An alias is associated with the ip address of my website, e.g.
ip address of my site = 10.75.XXX.XXX
alias = mywebsitehosting.com
The S.O. is Windows Server 2008 and IIS 7
If getting on the browser:
http://10.75.XXX.XXX/aspnet/
the server recognize correctly my user page identity
Instead if getting on the browser:
http://mywebsitehosting.com/aspnet/
the server recognize me as administrator...
It's really strange because this problem only occurs with my account
All other accounts are properly recognized
The user page identity from AUTH_USER and this is the return of webpage
AUTH_USER: NameOfServer\Administrator
LOGON_USER: NameOfServer\Administrator
REMOTE_USER: NameOfServer\Administrator
The server is part of a corporate intranet and I think register the alias on Local AD DNS
I did not perform the association alias ip address...
These are application pool identity
ASP.NET v4.0 > Integrated
ASP.NET v4.0 Classic > Classic
Classic .NET AppPool > Integrated
DefaultAppPool > Integrated
DataTablesAppPool > Integrated (for NET CORE Application MVC)
and authentication
anonymous authentication enabled
basic authentication enabled
windows authentication enabled
all other authentication disabled
what is the problem ?
Depends on what?
Related
I published a Blazor (Server side) application with Windows Authentication to IIS. I disabled "Anonymous Authentication" and enabled "Windows Authentication".
The application can display the login information ("Hello, Domain\Username!") correctly. The application connects to SQL Server using Windows integrate mode.
"ConnectionStrings": {
"MyDatabase": "Server=DBServer;Database=DB1;Trusted_Connection=True"
}
However, it uses the system account (which is used to run IIS?) to connect the SQL Server.
Login failed for user 'Domain\IISMachineName$'.
I tried to enable "ASP.NET Impersonation" for the IIS site and it gets the 500.24 error.
HTTP Error 500.24 - Internal Server Error
An ASP.NET setting has been detected that does not apply in Integrated managed pipeline mode.
Most likely causes:
• system.web/identity#impersonate is set to true.
It depends on your hosting and the location of your SQL server, as you say you host in IIS it takes the application pool like any other webservice hosted in IIS.
If SQL Server is on the same server then you can assign the application pool.
You can add the application pool to your SQL Database as a Login and user.
CREATE LOGIN [IIS APPPOOL\MyBlazorAppPool] FROM WINDOWS;
CREATE USER MyBlazorAppPool FOR LOGIN [IIS APPPOOL\MyBlazorAppPool];
On a defend machine you can simply create the machine hosting your blazor app as a user.
CREATE LOGIN [computername$] FROM WINDOWS;
I'm trying to set up impersonation/delegation for a web application using ASP.NET 4.5/SQL Server 2016. The goal is to use the Windows authentication on the web application and the SQL Server.
I reproduced on Azure a setup similar to the one which will be used for production, but I can't seem to find what is making the impersonation not working.
Azure VM #1 [machine name: test-iis-server]: Windows Server 2012 running IIS 8.5 and acting as Active Directory Domain Controller
Azure VM #2 [machine name: test-sql-server]: Windows Server 2016 running SQL Server 2016
Azure VM #3 [machine name: test-client]: Windows 10 machine for simulating a user connecting to the website
I created an Active Directory domain named TEST. It is possible to connect to the 3 machines with users created in Active Directory.
IIS Web server configuration:
In the web.config file:
Authentication mode = Windows
Identity impersonate = True
validation validateIntegratedModeConfiguration = False
Integrated security = SSPI
In IIS Manager:
Windows authentication = Enabled (Kernel-mode authentication = Disabled, Providers = Negotiate:Kerberos)
ASP.NET Impersonation = Enabled
Application pool = Integrated Managed Pipeline (Identity = Custom Identity: test\my-svc-account)
In Active Directory Users & Computers
For each computers (web server, sql server and user computer), I went into Properties and checked in the Delegation tab Trust this
computer for delegation to any service (Kerberos only).
SQL Server Configuration
I did not setup anything here. I assumed that ASP.NET will use the credentials of the user logged in the web application to access the
SQL Server database.
Edit: SQL Server service account: test\my-svc-account
Results:
If I don't use impersonation in the web application and use a defined user/pwd login created in SQL Server, my application works normally and I can get the Windows user credential if I want.
Using impersonation, I get a SQL Server connection error when I open the web application page: Login failed for user 'TEST\test-iis-server$'.
Expected behavior:
The web application will log into SQL Server using the credentials used to log into the "test-client" machine.
I've read a lot on how to implement the impersonation/delegation for my solution, but can't seem to find what's wrong. Anyone has any idea where the proble might come from and how I can resolve it?
Edit #1:
From what I've read, it seems like I need to setup SPNs. I'm confused about how to set them up correctly for my double-hop scenario.
I have created a user account in Active Directory to act as a service account. I've set this account to be trusted for delegation.
I use this account as the identity for my application pool in IIS and as the service account of the SQL Server instance.
Yes, you do need to configure SPNs for both the ASP.NET app pool identity, and the SQL Server service account.
It's relatively straightforward, but you need to make sure you get the right values.
In AD Users and Computers find the 'my-svc-account' account and open the properties. Navigate to the attribute editor tab (if you don't see it, enable advanced features through the ADUC 'View' menu). Find the servicePrincipalName attribute and edit it. Add the following:
http/servicename.foo.com
http/servername <== optional
Where service.foo.com matches your DNS name. If this is a CNAME, you need to also include the underlying A record name as well. So if servicename.foo.com maps to whatever.cloudapp.net, you need to add an SPN for whatever.cloudapp.net. This is for IE, because IE is ...dumb... and trying to be smart (it resolves the DNS down to lowest named record and requests an SPN for that).
Then do the same for the SQL Server service account.
MSSQLSvc/sqlserver.foo.com
MSSQLSvc/sqlserver <== optional
This needs to be the FQDN of the SQL Server host.
Lastly, you need to enable Constrained Delegation between the App Pool identity and the SQL Server service account. This is the 3rd radio button in the delegation control. Add the SQL Server SPN as a delegated target.
Restart IIS and SQL. Try browsing to the app. You should now see it connect to SQL as your named user.
On IIS 8.5, the only authentication method I have enabled is Windows Authentication, with Negotiate and NTLM. When I use a connection string in any ASP.NET application, running under an app pool who's identity is a domain account, I'm able to connect fine. In classic asp I get:
Microsoft OLE DB Provider for SQL Server error '80040e4d'
Login failed for user 'NT AUTHORITY\ANONYMOUS LOGON'.
As far as I know the servers aren't configured for delegation, and I didn't explicitly set the SPN. I'm accessing the box via the FQDN which is netbiosname.mydomain.com .
Why is it working in ASP.NET, but failing in classic asp? Am I experiencing the double hop? Is there a way to confirm it is in fact the double hop?
Here's the error I'm getting:
Microsoft OLE DB Provider for SQL Server error '80040e4d'
Login failed for user 'NT AUTHORITY\ANONYMOUS LOGON'.
I found out how to resolve this issue, I believe the last step was the only one that helped, but here's what I did:
Disabled all authentication methods other than Windows Authentication
In IIS Manager, I used the "Convert to Application" option to mark
the folder containing the classic asp code as an application
Assigned the application to app pool running under AD account with access to SQL server
Enabled 32-Bit application support on the app pool
Set pipeline mode to integrated for app pool
At this point I still was getting the same error
I right clicked on the application and set the Physical Path Credentials to the same domain account that the app pool runs under and everything started to work correctly
I would imagine you need to set the classic asp IIS website to run as the domain account you're using for integrated security.
To get ASP to connect to the database, in IIS 6, Directory Security -> Authentication Methods, Under Enable Anonymous Access, I set the anonymous access account to the AD account with permissions to the database.
i was tearing my hair out for a while. then i tried creating a windows user account, with the proper permissions in SQL Server, and used "Integrated Security=SSPI" in the connection string. it worked like a charm - no AD required:
SQLconnex = "PROVIDER=SQLOLEDB;DATA SOURCE={server};DATABASE={db};UID={uid};PWD={pwd};Integrated Security=SSPI"
hope it helps and saves your hair.
In my case to solve it I set the "anonymous authentication" the use of the "application pool identity".
Sites > Authentication > anonymous authentication > Edit > application pool identity
I have setup Active Directory in a VM and added some users into it. I used Windows 2008 core edition to setup the AD. Now to test my asp.net application, I created a sample page and configured in IIS. So when we call this page windows security window will be called and ask for username and passowrd.
My requirement is type the username and password which i specified inside AD. I provide username in the security window, something like:
test.ca/username
where test.ca is the domain name for AD. My problem is username is not getting accessed from VM and authentication fails and the username/pwd window prompts again.
Any one has suggestions?
Regards
Sangeetha
The machine running IIS must be joined to the Active Directory domain in order to use Integrated authentication with domain accounts.
If the machine running IIS cannot be joined to the domain, then you would need to use Forms authentication instead. Then, your ASP.NET application could, for example, validate the user's credentials against AD using the classes in the System.DirectoryServices namespace.
Question - Will I be able to access a Asp.net website on IIS 7 with integrated windows authentication enabled from outside the domain?
Thks
Yes - browser will typically prompt for your windows credentials. User name has to be provided as [Domain Name]/[Login Name] format where domain name will be target domain (i.e. domain known (and trusted) by your web server).