Digest
Constrained delegation and protocol transitioning
Client certificate
Constrained delegation and protocol transitioning
I was able to do doulble-hop authentication to a file server after upgrading to Windows Server 2003 Functional Level.
-IIS is using only Windows Integrated Authentiation and the user under the DefaultAppPool is Network Service.
C:\Documents and Settings\jharper>setspn -l XYZ00001
Registered ServicePrincipalNames for CN=XYZ00001,OU=Production,
vers and Computers,DC=xyz,DC=com:
HOST/XYZ00001
HOST/xyz00001.123.com
SMTPSVC/XYZ00001
SMTPSVC/xyz00001.123.com
**Load balanced web servers DefaultAppPool run under hbk\iiskerberos require and additional SPN but the computer account should look like the above.
Reference: http://www.microsoft.com/t
-IIS is using only Windows Integrated Authentiation and the user under the DefaultAppPool is xyz\iisberberos.
C:\Documents and Settings\jharper>setspn -l xyz\iiskerberos
Registered ServicePrincipalNames for CN=iiskerberos,CN=Users,DC
http/mylwebcl1.123.com
HTTP/myweb1.123.com
HTTP/myweb6
HTTP/myweb5
HTTP/myweb6.123.com
HTTP/myweb5.123.com
HTTP/mywebcl1
Business Accounts
Answer for Membership
by: marc_nivensPosted on 2005-06-10 at 23:18:26ID: 14194382
With double hop authentication you have to use Kerberos because NTLM will not work. To setup IIS to use Kerberos, follow this article: http://support.microsoft.c om/?id=326 089. Once you enable Kerberos for IIS, just set the authentication to integrated windows only and leave OpenDSObject() null. Before you were authenticating with NTLM and double hop was failing. Once you're in with Kerberos it shouldn't be a problem. Oh, and make sure you bind to the FQDN of the server or the authentication package will revert back to NTLM.