469,282 Members | 2,000 Online
Bytes | Developer Community
New Post

Home Posts Topics Members FAQ

Post your question to a community of 469,282 developers. It's quick & easy.

User.IsInRole is always FALSE

Hi, I have the following problem...

Pre-requisites:
Installation of an Asp.net webservice on a IIS5 server (win2k). Anonymous
access is not allowed, only using windows authentication (intranet app),
webmethoda are using the Principalpermssion attribute
([PrincipalPermission(SecurityAction.Demand,
Role=@"DomainName\WindowsGroup...")]) for identification.

Result --> does not work

When I change the to [PrincipalPermission(SecurityAction.Demand,
name=@"DomainName\Windowsuser...")]) -> it runs fine

--> conclusion: IIS cannot determine if a user belongs to an AD group -->
IPrincipal.IsInRole(@"DomainName\WindowsGroup") is always FALSE!

I already found an article on the web
(http://www.kbalertz.com/kb_894432.aspx --> web dir is UNC share), but
didn't solved the problem...

Does anyone know more about this issue?

Thanks
Oliver Rainer

Nov 23 '05 #1
8 12448
June 7, 2005

hehe I actually have to go to a meeting right now, but a quick suggestion
before I leave. Try switching the PrincipalPermission
role="domain\groupname" to "BUILTIN\GROUPNAME". There is a little more to
this change, but it should work.... depending on which role it is, so if you
could post it, that would really help... until later! :-)

--
Joseph Bittman
Microsoft Certified Application Developer

Web Site: http://71.35.110.42
Dynamic IP -- Check here for future changes

"Oliver Rainer" <ol******@tiscali.ch> wrote in message
news:ub**************@TK2MSFTNGP10.phx.gbl...
Hi, I have the following problem...

Pre-requisites:
Installation of an Asp.net webservice on a IIS5 server (win2k). Anonymous
access is not allowed, only using windows authentication (intranet app),
webmethoda are using the Principalpermssion attribute
([PrincipalPermission(SecurityAction.Demand,
Role=@"DomainName\WindowsGroup...")]) for identification.

Result --> does not work

When I change the to [PrincipalPermission(SecurityAction.Demand,
name=@"DomainName\Windowsuser...")]) -> it runs fine

--> conclusion: IIS cannot determine if a user belongs to an AD group -->
IPrincipal.IsInRole(@"DomainName\WindowsGroup") is always FALSE!

I already found an article on the web
(http://www.kbalertz.com/kb_894432.aspx --> web dir is UNC share), but
didn't solved the problem...

Does anyone know more about this issue?

Thanks
Oliver Rainer

Nov 23 '05 #2
June 7, 2005

hehe I actually have to go to a meeting right now, but a quick suggestion
before I leave. Try switching the PrincipalPermission
role="domain\groupname" to "BUILTIN\GROUPNAME". There is a little more to
this change, but it should work.... depending on which role it is, so if you
could post it, that would really help... until later! :-)

--
Joseph Bittman
Microsoft Certified Application Developer

Web Site: http://71.35.110.42
Dynamic IP -- Check here for future changes

"Oliver Rainer" <ol******@tiscali.ch> wrote in message
news:ub**************@TK2MSFTNGP10.phx.gbl...
Hi, I have the following problem...

Pre-requisites:
Installation of an Asp.net webservice on a IIS5 server (win2k). Anonymous
access is not allowed, only using windows authentication (intranet app),
webmethoda are using the Principalpermssion attribute
([PrincipalPermission(SecurityAction.Demand,
Role=@"DomainName\WindowsGroup...")]) for identification.

Result --> does not work

When I change the to [PrincipalPermission(SecurityAction.Demand,
name=@"DomainName\Windowsuser...")]) -> it runs fine

--> conclusion: IIS cannot determine if a user belongs to an AD group -->
IPrincipal.IsInRole(@"DomainName\WindowsGroup") is always FALSE!

I already found an article on the web
(http://www.kbalertz.com/kb_894432.aspx --> web dir is UNC share), but
didn't solved the problem...

Does anyone know more about this issue?

Thanks
Oliver Rainer

Nov 23 '05 #3
Thanks for your suggestion... that really works for local groups (BUILTIN),
but IIS still has the problem to resolve AD groups (OURDOMAIN\...)... The
strange thing is that on certain machines (our developer machines), IIS can
succesfully determine if a user belongs to an AD group...

Do you have other suggestions??

Thanks
Oliver Rainer
"Joseph Bittman MCAD" <Ry*********@msn.com> wrote in message
news:eI**************@TK2MSFTNGP12.phx.gbl...
June 7, 2005

hehe I actually have to go to a meeting right now, but a quick suggestion
before I leave. Try switching the PrincipalPermission
role="domain\groupname" to "BUILTIN\GROUPNAME". There is a little more to
this change, but it should work.... depending on which role it is, so if you could post it, that would really help... until later! :-)

--
Joseph Bittman
Microsoft Certified Application Developer

Web Site: http://71.35.110.42
Dynamic IP -- Check here for future changes

"Oliver Rainer" <ol******@tiscali.ch> wrote in message
news:ub**************@TK2MSFTNGP10.phx.gbl...
Hi, I have the following problem...

Pre-requisites:
Installation of an Asp.net webservice on a IIS5 server (win2k). Anonymous access is not allowed, only using windows authentication (intranet app),
webmethoda are using the Principalpermssion attribute
([PrincipalPermission(SecurityAction.Demand,
Role=@"DomainName\WindowsGroup...")]) for identification.

Result --> does not work

When I change the to [PrincipalPermission(SecurityAction.Demand,
name=@"DomainName\Windowsuser...")]) -> it runs fine

--> conclusion: IIS cannot determine if a user belongs to an AD group --> IPrincipal.IsInRole(@"DomainName\WindowsGroup") is always FALSE!

I already found an article on the web
(http://www.kbalertz.com/kb_894432.aspx --> web dir is UNC share), but
didn't solved the problem...

Does anyone know more about this issue?

Thanks
Oliver Rainer


Nov 23 '05 #4
Thanks for your suggestion... that really works for local groups (BUILTIN),
but IIS still has the problem to resolve AD groups (OURDOMAIN\...)... The
strange thing is that on certain machines (our developer machines), IIS can
succesfully determine if a user belongs to an AD group...

Do you have other suggestions??

Thanks
Oliver Rainer
"Joseph Bittman MCAD" <Ry*********@msn.com> wrote in message
news:eI**************@TK2MSFTNGP12.phx.gbl...
June 7, 2005

hehe I actually have to go to a meeting right now, but a quick suggestion
before I leave. Try switching the PrincipalPermission
role="domain\groupname" to "BUILTIN\GROUPNAME". There is a little more to
this change, but it should work.... depending on which role it is, so if you could post it, that would really help... until later! :-)

--
Joseph Bittman
Microsoft Certified Application Developer

Web Site: http://71.35.110.42
Dynamic IP -- Check here for future changes

"Oliver Rainer" <ol******@tiscali.ch> wrote in message
news:ub**************@TK2MSFTNGP10.phx.gbl...
Hi, I have the following problem...

Pre-requisites:
Installation of an Asp.net webservice on a IIS5 server (win2k). Anonymous access is not allowed, only using windows authentication (intranet app),
webmethoda are using the Principalpermssion attribute
([PrincipalPermission(SecurityAction.Demand,
Role=@"DomainName\WindowsGroup...")]) for identification.

Result --> does not work

When I change the to [PrincipalPermission(SecurityAction.Demand,
name=@"DomainName\Windowsuser...")]) -> it runs fine

--> conclusion: IIS cannot determine if a user belongs to an AD group --> IPrincipal.IsInRole(@"DomainName\WindowsGroup") is always FALSE!

I already found an article on the web
(http://www.kbalertz.com/kb_894432.aspx --> web dir is UNC share), but
didn't solved the problem...

Does anyone know more about this issue?

Thanks
Oliver Rainer


Nov 23 '05 #5
June 9, 2005

:-) Yes, the BUILTIN will only work for local groups. AD groups are
somewhat more mysterious and have had problems with them myself. When you
call IsInRole, where is the IPrincipal coming from? Are you using the
interface directly, or using an object taken from the
System.Threading.Thread.CurrentPrincipal, or the User object???? This makes
a big difference in the result that you will get, because I believe in your
case that only a principal taken from User will reflect the user's identity
and not ASPNET. If you could post how you got Iprincipal.IsInRole, then I
believe that I can help you further! :-) Have a great day and until later!!!

--
Joseph Bittman Beta ID# 678424
Microsoft Certified Application Developer

Web Site: http://71.35.110.42
Dynamic IP -- Check here for future changes

"Oliver Rainer" <ol******@tiscali.ch> wrote in message
news:O$****************@TK2MSFTNGP10.phx.gbl...
Thanks for your suggestion... that really works for local groups
(BUILTIN),
but IIS still has the problem to resolve AD groups (OURDOMAIN\...)... The
strange thing is that on certain machines (our developer machines), IIS
can
succesfully determine if a user belongs to an AD group...

Do you have other suggestions??

Thanks
Oliver Rainer
"Joseph Bittman MCAD" <Ry*********@msn.com> wrote in message
news:eI**************@TK2MSFTNGP12.phx.gbl...
June 7, 2005

hehe I actually have to go to a meeting right now, but a quick
suggestion
before I leave. Try switching the PrincipalPermission
role="domain\groupname" to "BUILTIN\GROUPNAME". There is a little more to
this change, but it should work.... depending on which role it is, so if

you
could post it, that would really help... until later! :-)

--
Joseph Bittman
Microsoft Certified Application Developer

Web Site: http://71.35.110.42
Dynamic IP -- Check here for future changes

"Oliver Rainer" <ol******@tiscali.ch> wrote in message
news:ub**************@TK2MSFTNGP10.phx.gbl...
> Hi, I have the following problem...
>
> Pre-requisites:
> Installation of an Asp.net webservice on a IIS5 server (win2k). Anonymous > access is not allowed, only using windows authentication (intranet
> app),
> webmethoda are using the Principalpermssion attribute
> ([PrincipalPermission(SecurityAction.Demand,
> Role=@"DomainName\WindowsGroup...")]) for identification.
>
> Result --> does not work
>
> When I change the to [PrincipalPermission(SecurityAction.Demand,
> name=@"DomainName\Windowsuser...")]) -> it runs fine
>
> --> conclusion: IIS cannot determine if a user belongs to an AD group --> > IPrincipal.IsInRole(@"DomainName\WindowsGroup") is always FALSE!
>
> I already found an article on the web
> (http://www.kbalertz.com/kb_894432.aspx --> web dir is UNC share),
> but
> didn't solved the problem...
>
> Does anyone know more about this issue?
>
> Thanks
> Oliver Rainer
>
>
>



Nov 23 '05 #6
June 9, 2005

:-) Yes, the BUILTIN will only work for local groups. AD groups are
somewhat more mysterious and have had problems with them myself. When you
call IsInRole, where is the IPrincipal coming from? Are you using the
interface directly, or using an object taken from the
System.Threading.Thread.CurrentPrincipal, or the User object???? This makes
a big difference in the result that you will get, because I believe in your
case that only a principal taken from User will reflect the user's identity
and not ASPNET. If you could post how you got Iprincipal.IsInRole, then I
believe that I can help you further! :-) Have a great day and until later!!!

--
Joseph Bittman Beta ID# 678424
Microsoft Certified Application Developer

Web Site: http://71.35.110.42
Dynamic IP -- Check here for future changes

"Oliver Rainer" <ol******@tiscali.ch> wrote in message
news:O$****************@TK2MSFTNGP10.phx.gbl...
Thanks for your suggestion... that really works for local groups
(BUILTIN),
but IIS still has the problem to resolve AD groups (OURDOMAIN\...)... The
strange thing is that on certain machines (our developer machines), IIS
can
succesfully determine if a user belongs to an AD group...

Do you have other suggestions??

Thanks
Oliver Rainer
"Joseph Bittman MCAD" <Ry*********@msn.com> wrote in message
news:eI**************@TK2MSFTNGP12.phx.gbl...
June 7, 2005

hehe I actually have to go to a meeting right now, but a quick
suggestion
before I leave. Try switching the PrincipalPermission
role="domain\groupname" to "BUILTIN\GROUPNAME". There is a little more to
this change, but it should work.... depending on which role it is, so if

you
could post it, that would really help... until later! :-)

--
Joseph Bittman
Microsoft Certified Application Developer

Web Site: http://71.35.110.42
Dynamic IP -- Check here for future changes

"Oliver Rainer" <ol******@tiscali.ch> wrote in message
news:ub**************@TK2MSFTNGP10.phx.gbl...
> Hi, I have the following problem...
>
> Pre-requisites:
> Installation of an Asp.net webservice on a IIS5 server (win2k). Anonymous > access is not allowed, only using windows authentication (intranet
> app),
> webmethoda are using the Principalpermssion attribute
> ([PrincipalPermission(SecurityAction.Demand,
> Role=@"DomainName\WindowsGroup...")]) for identification.
>
> Result --> does not work
>
> When I change the to [PrincipalPermission(SecurityAction.Demand,
> name=@"DomainName\Windowsuser...")]) -> it runs fine
>
> --> conclusion: IIS cannot determine if a user belongs to an AD group --> > IPrincipal.IsInRole(@"DomainName\WindowsGroup") is always FALSE!
>
> I already found an article on the web
> (http://www.kbalertz.com/kb_894432.aspx --> web dir is UNC share),
> but
> didn't solved the problem...
>
> Does anyone know more about this issue?
>
> Thanks
> Oliver Rainer
>
>
>



Nov 23 '05 #7
Hi Joseph,

I executed the following code for testing the stuff --> all booleans were
false except the local admin groups...

WindowsPrincipal windowsPrincipal =
(WindowsPrincipal)Thread.CurrentPrincipal;

IPrincipal iPrincipal = Thread.CurrentPrincipal;

WindowsIdentity windowsIdentity =
System.Security.Principal.WindowsIdentity.GetCurre nt();

string user = windowsIdentity.Name;
bool isLocalAdmin =
windowsPrincipal.IsInRole(WindowsBuiltInRole.Admin istrator);

bool isInTestgroup1 = windowsPrincipal.IsInRole(@"DOMAIN\Testgroup1");

bool isInTestgroup2 = windowsPrincipal.IsInRole(@"DOMAIN\Testgroup2");

bool isLocalAdmin_2 = iPrincipal.IsInRole(@"BUILTIN\Administrators");

bool isInTestgroup1_2 = iPrincipal.IsInRole(@"DOMAIN\Testgroup1");

bool isInTestgroup2_2 = iPrincipal.IsInRole(@"DOMAIN\Testgroup2");

Thanks for your help...

Oliver Rainer


"Joseph Bittman MCAD" <Ry*********@msn.com> wrote in message
news:OJ**************@TK2MSFTNGP10.phx.gbl...
June 9, 2005

:-) Yes, the BUILTIN will only work for local groups. AD groups are
somewhat more mysterious and have had problems with them myself. When you
call IsInRole, where is the IPrincipal coming from? Are you using the
interface directly, or using an object taken from the
System.Threading.Thread.CurrentPrincipal, or the User object???? This makes a big difference in the result that you will get, because I believe in your case that only a principal taken from User will reflect the user's identity and not ASPNET. If you could post how you got Iprincipal.IsInRole, then I
believe that I can help you further! :-) Have a great day and until later!!!
--
Joseph Bittman Beta ID# 678424
Microsoft Certified Application Developer

Web Site: http://71.35.110.42
Dynamic IP -- Check here for future changes

"Oliver Rainer" <ol******@tiscali.ch> wrote in message
news:O$****************@TK2MSFTNGP10.phx.gbl...
Thanks for your suggestion... that really works for local groups
(BUILTIN),
but IIS still has the problem to resolve AD groups (OURDOMAIN\...)... The strange thing is that on certain machines (our developer machines), IIS
can
succesfully determine if a user belongs to an AD group...

Do you have other suggestions??

Thanks
Oliver Rainer
"Joseph Bittman MCAD" <Ry*********@msn.com> wrote in message
news:eI**************@TK2MSFTNGP12.phx.gbl...
June 7, 2005

hehe I actually have to go to a meeting right now, but a quick
suggestion
before I leave. Try switching the PrincipalPermission
role="domain\groupname" to "BUILTIN\GROUPNAME". There is a little more to this change, but it should work.... depending on which role it is, so
if you
could post it, that would really help... until later! :-)

--
Joseph Bittman
Microsoft Certified Application Developer

Web Site: http://71.35.110.42
Dynamic IP -- Check here for future changes

"Oliver Rainer" <ol******@tiscali.ch> wrote in message
news:ub**************@TK2MSFTNGP10.phx.gbl...
> Hi, I have the following problem...
>
> Pre-requisites:
> Installation of an Asp.net webservice on a IIS5 server (win2k).

Anonymous
> access is not allowed, only using windows authentication (intranet
> app),
> webmethoda are using the Principalpermssion attribute
> ([PrincipalPermission(SecurityAction.Demand,
> Role=@"DomainName\WindowsGroup...")]) for identification.
>
> Result --> does not work
>
> When I change the to [PrincipalPermission(SecurityAction.Demand,
> name=@"DomainName\Windowsuser...")]) -> it runs fine
>
> --> conclusion: IIS cannot determine if a user belongs to an AD

group -->
> IPrincipal.IsInRole(@"DomainName\WindowsGroup") is always FALSE!
>
> I already found an article on the web
> (http://www.kbalertz.com/kb_894432.aspx --> web dir is UNC share),
> but
> didn't solved the problem...
>
> Does anyone know more about this issue?
>
> Thanks
> Oliver Rainer
>
>
>



Nov 23 '05 #8
Hi Joseph,

I executed the following code for testing the stuff --> all booleans were
false except the local admin groups...

WindowsPrincipal windowsPrincipal =
(WindowsPrincipal)Thread.CurrentPrincipal;

IPrincipal iPrincipal = Thread.CurrentPrincipal;

WindowsIdentity windowsIdentity =
System.Security.Principal.WindowsIdentity.GetCurre nt();

string user = windowsIdentity.Name;
bool isLocalAdmin =
windowsPrincipal.IsInRole(WindowsBuiltInRole.Admin istrator);

bool isInTestgroup1 = windowsPrincipal.IsInRole(@"DOMAIN\Testgroup1");

bool isInTestgroup2 = windowsPrincipal.IsInRole(@"DOMAIN\Testgroup2");

bool isLocalAdmin_2 = iPrincipal.IsInRole(@"BUILTIN\Administrators");

bool isInTestgroup1_2 = iPrincipal.IsInRole(@"DOMAIN\Testgroup1");

bool isInTestgroup2_2 = iPrincipal.IsInRole(@"DOMAIN\Testgroup2");

Thanks for your help...

Oliver Rainer


"Joseph Bittman MCAD" <Ry*********@msn.com> wrote in message
news:OJ**************@TK2MSFTNGP10.phx.gbl...
June 9, 2005

:-) Yes, the BUILTIN will only work for local groups. AD groups are
somewhat more mysterious and have had problems with them myself. When you
call IsInRole, where is the IPrincipal coming from? Are you using the
interface directly, or using an object taken from the
System.Threading.Thread.CurrentPrincipal, or the User object???? This makes a big difference in the result that you will get, because I believe in your case that only a principal taken from User will reflect the user's identity and not ASPNET. If you could post how you got Iprincipal.IsInRole, then I
believe that I can help you further! :-) Have a great day and until later!!!
--
Joseph Bittman Beta ID# 678424
Microsoft Certified Application Developer

Web Site: http://71.35.110.42
Dynamic IP -- Check here for future changes

"Oliver Rainer" <ol******@tiscali.ch> wrote in message
news:O$****************@TK2MSFTNGP10.phx.gbl...
Thanks for your suggestion... that really works for local groups
(BUILTIN),
but IIS still has the problem to resolve AD groups (OURDOMAIN\...)... The strange thing is that on certain machines (our developer machines), IIS
can
succesfully determine if a user belongs to an AD group...

Do you have other suggestions??

Thanks
Oliver Rainer
"Joseph Bittman MCAD" <Ry*********@msn.com> wrote in message
news:eI**************@TK2MSFTNGP12.phx.gbl...
June 7, 2005

hehe I actually have to go to a meeting right now, but a quick
suggestion
before I leave. Try switching the PrincipalPermission
role="domain\groupname" to "BUILTIN\GROUPNAME". There is a little more to this change, but it should work.... depending on which role it is, so
if you
could post it, that would really help... until later! :-)

--
Joseph Bittman
Microsoft Certified Application Developer

Web Site: http://71.35.110.42
Dynamic IP -- Check here for future changes

"Oliver Rainer" <ol******@tiscali.ch> wrote in message
news:ub**************@TK2MSFTNGP10.phx.gbl...
> Hi, I have the following problem...
>
> Pre-requisites:
> Installation of an Asp.net webservice on a IIS5 server (win2k).

Anonymous
> access is not allowed, only using windows authentication (intranet
> app),
> webmethoda are using the Principalpermssion attribute
> ([PrincipalPermission(SecurityAction.Demand,
> Role=@"DomainName\WindowsGroup...")]) for identification.
>
> Result --> does not work
>
> When I change the to [PrincipalPermission(SecurityAction.Demand,
> name=@"DomainName\Windowsuser...")]) -> it runs fine
>
> --> conclusion: IIS cannot determine if a user belongs to an AD

group -->
> IPrincipal.IsInRole(@"DomainName\WindowsGroup") is always FALSE!
>
> I already found an article on the web
> (http://www.kbalertz.com/kb_894432.aspx --> web dir is UNC share),
> but
> didn't solved the problem...
>
> Does anyone know more about this issue?
>
> Thanks
> Oliver Rainer
>
>
>



Nov 23 '05 #9

This discussion thread is closed

Replies have been disabled for this discussion.

Similar topics

1 post views Thread by John Kraft | last post: by
2 posts views Thread by Jesper Stocholm | last post: by
9 posts views Thread by Sameh Ahmed | last post: by
reply views Thread by Oliver Rainer | last post: by
3 posts views Thread by tshad | last post: by
3 posts views Thread by trullock | last post: by
reply views Thread by zhoujie | last post: by
reply views Thread by suresh191 | last post: by
By using this site, you agree to our Privacy Policy and Terms of Use.