|
|
You're in the
asp.net security
group:ASP.NET 2.0 WindowsTokenRoleProvider Local Groups Broken
asp.net security:
I've configured the web-site (following directions at http://support.microsoft.com/kb/215383) in the MetaBase to allow NTLM and Negotiate access, and the site itself is using Integrated Windows Authentication and allow-anonymous. I've added an entry to my local HOSTS file, since there is no real domain-name (yet) for the web-site DNS. So, my urls look like http://mysite.com/Admin.aspx, where I've an entry in HOSTS for mysite.com (127.0.0.1). The mysite.com site is in my Local Intranet sites in IE (I put it there) as http://*.mysite.com. I have a local group on the server computer (W2K3) named "Local PAIS Admins". I have added myself to that group, and logged out of Windows and logged back in (to the local machine -- the same computer that is hosting the web site). In web.config, I have a <location> element for the Admin.aspx page: <location path="Admin.aspx"> <system.web> <authorization> <allow roles="COMPUTER-NAME-HERE\Local PAIS Admins" /> <deny users="*" /> </authorization> </system.web> </location> obviously, substituting the actual machine name for COMPUTER-NAME-HERE. If I run with RoleManager enabled in ASP.NET (<roleManager enabled="true" defaultProvider="AspNetWindowsTokenRoleProvider" cacheRolesInCookie="false">), I cannot get access to Admin.aspx, even though I am in that group. I am prompted 3 times for the my credentials, and I enter them correctly. Finally, I get the Access is Denied default error page, with a 401.2 error. If I run with the RoleManager element commented out, it works, and I can see the page. If I add myself to a BUILTIN group (say, Power Users), and change the above <location> element to allow only that BUILTIN group, with RoleManager enalbed for the WindowsTokenRoleProvider, it works. Only BUILTIN groups work though. I've not ever edited any of the C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\CONFIG config files. Can someone explain what is happening? Is this a known ASP.NET WindowsTokenRoleProvider limitation? Am I doing something wrong? I've a production deployment going on a similarly configured site, and we need to use local-machine groups. Thanks in advance, Howard Hoffman
I'm not sure what the problem is, but I would suggest writing some quick
code that takes the WindowsIdentity object for the authenticated user (cast Context.User.Identity to WindowIdentity), take the objects in the Group property (IdentityReferenceCollection) and convert them to NTAccount objects via the Translate method. Then you can look at the names of the groups. That will help identify whether the group really isn't in the token or there is some weird string mismatch problem. Joe K. -- Joe Kaplan-MS MVP Directory Services Programming Co-author of "The .NET Developer's Guide to Directory Services Programming" http://www.directoryprogramming.net -- [quoted text, click to view] "Howard Hoffman" <HowardH@community.nospam> wrote in message news:O2IPx14CIHA.4752@TK2MSFTNGP04.phx.gbl... > I've an IIS6 ASP.NET 2.0 web site (not a virtual directory, a web-site). > > I've configured the web-site (following directions at > http://support.microsoft.com/kb/215383) in the MetaBase to allow NTLM and > Negotiate access, and the site itself is using Integrated Windows > Authentication and allow-anonymous. > > I've added an entry to my local HOSTS file, since there is no real > domain-name (yet) for the web-site DNS. So, my urls look like > http://mysite.com/Admin.aspx, where I've an entry in HOSTS for mysite.com > (127.0.0.1). The mysite.com site is in my Local Intranet sites in IE (I > put it there) as http://*.mysite.com. > > I have a local group on the server computer (W2K3) named "Local PAIS > Admins". I have added myself to that group, and logged out of Windows and > logged back in (to the local machine -- the same computer that is hosting > the web site). > > In web.config, I have a <location> element for the Admin.aspx page: > > <location path="Admin.aspx"> > <system.web> > <authorization> > <allow roles="COMPUTER-NAME-HERE\Local PAIS Admins" /> > <deny users="*" /> > </authorization> > </system.web> > </location> > > obviously, substituting the actual machine name for COMPUTER-NAME-HERE. > > If I run with RoleManager enabled in ASP.NET (<roleManager enabled="true" > defaultProvider="AspNetWindowsTokenRoleProvider" > cacheRolesInCookie="false">), I cannot get access to Admin.aspx, even > though I am in that group. I am prompted 3 times for the my credentials, > and I enter them correctly. Finally, I get the Access is Denied default > error page, with a 401.2 error. > > If I run with the RoleManager element commented out, it works, and I can > see the page. > > If I add myself to a BUILTIN group (say, Power Users), and change the > above <location> element to allow only that BUILTIN group, with > RoleManager enalbed for the WindowsTokenRoleProvider, it works. Only > BUILTIN groups work though. > > I've not ever edited any of the > C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\CONFIG config files. > > Can someone explain what is happening? Is this a known ASP.NET > WindowsTokenRoleProvider limitation? Am I doing something wrong? > > I've a production deployment going on a similarly configured site, and we > need to use local-machine groups. > > Thanks in advance, > > Howard Hoffman >
Joe -
I appreciate your response, but I don't see how it helps me. There is no Group property on the WindowsIdentity object in .NET 2.0, is there? I can certainly instantiate a new NTIdentity object from the HttpContext.Current.User.Identity.Name (and domain) just fine. So, there is a real-SID for the user-name. Where do we go from here? There is no copy / paste error - I put the group name on the clipboard in Computer Management / Local Users and Groups / Groups, and pasted that into Web.config. Thanks in advance, Howard Hoffman [quoted text, click to view] "Joe Kaplan" <joseph.e.kaplan@removethis.accenture.com> wrote in message news:ufRXXK6CIHA.4308@TK2MSFTNGP06.phx.gbl... > I'm not sure what the problem is, but I would suggest writing some quick > code that takes the WindowsIdentity object for the authenticated user > (cast Context.User.Identity to WindowIdentity), take the objects in the > Group property (IdentityReferenceCollection) and convert them to NTAccount > objects via the Translate method. Then you can look at the names of the > groups. That will help identify whether the group really isn't in the > token or there is some weird string mismatch problem. > > Joe K. > > -- > Joe Kaplan-MS MVP Directory Services Programming > Co-author of "The .NET Developer's Guide to Directory Services > Programming" > http://www.directoryprogramming.net > -- > "Howard Hoffman" <HowardH@community.nospam> wrote in message > news:O2IPx14CIHA.4752@TK2MSFTNGP04.phx.gbl... >> I've an IIS6 ASP.NET 2.0 web site (not a virtual directory, a web-site). >> >> I've configured the web-site (following directions at >> http://support.microsoft.com/kb/215383) in the MetaBase to allow NTLM and >> Negotiate access, and the site itself is using Integrated Windows >> Authentication and allow-anonymous. >> >> I've added an entry to my local HOSTS file, since there is no real >> domain-name (yet) for the web-site DNS. So, my urls look like >> http://mysite.com/Admin.aspx, where I've an entry in HOSTS for mysite.com >> (127.0.0.1). The mysite.com site is in my Local Intranet sites in IE (I >> put it there) as http://*.mysite.com. >> >> I have a local group on the server computer (W2K3) named "Local PAIS >> Admins". I have added myself to that group, and logged out of Windows >> and logged back in (to the local machine -- the same computer that is >> hosting the web site). >> >> In web.config, I have a <location> element for the Admin.aspx page: >> >> <location path="Admin.aspx"> >> <system.web> >> <authorization> >> <allow roles="COMPUTER-NAME-HERE\Local PAIS Admins" /> >> <deny users="*" /> >> </authorization> >> </system.web> >> </location> >> >> obviously, substituting the actual machine name for COMPUTER-NAME-HERE. >> >> If I run with RoleManager enabled in ASP.NET (<roleManager enabled="true" >> defaultProvider="AspNetWindowsTokenRoleProvider" >> cacheRolesInCookie="false">), I cannot get access to Admin.aspx, even >> though I am in that group. I am prompted 3 times for the my credentials, >> and I enter them correctly. Finally, I get the Access is Denied default >> error page, with a 401.2 error. >> >> If I run with the RoleManager element commented out, it works, and I can >> see the page. >> >> If I add myself to a BUILTIN group (say, Power Users), and change the >> above <location> element to allow only that BUILTIN group, with >> RoleManager enalbed for the WindowsTokenRoleProvider, it works. Only >> BUILTIN groups work though. >> >> I've not ever edited any of the >> C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\CONFIG config files. >> >> Can someone explain what is happening? Is this a known ASP.NET >> WindowsTokenRoleProvider limitation? Am I doing something wrong? >> >> I've a production deployment going on a similarly configured site, and we >> need to use local-machine groups. >> >> Thanks in advance, >> >> Howard Hoffman >> > >
There is a Groups property:
http://msdn2.microsoft.com/en-us/library/system.security.principal.windowsidentity.groups.aspx Joe K. -- Joe Kaplan-MS MVP Directory Services Programming Co-author of "The .NET Developer's Guide to Directory Services Programming" http://www.directoryprogramming.net -- [quoted text, click to view] "Howard Hoffman" <HowardH@community.nospam> wrote in message news:uSK3gYADIHA.4712@TK2MSFTNGP04.phx.gbl... > Joe - > > I appreciate your response, but I don't see how it helps me. > > There is no Group property on the WindowsIdentity object in .NET 2.0, is > there? > I can certainly instantiate a new NTIdentity object from the > HttpContext.Current.User.Identity.Name (and domain) just fine. > So, there is a real-SID for the user-name. Where do we go from here? > > There is no copy / paste error - I put the group name on the clipboard in > Computer Management / Local Users and Groups / Groups, and pasted that > into Web.config. > > Thanks in advance, > > Howard Hoffman > > "Joe Kaplan" <joseph.e.kaplan@removethis.accenture.com> wrote in message > news:ufRXXK6CIHA.4308@TK2MSFTNGP06.phx.gbl... >> I'm not sure what the problem is, but I would suggest writing some quick >> code that takes the WindowsIdentity object for the authenticated user >> (cast Context.User.Identity to WindowIdentity), take the objects in the >> Group property (IdentityReferenceCollection) and convert them to >> NTAccount objects via the Translate method. Then you can look at the >> names of the groups. That will help identify whether the group really >> isn't in the token or there is some weird string mismatch problem. >> >> Joe K. >> >> -- >> Joe Kaplan-MS MVP Directory Services Programming >> Co-author of "The .NET Developer's Guide to Directory Services >> Programming" >> http://www.directoryprogramming.net >> -- >> "Howard Hoffman" <HowardH@community.nospam> wrote in message >> news:O2IPx14CIHA.4752@TK2MSFTNGP04.phx.gbl... >>> I've an IIS6 ASP.NET 2.0 web site (not a virtual directory, a web-site). >>> >>> I've configured the web-site (following directions at >>> http://support.microsoft.com/kb/215383) in the MetaBase to allow NTLM >>> and Negotiate access, and the site itself is using Integrated Windows >>> Authentication and allow-anonymous. >>> >>> I've added an entry to my local HOSTS file, since there is no real >>> domain-name (yet) for the web-site DNS. So, my urls look like >>> http://mysite.com/Admin.aspx, where I've an entry in HOSTS for >>> mysite.com (127.0.0.1). The mysite.com site is in my Local Intranet >>> sites in IE (I put it there) as http://*.mysite.com. >>> >>> I have a local group on the server computer (W2K3) named "Local PAIS >>> Admins". I have added myself to that group, and logged out of Windows >>> and logged back in (to the local machine -- the same computer that is >>> hosting the web site). >>> >>> In web.config, I have a <location> element for the Admin.aspx page: >>> >>> <location path="Admin.aspx"> >>> <system.web> >>> <authorization> >>> <allow roles="COMPUTER-NAME-HERE\Local PAIS Admins" /> >>> <deny users="*" /> >>> </authorization> >>> </system.web> >>> </location> >>> >>> obviously, substituting the actual machine name for COMPUTER-NAME-HERE. >>> >>> If I run with RoleManager enabled in ASP.NET (<roleManager >>> enabled="true" defaultProvider="AspNetWindowsTokenRoleProvider" >>> cacheRolesInCookie="false">), I cannot get access to Admin.aspx, even >>> though I am in that group. I am prompted 3 times for the my >>> credentials, and I enter them correctly. Finally, I get the Access is >>> Denied default error page, with a 401.2 error. >>> >>> If I run with the RoleManager element commented out, it works, and I can >>> see the page. >>> >>> If I add myself to a BUILTIN group (say, Power Users), and change the >>> above <location> element to allow only that BUILTIN group, with >>> RoleManager enalbed for the WindowsTokenRoleProvider, it works. Only >>> BUILTIN groups work though. >>> >>> I've not ever edited any of the >>> C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\CONFIG config files. >>> >>> Can someone explain what is happening? Is this a known ASP.NET >>> WindowsTokenRoleProvider limitation? Am I doing something wrong? >>> >>> I've a production deployment going on a similarly configured site, and >>> we need to use local-machine groups. >>> >>> Thanks in advance, >>> >>> Howard Hoffman >>> >> >> > >
Does this help you out? <deny users="*" /> might be killing <allow roles="COMPUTER-NAME-HERE\Local PAIS Admins" /> <location path="Admin.aspx"> <system.web> <authorization> <deny users="*" /> <allow roles="COMPUTER-NAME-HERE\Local PAIS Admins" /> </authorization> </system.web> </location> [quoted text, click to view] "Howard Hoffman" <HowardH@community.nospam> wrote in message news:O2IPx14CIHA.4752@TK2MSFTNGP04.phx.gbl... > I've an IIS6 ASP.NET 2.0 web site (not a virtual directory, a web-site). > > I've configured the web-site (following directions at > http://support.microsoft.com/kb/215383) in the MetaBase to allow NTLM and > Negotiate access, and the site itself is using Integrated Windows > Authentication and allow-anonymous. > > I've added an entry to my local HOSTS file, since there is no real > domain-name (yet) for the web-site DNS. So, my urls look like > http://mysite.com/Admin.aspx, where I've an entry in HOSTS for mysite.com > (127.0.0.1). The mysite.com site is in my Local Intranet sites in IE (I > put it there) as http://*.mysite.com. > > I have a local group on the server computer (W2K3) named "Local PAIS > Admins". I have added myself to that group, and logged out of Windows and > logged back in (to the local machine -- the same computer that is hosting > the web site). > > In web.config, I have a <location> element for the Admin.aspx page: > > <location path="Admin.aspx"> > <system.web> > <authorization> > <allow roles="COMPUTER-NAME-HERE\Local PAIS Admins" /> > <deny users="*" /> > </authorization> > </system.web> > </location> > > obviously, substituting the actual machine name for COMPUTER-NAME-HERE. > > If I run with RoleManager enabled in ASP.NET (<roleManager enabled="true" > defaultProvider="AspNetWindowsTokenRoleProvider" > cacheRolesInCookie="false">), I cannot get access to Admin.aspx, even > though I am in that group. I am prompted 3 times for the my credentials, > and I enter them correctly. Finally, I get the Access is Denied default > error page, with a 401.2 error. > > If I run with the RoleManager element commented out, it works, and I can > see the page. > > If I add myself to a BUILTIN group (say, Power Users), and change the > above <location> element to allow only that BUILTIN group, with > RoleManager enalbed for the WindowsTokenRoleProvider, it works. Only > BUILTIN groups work though. > > I've not ever edited any of the > C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\CONFIG config files. > > Can someone explain what is happening? Is this a known ASP.NET > WindowsTokenRoleProvider limitation? Am I doing something wrong? > > I've a production deployment going on a similarly configured site, and we > need to use local-machine groups. > > Thanks in advance, > > Howard Hoffman >
IIRC
if you use the WindowsTokenRoleProvider you have to omit the machine name for local groups. Why do you use the provider at all? I wrote about it here: http://www.leastprivilege.com/SearchView.aspx?q=TokenRole but meanwhile i came to the conclusion that all the optimization is also done by the LSA - so i really not see the point of this provider at all. ----- Dominick Baier (http://www.leastprivilege.com) Developing More Secure Microsoft ASP.NET 2.0 Applications (http://www.microsoft.com/mspress/books/9989.asp) [quoted text, click to view] > I've an IIS6 ASP.NET 2.0 web site (not a virtual directory, a > web-site). > > I've configured the web-site (following directions at > http://support.microsoft.com/kb/215383) in the MetaBase to allow NTLM > and Negotiate access, and the site itself is using Integrated Windows > Authentication and allow-anonymous. > > I've added an entry to my local HOSTS file, since there is no real > domain-name (yet) for the web-site DNS. So, my urls look like > http://mysite.com/Admin.aspx, where I've an entry in HOSTS for > mysite.com (127.0.0.1). The mysite.com site is in my Local Intranet > sites in IE (I put it there) as http://*.mysite.com. > > I have a local group on the server computer (W2K3) named "Local PAIS > Admins". I have added myself to that group, and logged out of Windows > and logged back in (to the local machine -- the same computer that is > hosting the web site). > > In web.config, I have a <location> element for the Admin.aspx page: > > <location path="Admin.aspx"> > <system.web> > <authorization> > <allow roles="COMPUTER-NAME-HERE\Local PAIS Admins" /> > <deny users="*" /> > </authorization> > </system.web> > </location> > obviously, substituting the actual machine name for > COMPUTER-NAME-HERE. > > If I run with RoleManager enabled in ASP.NET (<roleManager > enabled="true" defaultProvider="AspNetWindowsTokenRoleProvider" > cacheRolesInCookie="false">), I cannot get access to Admin.aspx, even > though I am in that group. I am prompted 3 times for the my > credentials, and I enter them correctly. Finally, I get the Access is > Denied default error page, with a 401.2 error. > > If I run with the RoleManager element commented out, it works, and I > can see the page. > > If I add myself to a BUILTIN group (say, Power Users), and change the > above <location> element to allow only that BUILTIN group, with > RoleManager enalbed for the WindowsTokenRoleProvider, it works. Only > BUILTIN groups work though. > > I've not ever edited any of the > C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\CONFIG config files. > > Can someone explain what is happening? Is this a known ASP.NET > WindowsTokenRoleProvider limitation? Am I doing something wrong? > > I've a production deployment going on a similarly configured site, and > we need to use local-machine groups. > > Thanks in advance, > > Howard Hoffman >
It's been a while since I could get back to this issue.
Still stuck. I have to use a RoleProvider because of other needs in the application = -- there's another library that leverages RolePrincipal for = authorization. I have confirmed, via the code that Joe Kaplans suggested, that the = current user is indeed in the group listed in the <location> element. = In fact, I copied and pasted from the output-log of Groups to web.config = for the next run I've tried=20 <location path=3D"Admin.aspx"> <system.web> <authorization> <allow roles=3D"MACHINE-NAME\GroupName" /> <deny users=3D"*" /> </authorization> </system.web> </location> but that does not work, though at Global.asax Application_EndRequest = time, the HttpContext.Current.User contains a WindowsIdentity that I can = query Groups (via Joe's corrective example) on. Application_EndRequest is called 2 times in this case -- once with an = non-Authenticated HttpContext.Current.User.Identity (a WindowsIdentity), = and the other with a properly constructed, authenticated assigned value. = Indeed, that is the instance of User.Identity that has the group in the = list. This results in 401.1. In between the 2 calls, IE pops for = credentials, and I enter valid credentials. If I remove the MACHINE-NAME from the above configuration, = Application_EndRequest is only called 1 time, without an authenticated = identity. IE still pops for credentials here. The data still appears to show a limitation, near as I can tell. Any and all guidance appreciated. Howard Hoffman .. "Dominick Baier" <dbaier@pleasepleasenospam_leastprivilege.com> wrote in = message news:8e6a913a16b728c9dc90bd3b0b30@news.microsoft.com... [quoted text, click to view] > IIRC
>=20 > if you use the WindowsTokenRoleProvider you have to omit the machine = name=20 > for local groups. >=20 > Why do you use the provider at all? >=20 > I wrote about it here: > http://www.leastprivilege.com/SearchView.aspx?q=3DTokenRole >=20 > but meanwhile i came to the conclusion that all the optimization is = also=20 > done by the LSA - so i really not see the point of this provider at = all. >=20 >=20 > ----- > Dominick Baier (http://www.leastprivilege.com) >=20 > Developing More Secure Microsoft ASP.NET 2.0 Applications = (http://www.microsoft.com/mspress/books/9989.asp) >=20 >> I've an IIS6 ASP.NET 2.0 web site (not a virtual directory, a >> web-site). >>=20 >> I've configured the web-site (following directions at >> http://support.microsoft.com/kb/215383) in the MetaBase to allow NTLM >> and Negotiate access, and the site itself is using Integrated Windows >> Authentication and allow-anonymous. >>=20 >> I've added an entry to my local HOSTS file, since there is no real >> domain-name (yet) for the web-site DNS. So, my urls look like >> http://mysite.com/Admin.aspx, where I've an entry in HOSTS for >> mysite.com (127.0.0.1). The mysite.com site is in my Local Intranet >> sites in IE (I put it there) as http://*.mysite.com. >>=20 >> I have a local group on the server computer (W2K3) named "Local PAIS >> Admins". I have added myself to that group, and logged out of = Windows >> and logged back in (to the local machine -- the same computer that is >> hosting the web site). >>=20 >> In web.config, I have a <location> element for the Admin.aspx page: >>=20 >> <location path=3D"Admin.aspx"> >> <system.web> >> <authorization> >> <allow roles=3D"COMPUTER-NAME-HERE\Local PAIS Admins" /> >> <deny users=3D"*" /> >> </authorization> >> </system.web> >> </location> >> obviously, substituting the actual machine name for >> COMPUTER-NAME-HERE. >>=20 >> If I run with RoleManager enabled in ASP.NET (<roleManager >> enabled=3D"true" defaultProvider=3D"AspNetWindowsTokenRoleProvider" >> cacheRolesInCookie=3D"false">), I cannot get access to Admin.aspx, = even >> though I am in that group. I am prompted 3 times for the my >> credentials, and I enter them correctly. Finally, I get the Access = is >> Denied default error page, with a 401.2 error. >>=20 >> If I run with the RoleManager element commented out, it works, and I >> can see the page. >>=20 >> If I add myself to a BUILTIN group (say, Power Users), and change the >> above <location> element to allow only that BUILTIN group, with >> RoleManager enalbed for the WindowsTokenRoleProvider, it works. Only >> BUILTIN groups work though. >>=20 >> I've not ever edited any of the >> C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\CONFIG config files. >>=20 >> Can someone explain what is happening? Is this a known ASP.NET >> WindowsTokenRoleProvider limitation? Am I doing something wrong? >>=20 >> I've a production deployment going on a similarly configured site, = and >> we need to use local-machine groups. >>=20 >> Thanks in advance, >>=20 >> Howard Hoffman >>=20 >=20
Don't see what you're looking for? Try a search.
|
July 2003
August 2003
September 2003
October 2003
November 2003
December 2003
January 2004
February 2004
March 2004
April 2004
May 2004
June 2004
July 2004
August 2004
September 2004
October 2004
November 2004
December 2004
January 2005
February 2005
March 2005
April 2005
May 2005
June 2005
July 2005
August 2005
September 2005
October 2005
November 2005
December 2005
January 2006
February 2006
March 2006
April 2006
May 2006
June 2006
July 2006
August 2006
September 2006
October 2006
November 2006
December 2006
January 2007
February 2007
March 2007
April 2007
May 2007
June 2007
July 2007
August 2007
September 2007
October 2007
November 2007
December 2007
January 2008
February 2008
March 2008
April 2008
May 2008
June 2008
| home · blog · groups | Questions? Comments? Contact the dn |