LDAP connection & query works on XP, but not on 2003

[jeremy]

Hello.

I have an asp.net application that resides on a non-DC / BDC Sharepoint
Server (although it is logged into the domain). The application will perform
lookups based on the current user (integrated auth) to an LDAP server which
requires no login (AuthenticationTypes.None). When I run it, I get the
following ambiguous error:

Security Exception
Description: The application attempted to perform an operation not allowed
by the security policy. To grant this application the required permission
please contact your system administrator or change the application's trust
level in the configuration file.

Exception Details: System.Security.SecurityException: Security error.

But - the ldap query works flawlessly on my XP development machine (where I
am logged into the domain also).

What I've done:
Excluded the virt directory from SPS (so IIS will handle it)
in web.config:
<authentication mode="Windows" />
<identity impersonate="true"/>
in IIS - tried Basic (tied to my domain name and pwd) only and then
Integrated auth only
added a reference in dotnet to the System.DirectoryServices dll
looked in event viewer - no errors
created app pool specifically for the site. tried all of the identity
options (inc domain\username & pwd)

I have a very strong feeling that the security error is not linked to
the actual LDAP query, but to the loading of the directoryservices dll (or
some other windows 2003 config setting), when it is called. What leads me to
that conclusion is when I am debugging, I will not get that error when i rem
out the line --> dirEntry = new
DirectoryEntry("LDAP://server:389/ou=People,o=site.org"); <---. When that
line is unrem'd, the debugger never begins to debug - I get the error first.

using System.DirectoryServices;

........

DirectoryEntry dirEntry;
dirEntry = new DirectoryEntry(LDAP://server:389/ou=People,o=site.org);
dirEntry.AuthenticationType = AuthenticationTypes.None;
//perform lookup

Thanks much in advance for any ideas. Again, my code is good - it works on
my other box. It just doesn't run on the server.

[Willy Denoyette [MVP]]

This has nothing to do with windows security, it's a Code Access Security
issue. Do you run this code from a networkshare perhaps?
If you do, you must change the CAS settings.

Willy.

"jeremy" <[e-mail]> wrote in message
news:%2***************@TK2MSFTNGP14.phx.gbl...

Hello.

I have an asp.net application that resides on a non-DC / BDC Sharepoint
Server (although it is logged into the domain). The application will
perform
lookups based on the current user (integrated auth) to an LDAP server
which
requires no login (AuthenticationTypes.None). When I run it, I get the
following ambiguous error:

Security Exception
Description: The application attempted to perform an operation not allowed
by the security policy. To grant this application the required permission
please contact your system administrator or change the application's trust
level in the configuration file.

Exception Details: System.Security.SecurityException: Security error.

But - the ldap query works flawlessly on my XP development machine (where
I
am logged into the domain also).

What I've done:
Excluded the virt directory from SPS (so IIS will handle it)
in web.config:
<authentication mode="Windows" />
<identity impersonate="true"/>
in IIS - tried Basic (tied to my domain name and pwd) only and then
Integrated auth only
added a reference in dotnet to the System.DirectoryServices dll
looked in event viewer - no errors
created app pool specifically for the site. tried all of the identity
options (inc domain\username & pwd)

I have a very strong feeling that the security error is not linked to
the actual LDAP query, but to the loading of the directoryservices dll (or
some other windows 2003 config setting), when it is called. What leads me
to
that conclusion is when I am debugging, I will not get that error when i
rem
out the line --> dirEntry = new
DirectoryEntry("LDAP://server:389/ou=People,o=site.org"); <---. When that
line is unrem'd, the debugger never begins to debug - I get the error
first.

using System.DirectoryServices;

.......

DirectoryEntry dirEntry;
dirEntry = new DirectoryEntry(LDAP://server:389/ou=People,o=site.org);
dirEntry.AuthenticationType = AuthenticationTypes.None;
//perform lookup

Thanks much in advance for any ideas. Again, my code is good - it works on
my other box. It just doesn't run on the server.

[jeremy]

Thanks for your help. I wasn't running from a network share, but based on
your reply, was able to come to a solution.

After reading this document -->
http://msdn.microsoft.com/library/de...l/secmod81.asp
and this document -->
http://msdn.microsoft.com/library/de...l/secmod82.asp
I ran some tests and came to the realization that I probably have to load
the dll into the GAC. I tinkered with the machine.config and added my own
custom security configuration files, but to no avail. There must be
something about the system.directoryservices dll that requires full access.
I wasn't able to figure out how to do that, so I tried the last resort -
gac. strong named it, and added the dll to the gac using the .NET
Configuration 1.1 snap-in. Restarted IIS and it worked. Will likely use this
solution when the project goes into production next week.

I hope this helps someone else who is running sharepoint (@ medium security)
and ASP.NET

Thanks for your help Willy. If you do have any other suggestions as to why /
how to add the System.DirectoryServices to some customized .config files, I
am all ears.
"Willy Denoyette [MVP]" <wi*************@pandora.be> wrote in message
news:#$**************@tk2msftngp13.phx.gbl...

This has nothing to do with windows security, it's a Code Access Security
issue. Do you run this code from a networkshare perhaps?
If you do, you must change the CAS settings.

Willy.

"jeremy" <[e-mail]> wrote in message
news:%2***************@TK2MSFTNGP14.phx.gbl...

Hello.

I have an asp.net application that resides on a non-DC / BDC Sharepoint
Server (although it is logged into the domain). The application will
perform
lookups based on the current user (integrated auth) to an LDAP server
which
requires no login (AuthenticationTypes.None). When I run it, I get the
following ambiguous error:

Security Exception
Description: The application attempted to perform an operation not allowed by the security policy. To grant this application the required permission please contact your system administrator or change the application's trust level in the configuration file.

Exception Details: System.Security.SecurityException: Security error.

But - the ldap query works flawlessly on my XP development machine (where I
am logged into the domain also).

What I've done:
Excluded the virt directory from SPS (so IIS will handle it)
in web.config:
<authentication mode="Windows" />
<identity impersonate="true"/>
in IIS - tried Basic (tied to my domain name and pwd) only and then
Integrated auth only
added a reference in dotnet to the System.DirectoryServices dll
looked in event viewer - no errors
created app pool specifically for the site. tried all of the identity
options (inc domain\username & pwd)

I have a very strong feeling that the security error is not linked to
the actual LDAP query, but to the loading of the directoryservices dll (or some other windows 2003 config setting), when it is called. What leads me to
that conclusion is when I am debugging, I will not get that error when i
rem
out the line --> dirEntry = new
DirectoryEntry("LDAP://server:389/ou=People,o=site.org"); <---. When that line is unrem'd, the debugger never begins to debug - I get the error
first.

using System.DirectoryServices;

.......

DirectoryEntry dirEntry;
dirEntry = new DirectoryEntry(LDAP://server:389/ou=People,o=site.org);
dirEntry.AuthenticationType = AuthenticationTypes.None;
//perform lookup

Thanks much in advance for any ideas. Again, my code is good - it works on my other box. It just doesn't run on the server.

[Marc Scheuner [MVP ADSI]]

>>There must be something about the system.directoryservices dll that requires full access.

To a certain degree - yes. You might want to post your question to the

microsoft.public.adsi.general

newsgroup - there are a number of very highly skilled AD / ASP.NET
programmers hanging out there who definitely knows this in depth. (I'm
not a ASP.NET guy, so I can't really help you myself).

Marc

================================================== ==============
Marc Scheuner May The Source Be With You!
Bern, Switzerland m.scheuner(at)inova.ch