Directory Services error: The authentication mechanism is unknown

[David Moore]

Hello

I am using the System.Director yServices namespace classes to access Active Directory. We connect using the LDAP://DOMAIN method.

The code works on local dev boxes, and in staging, but doesn't work on a particular box in our production environment. When we try to connect and do a search, we get a "The authentication mechanism is unknown" error. I have searched on Google, Microsoft Support Knowledge Base and Yahoo etc, and found this error, but noone can offer an explanation or a solution.

We put together a simple application to help us debug the problem, using the same code we used in our application, but allowing us to have logging and see the stack trace. We ran this as a console application, then as a ASP.NET application, with the same result (it works, and defaults to the Secure authentication type - except it breaks on the production box!). Trying other authentication types doesn't help either.

Here is a successful output:

Connecting to mgsmith:xxxxx@L DAP://AUNZ with authentication type 'Secure'
Authentication Type = Secure
Type = AuthenticationT ypes
Setting LDAP Search Filter to (samaccountname =mgsmith)
Executing search.FindOne( )...
Search was successful.
Search found an entry.
Looking up employeeid
EmployeeID = 18457

Here is the problematic output:

Connecting to mgsmith:xxxxx@L DAP://AUNZ with authentication type 'Secure'
Authentication Type = Secure
Type = AuthenticationT ypes
Setting LDAP Search Filter to (samaccountname =mgsmith)
Executing search.FindOne( )...
Exception: The authentication mechanism is unknown
Stack Trace: at System.Director yServices.Direc toryEntry.Bind( Boolean throwIfFail)
at System.Director yServices.Direc toryEntry.Bind( )
at System.Director yServices.Direc toryEntry.get_A dsObject()
at System.Director yServices.Direc torySearcher.Fi ndAll(Boolean findMoreThanOne )
at System.Director yServices.Direc torySearcher.Fi ndOne()
at Sandbox.WebForm 1.cmdLogin_Clic k(Object sender, EventArgs e)

Any help is much appreciated.

Cheers

Here is our test code:

try
{
// Bind to the domain directory server
Console.Write(" Connecting to {0}:{1}@{2}", txtUsername.Tex t, txtPassword.Tex t, txtUri.Text);
DirectoryEntry entry;
Console.WriteLi ne(" with authentication type '{0}'", ddlAuthenticati onType.Selected Item.Value);

AuthenticationT ypes authTypeValue = new AuthenticationT ypes();
try
{
authTypeValue = (Authentication Types) Enum.Parse( typeof(Authenti cationTypes), ddlAuthenticati onType.Selected Item.Value,true );
}
catch(Exception ex)
{
Console.WriteLi ne("There was an exception when configuring AuthenticationT ypes. Message: {0}", ex.Message);
Console.WriteLi ne("Available AuthenticationT ypes:");
foreach( string enumName in Enum.GetNames( typeof(Authenti cationTypes) ) )
{
Console.WriteLi ne(" {0}", enumName);
}
Environment.Exi t(2);
}
entry = new DirectoryEntry( txtUri.Text, txtUsername.Tex t, txtPassword.Tex t, authTypeValue);
Console.WriteLi ne("Authenticat ion Type = {0}", entry.Authentic ationType.ToStr ing() );
Console.WriteLi ne("Type = {0}", entry.Authentic ationType.GetTy pe().Name);
// Set up the LDAP search filter
DirectorySearch er searcher = new DirectorySearch er( entry );
searcher.Filter = "(samaccountnam e=" + txtLookup.Text + ")";
Console.WriteLi ne("Setting LDAP Search Filter to {0}", searcher.Filter );

// Find the first occurance for the search filter
Console.WriteLi ne("Executing search.FindOne( )...");
SearchResult result = searcher.FindOn e();
Console.WriteLi ne("Search was successful.");
if (result != null)
{
Console.WriteLi ne("Search found an entry.");
// Store the employee id
Console.WriteLi ne("Looking up employeeid");
ResultPropertyV alueCollection propVals = result.Properti es["employeeid "];

// Check that we can find at least 1 employeeID
if ( propVals == null || propVals.Count <= 0 )
{
Console.WriteLi ne("Couldn't find employee ID in directory entry!");
}
else
{
// If there's more than one employeeID something must be up!
// Doubt this would ever happen, but just in case ;-)
if (propVals.Count > 1)
{
Console.WriteLi ne("User has more than one employeeID?!");
}
foreach(string employeeID in propVals)
{
Console.WriteLi ne("EmployeeID = {0}", employeeID);
}
}
}
else
{
Console.WriteLi ne("No matching entry found.");
}
}
catch (Exception ex)
{
Console.WriteLi ne("Exception: " + ex.Message );
Console.WriteLi ne("Stack Trace: " + ex.StackTrace);
}

END

[Willy Denoyette [MVP]]

Is the production server a domain member of the AD domain?

Willy.
"David Moore" <da***@realdeve lopments.com> wrote in message news:OD******** ******@TK2MSFTN GP12.phx.gbl...
Hello

I am using the System.Director yServices namespace classes to access Active Directory. We connect using the LDAP://DOMAIN method.

The code works on local dev boxes, and in staging, but doesn't work on a particular box in our production environment. When we try to connect and do a search, we get a "The authentication mechanism is unknown" error. I have searched on Google, Microsoft Support Knowledge Base and Yahoo etc, and found this error, but noone can offer an explanation or a solution.

We put together a simple application to help us debug the problem, using the same code we used in our application, but allowing us to have logging and see the stack trace. We ran this as a console application, then as a ASP.NET application, with the same result (it works, and defaults to the Secure authentication type - except it breaks on the production box!). Trying other authentication types doesn't help either.

Here is a successful output:

Connecting to mgsmith:xxxxx@L DAP://AUNZ with authentication type 'Secure'
Authentication Type = Secure
Type = AuthenticationT ypes
Setting LDAP Search Filter to (samaccountname =mgsmith)
Executing search.FindOne( )...
Search was successful.
Search found an entry.
Looking up employeeid
EmployeeID = 18457

Here is the problematic output:

Connecting to mgsmith:xxxxx@L DAP://AUNZ with authentication type 'Secure'
Authentication Type = Secure
Type = AuthenticationT ypes
Setting LDAP Search Filter to (samaccountname =mgsmith)
Executing search.FindOne( )...
Exception: The authentication mechanism is unknown
Stack Trace: at System.Director yServices.Direc toryEntry.Bind( Boolean throwIfFail)
at System.Director yServices.Direc toryEntry.Bind( )
at System.Director yServices.Direc toryEntry.get_A dsObject()
at System.Director yServices.Direc torySearcher.Fi ndAll(Boolean findMoreThanOne )
at System.Director yServices.Direc torySearcher.Fi ndOne()
at Sandbox.WebForm 1.cmdLogin_Clic k(Object sender, EventArgs e)

Any help is much appreciated.

Cheers

Here is our test code:

try
{
// Bind to the domain directory server
Console.Write(" Connecting to {0}:{1}@{2}", txtUsername.Tex t, txtPassword.Tex t, txtUri.Text);
DirectoryEntry entry;
Console.WriteLi ne(" with authentication type '{0}'", ddlAuthenticati onType.Selected Item.Value);

AuthenticationT ypes authTypeValue = new AuthenticationT ypes();
try
{
authTypeValue = (Authentication Types) Enum.Parse( typeof(Authenti cationTypes), ddlAuthenticati onType.Selected Item.Value,true );
}
catch(Exception ex)
{
Console.WriteLi ne("There was an exception when configuring AuthenticationT ypes. Message: {0}", ex.Message);
Console.WriteLi ne("Available AuthenticationT ypes:");
foreach( string enumName in Enum.GetNames( typeof(Authenti cationTypes) ) )
{
Console.WriteLi ne(" {0}", enumName);
}
Environment.Exi t(2);
}
entry = new DirectoryEntry( txtUri.Text, txtUsername.Tex t, txtPassword.Tex t, authTypeValue);
Console.WriteLi ne("Authenticat ion Type = {0}", entry.Authentic ationType.ToStr ing() );
Console.WriteLi ne("Type = {0}", entry.Authentic ationType.GetTy pe().Name);
// Set up the LDAP search filter
DirectorySearch er searcher = new DirectorySearch er( entry );
searcher.Filter = "(samaccountnam e=" + txtLookup.Text + ")";
Console.WriteLi ne("Setting LDAP Search Filter to {0}", searcher.Filter );

// Find the first occurance for the search filter
Console.WriteLi ne("Executing search.FindOne( )...");
SearchResult result = searcher.FindOn e();
Console.WriteLi ne("Search was successful.");
if (result != null)
{
Console.WriteLi ne("Search found an entry.");
// Store the employee id
Console.WriteLi ne("Looking up employeeid");
ResultPropertyV alueCollection propVals = result.Properti es["employeeid "];

// Check that we can find at least 1 employeeID
if ( propVals == null || propVals.Count <= 0 )
{
Console.WriteLi ne("Couldn't find employee ID in directory entry!");
}
else
{
// If there's more than one employeeID something must be up!
// Doubt this would ever happen, but just in case ;-)
if (propVals.Count > 1)
{
Console.WriteLi ne("User has more than one employeeID?!");
}
foreach(string employeeID in propVals)
{
Console.WriteLi ne("EmployeeID = {0}", employeeID);
}
}
}
else
{
Console.WriteLi ne("No matching entry found.");
}
}
catch (Exception ex)
{
Console.WriteLi ne("Exception: " + ex.Message );
Console.WriteLi ne("Stack Trace: " + ex.StackTrace);
}

END

[David Moore]

Yes it is

"Willy Denoyette [MVP]" <wi************ *@pandora.be> wrote in message
news:OD******** ******@TK2MSFTN GP09.phx.gbl...
Is the production server a domain member of the AD domain?

Willy.
"David Moore" <da***@realdeve lopments.com> wrote in message
news:OD******** ******@TK2MSFTN GP12.phx.gbl...
Hello

I am using the System.Director yServices namespace classes to access Active
Directory. We connect using the LDAP://DOMAIN method.

The code works on local dev boxes, and in staging, but doesn't work on a
particular box in our production environment. When we try to connect and do
a search, we get a "The authentication mechanism is unknown" error. I have
searched on Google, Microsoft Support Knowledge Base and Yahoo etc, and
found this error, but noone can offer an explanation or a solution.

We put together a simple application to help us debug the problem, using the
same code we used in our application, but allowing us to have logging and
see the stack trace. We ran this as a console application, then as a ASP.NET
application, with the same result (it works, and defaults to the Secure
authentication type - except it breaks on the production box!). Trying other
authentication types doesn't help either.

Here is a successful output:

Connecting to mgsmith:xxxxx@L DAP://AUNZ with authentication type 'Secure'
Authentication Type = Secure
Type = AuthenticationT ypes
Setting LDAP Search Filter to (samaccountname =mgsmith)
Executing search.FindOne( )...
Search was successful.
Search found an entry.
Looking up employeeid
EmployeeID = 18457

Here is the problematic output:

Connecting to mgsmith:xxxxx@L DAP://AUNZ with authentication type 'Secure'
Authentication Type = Secure
Type = AuthenticationT ypes
Setting LDAP Search Filter to (samaccountname =mgsmith)
Executing search.FindOne( )...
Exception: The authentication mechanism is unknown
Stack Trace: at System.Director yServices.Direc toryEntry.Bind( Boolean
throwIfFail)
at System.Director yServices.Direc toryEntry.Bind( )
at System.Director yServices.Direc toryEntry.get_A dsObject()
at System.Director yServices.Direc torySearcher.Fi ndAll(Boolean
findMoreThanOne )
at System.Director yServices.Direc torySearcher.Fi ndOne()
at Sandbox.WebForm 1.cmdLogin_Clic k(Object sender, EventArgs e)

Any help is much appreciated.

Cheers

Here is our test code:

try
{
// Bind to the domain directory server
Console.Write(" Connecting to {0}:{1}@{2}", txtUsername.Tex t,
txtPassword.Tex t, txtUri.Text);
DirectoryEntry entry;
Console.WriteLi ne(" with authentication type '{0}'",
ddlAuthenticati onType.Selected Item.Value);

AuthenticationT ypes authTypeValue = new AuthenticationT ypes();
try
{
authTypeValue = (Authentication Types) Enum.Parse(
typeof(Authenti cationTypes), ddlAuthenticati onType.Selected Item.Value,true );
}
catch(Exception ex)
{
Console.WriteLi ne("There was an exception when configuring
AuthenticationT ypes. Message: {0}", ex.Message);
Console.WriteLi ne("Available AuthenticationT ypes:");
foreach( string enumName in Enum.GetNames(
typeof(Authenti cationTypes) ) )
{
Console.WriteLi ne(" {0}", enumName);
}
Environment.Exi t(2);
}
entry = new DirectoryEntry( txtUri.Text, txtUsername.Tex t,
txtPassword.Tex t, authTypeValue);
Console.WriteLi ne("Authenticat ion Type = {0}",
entry.Authentic ationType.ToStr ing() );
Console.WriteLi ne("Type = {0}",
entry.Authentic ationType.GetTy pe().Name);
// Set up the LDAP search filter
DirectorySearch er searcher = new DirectorySearch er( entry );
searcher.Filter = "(samaccountnam e=" + txtLookup.Text + ")";
Console.WriteLi ne("Setting LDAP Search Filter to {0}", searcher.Filter );

// Find the first occurance for the search filter
Console.WriteLi ne("Executing search.FindOne( )...");
SearchResult result = searcher.FindOn e();
Console.WriteLi ne("Search was successful.");
if (result != null)
{
Console.WriteLi ne("Search found an entry.");
// Store the employee id
Console.WriteLi ne("Looking up employeeid");
ResultPropertyV alueCollection propVals =
result.Properti es["employeeid "];

// Check that we can find at least 1 employeeID
if ( propVals == null || propVals.Count <= 0 )
{
Console.WriteLi ne("Couldn't find employee ID in directory
entry!");
}
else
{
// If there's more than one employeeID something must be up!
// Doubt this would ever happen, but just in case ;-)
if (propVals.Count > 1)
{
Console.WriteLi ne("User has more than one employeeID?!");
}
foreach(string employeeID in propVals)
{
Console.WriteLi ne("EmployeeID = {0}", employeeID);
}
}
}
else
{
Console.WriteLi ne("No matching entry found.");
}
}
catch (Exception ex)
{
Console.WriteLi ne("Exception: " + ex.Message );
Console.WriteLi ne("Stack Trace: " + ex.StackTrace);
}

END

[Marc Scheuner [MVP ADSI]]

>Yes it is

I'd recommend

a) to check out the microsoft.publi c.adsi.general newsgroup - lots of
AD cracks there

b) Look into ASP.NET issues - things like what context does the app
run under etc.

c) Check out the Directory Services + ADSI Yahoo! group - again, lots
of AD and ASP.NET cracks there
http://groups.yahoo.com/group/ADSIANDDirectoryServices/

d) LEARN hot to post in PURE text (*NOT* HTML) and LIMIT QUOTING when
answeing..... (just to answer "yes it is", you don't need to repeat
300 lines of other text........)

Thanks!
Marc

=============== =============== =============== =============== ====
Marc Scheuner May The Source Be With You!
Bern, Switzerland m.scheuner(at)i nova.ch