Solved

LDAP query - advanced permission/authentication issue

Posted on 2006-07-10
2
2,060 Views
Last Modified: 2007-12-19
I have an LDAP query that works fine by default.  We are invoking via a webservice.  We then went into IIS and made the directory use Integrated Windows Authentication.

Still no problem.

We then wanted to be able to read the windows identity of the user logged in.  So we added a new webconfig inside the parent folder (which only contains the webservice) that is as follows:

<?xml version="1.0"?>
<configuration>
    <appSettings/>
    <connectionStrings/>
    <system.web>
                  <identity impersonate="true"/>
    </system.web>
</configuration>

Now - we can successfully read the username of the person logged in, but the LDAP query fails.
The error we get is:
================================================
System.Runtime.InteropServices.COMException: An operations error occurred.

   at System.DirectoryServices.DirectoryEntry.Bind(Boolean throwIfFail)
   at System.DirectoryServices.DirectoryEntry.Bind()
   at System.DirectoryServices.DirectoryEntry.get_IsContainer()
   at System.DirectoryServices.DirectoryEntries.ChildEnumerator..ctor(DirectoryEntry container)
   at System.DirectoryServices.DirectoryEntries.GetEnumerator()
... more stack of our specific code
================================================

If we go to the LDAP query code and add in

de.Username = "adminuser";
de.Password = "P@ssword";

then it works.

But if we use any user that is not an admin it does not work.

Therefore we think that the problem is with the account that is being used to access the webservice.

The goal here is to restrict the webservice to only allow certain windows accounts to run it within our network.  We test the identity in the webservice constructor.  I know there are other ways, but for now we need to go with this option as the other methods of WSE etc have caused other issues.

So it works without that web.config or with the web.config with an admin account hardcoded in (which we don't want either).  It does not work if an admin account is passed in through the windows identity.

Is there a way that we can get this to work without hard-coding in a username and password to the directory entry and still being able to read in the windows identity of the user in the constructor of the webservice?  Note - it is not possible to turn this directory into its own .NET Application.

We also do not want to send in the password to the webservice to then feed into the DirectoryEntry.

It just seems strange that the same account if using Windows Authentication doesnot work, but hardcoded in does work.

Maybe is there a way to tell the DirectoryEntry to use anonymous LDAP query?  How was it working before we added the web.config file?  Was it using an anonymous LDAP query before we added the web.config file?  If so is there a way to revert the LDAP query back to being anonymous?

PS all the LDAP query is doing is reading a list of users within a specific group.

Thanks
0
Comment
Question by:mrichmon
2 Comments
 
LVL 35

Accepted Solution

by:
mrichmon earned 0 total points
ID: 17084412
Working off of this article:
http://support.microsoft.com/?kbid=306158

I was able to determine that we can remove the web.config file and then programatically change the security context to the currently authenticated user, then revert back to the nt authority\network service account for the LDAP portion.

Basically the code is as follows:

// Change the security context to the currently logged in user from the nt authority\network service context
            System.Security.Principal.WindowsImpersonationContext impersonationContext = ((System.Security.Principal.WindowsIdentity)User.Identity).Impersonate();

// Code that needs the current user goes here such as
string username = WindowsIdentity.GetCurrent().Name;

// Revert back to normal context (i.e.  nt authority\network service account)
impersonationContext.Undo();

// Code for LDAP.
0

Featured Post

Better Security Awareness With Threat Intelligence

See how one of the leading financial services organizations uses Recorded Future as part of a holistic threat intelligence program to promote security awareness and proactively and efficiently identify threats.

Join & Write a Comment

Extention Methods in C# 3.0 by Ivo Stoykov C# 3.0 offers extension methods. They allow extending existing classes without changing the class's source code or relying on inheritance. These are static methods invoked as instance method. This…
We all know that functional code is the leg that any good program stands on when it comes right down to it, however, if your program lacks a good user interface your product may not have the appeal needed to keep your customers happy. This issue can…
It is a freely distributed piece of software for such tasks as photo retouching, image composition and image authoring. It works on many operating systems, in many languages.
When you create an app prototype with Adobe XD, you can insert system screens -- sharing or Control Center, for example -- with just a few clicks. This video shows you how. You can take the full course on Experts Exchange at http://bit.ly/XDcourse.

747 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

15 Experts available now in Live!

Get 1:1 Help Now