How to use the System.DirectoryServices namespace in ASP.NET

What is a Primary Token?

Double-Hop Issue

How to Acquire a Primary Token

Method A

• On the ASPX page, set the security mechanism to
  Anonymous only.
• Clear the Allow IIS to control the password check box.
• Set the Anonymous account to be a domain user.

Method B

• When Web.config is set to identity impersonate="false"/ and authentication mode="Windows"
• When Machine.config is set to processModel username=Domain\username,password=secret
  • If identity impersonate="false"/ in the Web.config file, the credentials of the Base process are used. When you supply a domain user and password, you make it possible for IIS to pass a primary token to the AD.

Error That You May Receive If You Do Not Have a Primary Token

Troubleshoot the Double-Hop Issue

Quick Test

1. Set the ASPX page security mechanism to use Basic only.
2. Use a client to browse to the ASPX page, and then provide domain credentials when prompted.
   
   If this works, you can conclude that the double-hop issue is probably the problem.

Test Your Code

1. Log on to the IIS server as the domain account that your browser was trying to use, and then run the code.
   
   This test removes the IIS server from the environment and helps you narrow down the problem.
   
2. To determine whether this is a double-hop issue, turn on auditing for directory service objects.
   For more information about how to do this for the Active Directory, click the following article number to view the article in the Microsoft Knowledge Base:
   
   
   232714 How to enable auditing of Directory Service access
   
   
   After you turn on logging, events are written to the security event log.

Event Type: Success Audit
Event Source: Security
Event Category: Directory Service Access 
Event ID: 565
Date:  3/27/2002
Time:  3:21:41 PM
User:  NT AUTHORITY\ANONYMOUS LOGON
Computer: TESTDC
Description:
Object Open:
  Object Server: DS
  Object Type: user
  Object Name: CN=Users,DC=corp,DC=com
  New Handle ID: 0
  Operation ID: {0,68019232}
  Process ID: 264
  Primary User Name: TESTDC$
  Primary Domain: TESTDOM
  Primary Logon ID: (0x0,0x3E7)
  Client User Name: ANONYMOUS LOGON
  Client Domain: NT AUTHORITY
  Client Logon ID: (0x0,0x40DE417)
  Accesses  READ_CONTROL 
   
  Privileges  -
 
 Properties: 
 

ASP.NET Base Account

Error That You May Receive If the ASP.NET Base Account Is Not Set Correctly

Troubleshoot ASP.NET Base Account Not Set Correctly

• If you have modified your Web.config file to use impersonation, but your DirectoryServices code does not succeed and you receive the same errors (see errors mentioned earlier in this article), the problem is probably caused by a default behavior in IIS. By default, the new virtual directory setup in IIS has Anonymous Authentication turned on. To resolve this, open Internet Services Manager and modify the authentication methods of the virtual directory to clear the Anonymous Authentication check box.
• Although you call DirectoryEntry.Invoke() for SetPassword (or for another method that is exposed) on the underlying ADSI interfaces, and you receive the following error message, the error number that is returned is not 0x8000500D:
  The Active Directory property cannot be found in the cache
  The expected behavior is that error number 0x8000500D is returned with this description.
  
  For example:
  COMException (0x80020006): The Active Directory property cannot be found in the cache
  The confusion is that the cause of this error, as indicated by the error number, may not correspond to the error description. The cause of this error should be identified by the error number, and not by the description. Generally, you can expect the resolution to your problem to be determined by the error number, not by the description. In this example, the error number corresponds to DISP_E_UNKNOWNNAME.

• If your IIS server is running on a Domain Control or Backup Domain Controller, the default base account may not work and you may receive errors.
  For more information and the descriptions of these error messages, click the following article number to view the article in the Microsoft Knowledge Base:
  
  
  315158 FIX: ASP.NET does not work with the default ASP.NET account on a domain controller
  
  
• If your base IIS server does not have rights to read, execute, and list on the root Web site, you receive an error when you browse to a Web page.
  For more information, click the following article number to view the article in the Microsoft Knowledge Base:
  
  
  316721 "Failed to start monitoring directory changes" error message when you browse to ASP.NET page
  
  

ADSI Schema Cache

Error That You May Receive When the ADSI Schema Cache Is Not Available

Troubleshoot the ADSI Schema Cache

Registry Keys and Resolving the Issue

• If the registry keys are present, delete them, stop and restart IIS, and then browse to the Web page.
• If the key is not created or the file is not written, either you do not have the permissions to download the schema cache from the server, or you do not have the permissions to write the file or create the registry key. If they are written, you can expect the page to work until the next time that IIS restarts.
  
  To resolve this, you must resolve the double-hop issue.