When I was writing the custom page using tridion 2011 core services from my local, I used my tridion credential to access the core services webservice.
Now when everything is done on my local :), I published my website and simply did below things on the Tridion CM server.
In the IIS I created new aplication website with name "CoreServices"
Used the application pool using Network USer
Copied my published website in the coreservice mapped folder.
Removed my credential from web config and implemented logic to read the user details who is accessing the website/custom page
Now when I am trying to access the coreservice website, I am getting below error
Access is denied for the user NT AUTHORITY\NETWORK SERVICE.
Description: An unhandled exception occurred during the execution of the current web request. Please review the stack trace for more information about the error and where it originated in the code.
Exception Details: System.ServiceModel.FaultException`1[[Tridion.ContentManager.CoreService.Client.CoreServiceFault, Tridion.ContentManager.CoreService.Client, Version=6.1.0.996, Culture=neutral, PublicKeyToken=ddfc895746e5ee6b]]: Access is denied for the user NT AUTHORITY\NETWORK SERVICE.
please suggest!!
EDIT: I can see NT AUTHORITY\NETWORK SERVICE is been already added to my Tridion MMC, please below screenshot:
This message indicates that the core service is being successfully called by your code and that your network credentials are successfully recognised, but that Tridion isn't granting access. There are two possible scenarios here:
You wish Tridion to use the NETWORK SERVICE identity as the Trustee under which to act. In this case, NETWORK SERVICE would be added as a User. This would be an unusual configuration, as you will commonly want NETWORK SERVICE to be an impersonation user for other purposes.
You wish to connect to Tridion as NETWORK SERVICE, but then have Tridion act as a different Trustee. In this scenario, NETWORK SERVICE should be configured as an impersonation user in the management snap-in, and you must call the Impersonate method as described in the question John linked to (Tridion CoreService Authentication/Impersonation)
The second of these two approaches is almost certainly what you want. I've really only described the first by way of explanation.
try this if it works for you, I haven't tried this so not sure that it will work
var remoteAddress = new EndpointAddress(Settings.EndpointAddress);
ProxyClient = new CoreServiceClient(basicHttpBinding, remoteAddress);
ProxyClient.ClientCredentials.Windows.AllowNtlm = true;
ProxyClient.ClientCredentials.Windows.ClientCredential = System.Net.CredentialCache.DefaultNetworkCredentials;
ProxyClient.ClientCredentials.Windows.AllowedImpersonationLevel = System.Security.Principal.TokenImpersonationLevel.Impersonation;
Related
My company just finish set up a reporting services server 2017.
The service run under a domain name.
At the same server, an IIS has been setup to run a web application in ASP.NET which will server the report from a report viewer. The IIS is currently running with default App Pool.
GOAL : We want client to be able to access the report from the web application without having to fill in the username and password from anywhere be it on intranet or internet.
Before this, we have ssrs 2008 with similar setup but for authentication we go with anonymous authentication, which is what we want, they can view report from anywhere.
But from microsoft site, they stated that authentication isn't supported anymore in the latest version, and we have tried doing it which results in error 401: Unauthorized.
Currently, I'm trying to do a kerberos authentication,
Things that I have done :
SPN for reporting services account.
Delegation for reporting services account.
Web application web.config I've added authentication mode="Windows" identity impersonate="true"
On IIS, I've enabled windows authentication and impersonate.
But when I try to request a report from the web application, I still got the prompt for username and password, when I fill in my domain and password, I still got the same error 401: Unauthorized.
Am I doing something wrong? Is Kerberos really suitable for my GOAL?
Thanks in advance.
EDIT : Sorry, If I am posting in the wrong section. I don't know where is the correct section for this question.
When you are planning to deploy the reporting service on the internet its batter to use the custom authentication instead of the windows authentication. Creating a custom authentication extension requires custom code and expertise in ASP.NET security.
If you do not want to code a custom authentication extension, you can use Microsoft Active Directory groups and accounts, but you should greatly reduce the scope of a report server deployment. The following guidelines describe how to support this scenario:
Create a low-privileged domain user account with read-only permissions. The account must have access to the computer hosting the report server. Provide a custom Web form so that users can log on using the low-privileged domain account.
Create role assignments that map the user account to specific items in the report server folder hierarchy. You can limit access to read-only operations by choosing as the role assignment the Browser predefined role.
Configure reports to use stored credentials to get data for the report. This approach is useful if you want to query the external data source using an account that is different from the account that allows access to the report server.
you could refer to the below links for more detail:
https://learn.microsoft.com/en-us/previous-versions/sql/sql-server-2005/bb283249(v=sql.90)?redirectedfrom=MSDN#configuring-authentication-for-extranet-and-internet-access
https://learn.microsoft.com/en-us/sql/reporting-services/security/authentication-with-the-report-server?view=sql-server-ver15
https://forums.asp.net/t/2095478.aspx?401+Unauthorized+SSRS+authentication+from+NET+IIS
https://forums.asp.net/t/1273411.aspx?Setting+up+Reporting+Services+with+IIS+Access+Denied+Error
I have an asp.net application running in IIS using the account which has access to my database. With windows authentication, I am able to log into this account in sql server manager and other things. In my connection string, I have Integrated Security=true, and the error message I get when loading a page using this connection string references the correct user. (Not 'IIS APPPOOL\ect...' like all the other instances of this question I have found on SO). Is there something else that can cause this issue? I just dont understand why I am able to log in with the same windows account in other applications.
can anyone help me on connection strings using custom service account.
I have gone through the MSDN guidance on connect to SQL Server using Windows authentication
but somehow unable to figure out how to get the custom service account to work.
My connection string is as follows:
<add name="GTR.MDFConnectionString" connectionString="Server=SGDB3;Database=GTR;Trusted_Connection=Yes;"/>
Have also created the an app pool successfully using the custom service account as identity and checked the application is running under this new app pool.
In the SQL server 2008r database, i have also added the custom service account as a new login to my database GTR with read write access roles
However, when my ASP.NET web application runs and access the database, it throws a login failed sqlexception referencing my personal domain ID and not my custom service ID.
"Cannot open database "GTR" requested by the login. The login failed.
Login failed for user 'ryan'."
Custom service id: SGImport
My domain id: ryan
Can anyone please guide me on whats wrong and how i should get the web application to connect to database as the custom service account and not the user account?
I'm trying to publish an asp.net website on a remote server. When my code tries to connect to the database, I get the error message described in the question title. Now, I've gone into the Microsoft SQL Server Management Studio for SSE 2008 and can see the list of logins. NT AUTHORITY\NETWORK SERVICE is there, but I'm not sure what settings I need to change to allow this user to access the database. I've tried using impersonation in my web.config file using the windows login credentials for the server, but that just brings up the same error message, with my windows username instead of NETWORK SERVICE.
My connection string is as follows:
connectionString="Data Source=MECHTRONICRND\SQLEXPRESS;Initial Catalog='C:\Inetpub\aspnettest\App_Data\FLEETMANAGERDB.MDF';Integrated Security=True"
Any ideas?
Thanks
--Amr
Thanks for your replies. After looking at this tutorial, I found out how to allow users access to a database. Once I had allowed NETWORK SERVICE read and write access to the database, my website worked fine with the original connection string.
--Amr
Your connection string should be:
"Data Source=MECHTRONICRND\SQLEXPRESS;Initial Catalog=FLEETMANAGERDB;Integrated Security=True"
Also, this is trying to connect to the database as the account that's used by the web server. You could run the web service (configure IIS accordingly) as a domain user, and then create a login and database user for that account. Otherwise, you will have to create a database user (in FleetManagerDB) for the Network Service account, which isn't recommended. Or yourself if you are impersonating yourself.
I made an application that access CRM's web service. The problem is, when I deployed the dll into Sharepoint server, it returned error 401 unauthorized. Apparently the System.Net.CredentialCache.DefaultCredentials didn't work (my suspicion). Here's the code.
CrmSdk.CrmAuthenticationToken token = new CrmSdk.CrmAuthenticationToken();
token.AuthenticationType = AuthenticationType.AD;
token.OrganizationName = ORGANIZATION_NAME;
CrmService service = new CrmService();
service.Url = "http://crmserver:5555/mscrmservices/2007/crmservice.asmx";
service.CrmAuthenticationTokenValue = token;
service.PreAuthenticate = true;
service.Credentials = System.Net.CredentialCache.DefaultCredentials;
It goes vice-versa.
When I made application that access Sharepoint's webservice (coding the plugin) and deployed it to CRM server. It couldn't access the Sharepoint's web service. Unauthorized error. Here is the code:
Lists listService = new Lists();
listService.PreAuthenticate = true;
listService.Credentials = System.Net.CredentialCache.DefaultCredentials;
listService.Url = "http://sharepointserver/webname/_vti_bin/Lists.asmx";
My CRM server and Sharepoint server are in the same domain.
For both code, if I changed the credentials part into something like this then deploy it on server, it can run.
service.Credentials = new NetworkCredential("username", "password", "domain");
Still, I don't want to do this because it reveals user's password in the code. May anyone help me?
The IIS in both server doesn't allow Anonymous Access and it uses Integrated Windows Authentication.
Thank you
From my local computer, I can access the CRM web services or Sharepoint web services. I guess I'm authorized because the DefaultCredentials sent my credentials that its password is saved in the "Stored Username and Password" (Control Panel > User Accounts > tab Advanced > Manage Passwords)
This way, I don't have to type:
service.Credentials = new NetworkCredential("username", "password", "domain");
and my DefaultCredentials from my local comp is authorized to access the web services.
I tried to implement this on the Sharepoint server that access CRM web services. and..tadaa..it won't work. hahaha..
can we inject credentials to DefaultCredentials in server?
the last thing I want to do is to hardcode the useraccount (like the code above)
Could be that you need to be running Kerberos for authentication, but cannot be sure and it is a pain to setup just to check.
Have you verified that the default credentials are the same as those when you explicitly state them? It could be that the default credentails are those of another account that you wouldn't expect.
EDIT #1: Per the remarks for the DefaultCredentials property on MSDN:
DefaultCredentials represents the
system credentials for the current
security context in which the
application is running. For a
client-side application, these are
usually the Windows credentials (user
name, password, and domain) of the
user running the application. For
ASP.NET applications, the default
credentials are the user credentials
of the logged-in user, or the user
being impersonated.
You'll also want to ensure that the user accessing the CRM page (making the call to the SharePoint web service) can access the web service with their credentials and vice versa. If they can then it would seem more likely that some kind of impersonation is happening.
Edit #2: Assuming that you have access to both the CRM and SharePoint server you might take a peak into both the application and system logs. One or both should likely indicate a failed login and indicate which account attempted to access the resource (in this case the web services).
By using DefaultCredentials means the ASP.NET worker process or IIS worker process will take the credential of the user who run the IIS Application Pool.
so if your Dynamics CRM Application Pool is run under a user account Custom-CRM-Domain\JohnDoe, that means it will take the privileges under user account Custom-CRM-Domain\JohnDoe.
Please check the user account who run the application pool of the CRM\Sharepoint Application IIS Web application.
These are the steps to check the Application Pool:
Open the website -> Right Click -> Choose Properties
Select the Home Directory tab
Notice the Application Pool name at the dropdownlist below
Now, go to the Application Pools folder
Try to find the Application Pool name which has been listed in the step 3 -> Right Click and choose Properties
Select the "Identity" tab and you will find the user account who run the application pool
Hope this helps.
service.Credentials = System.Net.CredentialsCache.DefaultNetworkCredentials;
Try that.
Not familiar with Sharepoint, but can't you just store the connection information in a configuration and use built in tools for securing your web.config? Thats what I do.
https://web.archive.org/web/20211029043331/https://aspnet.4guysfromrolla.com/articles/021506-1.aspx
to be able use defaultcredentials, the user in active directory must be defined both in SharePoint and CRM and have enough privileges to do what you are doing with code.
And try to use sdk (crm have helper classes) instead of service definitions.
For fixing this issue you need to know first which user is running the App pool as the others said and if you need to use CredentialCache.DefaultCredentials then you have to add the user lets say svcadmin or the like into "Secondary site collection administrator" by running SharePoint central administration application . By that SP allows to the user which the credential has been passed through to access the things it needs.