wierd asp.net integrated authentication issue

[maxedoutcc]

Solution found: This appears to be a security feature in Server 2003 acknowledged in the KB 896861 - http://support.microsoft.com/kb/896861

Figured I would post the solution if someone else comes across this problem in the future.
---------------------------------------------------------------------

I have a wierd asp.net 2.0 integrated authentication issue im dealing with.

I have a single webservice that allows you to get roles from active directory. The first service has a single method with a user/pass/domain parameter that then calls a second webservice which uses integrated authentication and returns the active directory roles they are in.

The second service works fine from any remote computer, except the host computer. I can not get the system to accept a username and password regardless if it is valid or not.

If I change the call from the first web service to the second webservice from using a DNS name to its IP address everything works fine.

I have searched google all to find various things that do not work. anyone have an idea? Below are a couple of more info.

each service has its own dns, ip address and website configured on IIS 6.0.

The service works fine on another server when they are configured as applications under a single domain.i.e... http://myname/service1 & http://myname/service2

I really want to get this resolved as opposed to splitting these web services to different servers.

 

[PTNL]

Do you have a DNS server defined? If not, is the server's HOSTS file handling the resolution?

 

[maxedoutcc]

yes same application pool, and we have three dns servers defined 1 in the datacenter the server is located and two in the wan outside the datacenter.

I am going to try hosts addition now

 

[maxedoutcc]

added host entry file, flushed dns and still the same. Im going to create a new asp.net app pool and see if that helps

 

[maxedoutcc]

different application pools yielded the same results.

 

[PTNL]

Can you paste your Web.Config file here?

Also, is this machine listed in the "Computers" group on the AD server? Is Trusted Delegation turned on for the server within AD?

And I'm not sure if this makes an impact or not, but on the server itself (not AD, but the web services server), is "Integrated Authentication" turned on in the Internet Settings?

 

[maxedoutcc]

Here is the web.config of the webservice I am having a problem with.

default comments removed.

<?xml version="1.0"?>
<configuration>
	<appSettings/>
	<connectionStrings/>
	<system.web>
		<compilation debug="false" strict="false" explicit="true" />
		<pages>
			<namespaces>
				<clear/>
				<add namespace="System"/>
				<add namespace="System.Collections"/>
				<add namespace="System.Collections.Specialized"/>
				<add namespace="System.Configuration"/>
				<add namespace="System.Text"/>
				<add namespace="System.Text.RegularExpressions"/>
				<add namespace="System.Web"/>
				<add namespace="System.Web.Caching"/>
				<add namespace="System.Web.SessionState"/>
				<add namespace="System.Web.Security"/>
				<add namespace="System.Web.Profile"/>
				<add namespace="System.Web.UI"/>
				<add namespace="System.Web.UI.WebControls"/>
				<add namespace="System.Web.UI.WebControls.WebParts"/>
				<add namespace="System.Web.UI.HtmlControls"/>
			</namespaces>
		</pages>
    <authentication mode="Windows"/>
    <identity impersonate="true"/>
    <authorization>
      <deny users="?"/>
      <allow users="*"/>
    </authorization>
		<roleManager defaultProvider="WindowsProvider" enabled="true" cacheRolesInCookie="false">
			<providers>
				<add name="WindowsProvider" type="System.Web.Security.WindowsTokenRoleProvider"/>
			</providers>
		</roleManager>
		
	</system.web>
</configuration>

Yes this is in the computers group in the AD server and I have had the admins enable the trusted delegation in the properties of the computer of AD.

I also checked the integrated authentication setting of IE. although like I mentioned earlier this works via IP but not DNS. So this setting should be irrelevant.

I also ran the SetSPN utility to create the security principal name since the host header is different from the NetBIOS name. I ran this via the suggestion from microsoft KB: 294382 http://support.microsoft.com/?id=294382

none of which seem to resolve the issue, I have rebooted and restarted IIS after each configuration.

One thing to note is that this is in a cluster of two servers. I have ensured that each change is done on both servers. Other web services on a different single server have the same problem so it has to be some sort of configuration issue I believe.

thanks in advance

 

[Bigbacon]

You may have to impersonate an account that can access AD directly depending on your network setup.

 

[maxedoutcc]

thats whats happening. Whats hapening is we are using oracle to call a webservice from a stored procedure. It calls the first webservice which tacks the user/pass/domain supplied. the first webservice then uses these credentials to call the second webservice which uses integrated authentication to get the roles from active directory.

The reason for the two seperate webservices is that the second webservice is going to be called directly from java for another process.

Like I mentioned before,it works from outside the server via IP or DNS. however when I remote desktop TO the server or initiate a call from teh first webservice to the second webservice via dns I receive an error. If I change the reference from the first webservice to ip access it works fine.

 

[maxedoutcc]

monday morning bump for ideas. thanks in advance for reading and helping if you can.