Discussion:
Adding user to AD from WebService (first work, second fail)
(too old to reply)
Joe Kaplan (MVP - ADSI)
2004-07-27 17:05:08 UTC
Permalink
The first thing I'd do is figure out what mechanism is being used to set the
password. It could be SSL/LDAP, Kerberos or NetUserSetInfo. They all fail
for different reasons.

I tend to find SSL is the most reliable, but you need to have your DC
configured with a valid certificate for it to work.

You might try doing a network sniff of the traffic between the server and
the DC to see what's going on there. Port 636 would indicate SSL/LDAP, 464
for Kerberos password and 135 for the RPC call.

FWIW, you should be able to get this working, but SetPassword can be a bit
of a pain at times.

Joe K.
I've been looking around for information about my problem for a couple of
days now and I just can't find any usefull information.
I've develop some code that create a user in AD by using the
DirectoryServices.
At first I developed everything in a windowsform (everything was fine at
that time).
Second I migrated the code to a webservice and everything started to
behave strangely. I managed to make almost everything work after some
researches.
Now the last problem I have is that I can add a user to AD, set his
password and change the "useraccountcontrol" to ADS_UF_NORMAL_ACCOUNT on my
first trip to the webservice.
My second creation results in an error on the line
newEntry.Invoke("SetPassword", New String() {"Secret"})
The strange thing is that if I restart IIS I can add ONE user without any
problem and the second fails just like before.
Any solution other than restarting IIS on each user creation would be
good!
The Account is created on the second call but it is disabled
I have tried many differents combinasion of impersonate or not, use
logonuser or not... (with all the security consideration that this implies)
<authentication mode="None" />
and no settings for impersonation
I keep getting the same error no matter which configuration I use.
One or more input parameters are invalid
GetLDAPSearchRoot, GetLDAPDomain, GetLDAPUsername, GetLDAPPassword are
just returning settings from the web.config file.
"Exists" function is working fine and tells me if the useraccount already
exists on any trip to the service.
<WebMethod()> _
Public Function Add(ByVal UserInfo As AccountInfo, ByVal
LDAPConfigName As String) As Guid
Dim newEntry As AD.DirectoryEntry
'IMPORTANT: Must use ServerBind so Kerberos encryption is used
(using anything else results in a Network path not found when setting the
password)
'IMPORTANT: User must be part of the Domain Admins otherwise
we cannot Set the password
Dim RootEntry As New
AD.DirectoryEntry(GetLDAPSearchRoot(LDAPConfigName),
String.Format("{0}\{1}", GetLDAPDomain(LDAPConfigName),
GetLDAPUsername(LDAPConfigName)), GetLDAPPassword(LDAPConfigName),
AD.AuthenticationTypes.ServerBind)
Try
If Exists(UserInfo, LDAPConfigName) Then
Throw New Exceptions.UserAlreadyExistsException
End If
'Creating the new entry
newEntry = RootEntry.Children.Add("CN=" &
UserInfo.Username, "User")
newEntry.Properties("sAMAccountName").Value =
UserInfo.Username 'Mandatory
newEntry.CommitChanges() 'must be commited before any
modification to other properties are permitted
'Set the password
newEntry.Invoke("SetPassword", New String()
{UserInfo.Password})
'Set UserAccountControl property to Normal Account (not
doing so results in a disabled account)
newEntry.Properties("useraccountcontrol").Value =
ADS_UF_NORMAL_ACCOUNT
'Set properies received from UserInfo
'For Each prop As String In UserInfo.PropertyNames
' newEntry.Properties(prop).Value =
UserInfo.Properties(prop)
'Next
newEntry.CommitChanges()
Return newEntry.Guid
Catch ex As Exception
Throw
Finally
If Not newEntry Is Nothing Then
newEntry.Close()
newEntry.Dispose()
End If
If Not RootEntry Is Nothing Then
RootEntry.Close()
RootEntry.Dispose()
End If
End Try
End Function
--
Eric Beaudry
.Net Architecture Developer
Joe Kaplan (MVP - ADSI)
2004-07-27 20:10:36 UTC
Permalink
I agreee that the problem is probably security-related.

The idea behind the diagnostics is to just try to figure out what mechanism
is being used for the password change as they all fail for different
reasons. However, if that isn't possible or is too much trouble, then you
can try other stuff. I understand that doing network sniffs can be a pain,
especially if you don't control the hardware.

One thing you said concerns me regarding Kerberos and AuthenticationTypes.
ServerBind simply saves a DNS lookup if you have specified a full server
name instead of a domain name or nothing, so it is just a perf tweak. It
doesn't force Kerberos. If you want to force a Kerberos bind, you should
do:
AuthenticationTypes.Secure or AuthenticationTypes.Sealing or
AuthenticationTypes.Signing or AuthenticationTypes.Delegation. You can
combine that with ServerBind if you are specifying a specific server.

What format are you using for your binding string? Is it the full server
DNS name?

Another thing to do is check to see if there are any Schannel errors in the
event log on the web server as that might indicate an SSL/LDAP problem
between the web server and the DC.

Joe K.
Since the procedures your are asking me to try can be a bit long "and
painfull" to get in place.
Can you confirm that they can solve my problem. I'm a bit sckeptical about
it because my code did work on any first attempt and fails for every
following attempt until I restart IIS.
A cut & paste of this code in a dll used within a windowsform is also
working fine.
I'm not sure but I think my problem have to do with IIS/ASPNET and some
rights or privileges around that.
I'm also using the AuthenticationTypes.ServerBind flag in my constructor
to force Kerberos encryption. We do not have a valid certificat on the DC
and it would take months to have the admins do it.
If after all that you do think I should use a sniffer please can you
provide me with a link on good tools to do it and a procedure to test that.
thanks a lot for your help,
--
Eric Beaudry
.Net Architecture Developer
Post by Joe Kaplan (MVP - ADSI)
The first thing I'd do is figure out what mechanism is being used to set the
password. It could be SSL/LDAP, Kerberos or NetUserSetInfo. They all fail
for different reasons.
I tend to find SSL is the most reliable, but you need to have your DC
configured with a valid certificate for it to work.
You might try doing a network sniff of the traffic between the server and
the DC to see what's going on there. Port 636 would indicate SSL/LDAP, 464
for Kerberos password and 135 for the RPC call.
FWIW, you should be able to get this working, but SetPassword can be a bit
of a pain at times.
Joe K.
I've been looking around for information about my problem for a couple of
days now and I just can't find any usefull information.
I've develop some code that create a user in AD by using the
DirectoryServices.
At first I developed everything in a windowsform (everything was fine at
that time).
Second I migrated the code to a webservice and everything started to
behave strangely. I managed to make almost everything work after some
researches.
Now the last problem I have is that I can add a user to AD, set his
password and change the "useraccountcontrol" to ADS_UF_NORMAL_ACCOUNT on my
first trip to the webservice.
My second creation results in an error on the line
newEntry.Invoke("SetPassword", New String() {"Secret"})
The strange thing is that if I restart IIS I can add ONE user without any
problem and the second fails just like before.
Any solution other than restarting IIS on each user creation would be
good!
The Account is created on the second call but it is disabled
I have tried many differents combinasion of impersonate or not, use
logonuser or not... (with all the security consideration that this implies)
<authentication mode="None" />
and no settings for impersonation
I keep getting the same error no matter which configuration I use.
The error is: System.Runtime.InteropServices.COMException
One or more input parameters are invalid
GetLDAPSearchRoot, GetLDAPDomain, GetLDAPUsername, GetLDAPPassword are
just returning settings from the web.config file.
"Exists" function is working fine and tells me if the useraccount already
exists on any trip to the service.
<WebMethod()> _
Public Function Add(ByVal UserInfo As AccountInfo, ByVal
LDAPConfigName As String) As Guid
Dim newEntry As AD.DirectoryEntry
'IMPORTANT: Must use ServerBind so Kerberos encryption is used
(using anything else results in a Network path not found when setting the
password)
'IMPORTANT: User must be part of the Domain Admins otherwise
we cannot Set the password
Dim RootEntry As New
AD.DirectoryEntry(GetLDAPSearchRoot(LDAPConfigName),
String.Format("{0}\{1}", GetLDAPDomain(LDAPConfigName),
GetLDAPUsername(LDAPConfigName)), GetLDAPPassword(LDAPConfigName),
AD.AuthenticationTypes.ServerBind)
Try
If Exists(UserInfo, LDAPConfigName) Then
Throw New Exceptions.UserAlreadyExistsException
End If
'Creating the new entry
newEntry = RootEntry.Children.Add("CN=" &
UserInfo.Username, "User")
newEntry.Properties("sAMAccountName").Value =
UserInfo.Username 'Mandatory
newEntry.CommitChanges() 'must be commited before any
modification to other properties are permitted
'Set the password
newEntry.Invoke("SetPassword", New String()
{UserInfo.Password})
'Set UserAccountControl property to Normal Account (not
doing so results in a disabled account)
newEntry.Properties("useraccountcontrol").Value =
ADS_UF_NORMAL_ACCOUNT
'Set properies received from UserInfo
'For Each prop As String In UserInfo.PropertyNames
' newEntry.Properties(prop).Value =
UserInfo.Properties(prop)
'Next
newEntry.CommitChanges()
Return newEntry.Guid
Catch ex As Exception
Throw
Finally
If Not newEntry Is Nothing Then
newEntry.Close()
newEntry.Dispose()
End If
If Not RootEntry Is Nothing Then
RootEntry.Close()
RootEntry.Dispose()
End If
End Try
End Function
--
Eric Beaudry
.Net Architecture Developer
Eric Beaudry
2004-07-28 12:56:09 UTC
Permalink
A precision

After some testing the flag AuthenticationTypes.Secure is the one causing the error "the network path could not be found" when I remove this one I get the same error as before "One or more input parameters are invalid"
--
Eric Beaudry
.Net Architecture Developer
I've tried to use: AuthenticationTypes.Secure Or AuthenticationTypes.Sealing Or AuthenticationTypes.Signing Or AuthenticationTypes.Delegation Or AuthenticationTypes.ServerBind in my constructor and now I have "The network path could not be found" When I call Invoke("SetPassword", password)
does this point to another problem present on the network? Note that the account is still created but the password is not set.
LDAP://YMQ-DEV6/OU=Collaboration Test,DC=YMQ-DEV,DC=IATA,DC=ORG
YMQ-DEV6 is the DC and the user I supply to the constructor is a domain admin
And there are no events about Schannel in the event viewer.
--
Eric Beaudry
.Net Architecture Developer
Post by Joe Kaplan (MVP - ADSI)
I agreee that the problem is probably security-related.
The idea behind the diagnostics is to just try to figure out what mechanism
is being used for the password change as they all fail for different
reasons. However, if that isn't possible or is too much trouble, then you
can try other stuff. I understand that doing network sniffs can be a pain,
especially if you don't control the hardware.
One thing you said concerns me regarding Kerberos and AuthenticationTypes.
ServerBind simply saves a DNS lookup if you have specified a full server
name instead of a domain name or nothing, so it is just a perf tweak. It
doesn't force Kerberos. If you want to force a Kerberos bind, you should
AuthenticationTypes.Secure or AuthenticationTypes.Sealing or
AuthenticationTypes.Signing or AuthenticationTypes.Delegation. You can
combine that with ServerBind if you are specifying a specific server.
What format are you using for your binding string? Is it the full server
DNS name?
Another thing to do is check to see if there are any Schannel errors in the
event log on the web server as that might indicate an SSL/LDAP problem
between the web server and the DC.
Joe K.
Since the procedures your are asking me to try can be a bit long "and
painfull" to get in place.
Can you confirm that they can solve my problem. I'm a bit sckeptical about
it because my code did work on any first attempt and fails for every
following attempt until I restart IIS.
A cut & paste of this code in a dll used within a windowsform is also
working fine.
I'm not sure but I think my problem have to do with IIS/ASPNET and some
rights or privileges around that.
I'm also using the AuthenticationTypes.ServerBind flag in my constructor
to force Kerberos encryption. We do not have a valid certificat on the DC
and it would take months to have the admins do it.
If after all that you do think I should use a sniffer please can you
provide me with a link on good tools to do it and a procedure to test that.
thanks a lot for your help,
--
Eric Beaudry
.Net Architecture Developer
Post by Joe Kaplan (MVP - ADSI)
The first thing I'd do is figure out what mechanism is being used to set
the
Post by Joe Kaplan (MVP - ADSI)
password. It could be SSL/LDAP, Kerberos or NetUserSetInfo. They all
fail
Post by Joe Kaplan (MVP - ADSI)
for different reasons.
I tend to find SSL is the most reliable, but you need to have your DC
configured with a valid certificate for it to work.
You might try doing a network sniff of the traffic between the server
and
Post by Joe Kaplan (MVP - ADSI)
the DC to see what's going on there. Port 636 would indicate SSL/LDAP,
464
Post by Joe Kaplan (MVP - ADSI)
for Kerberos password and 135 for the RPC call.
FWIW, you should be able to get this working, but SetPassword can be a
bit
Post by Joe Kaplan (MVP - ADSI)
of a pain at times.
Joe K.
I've been looking around for information about my problem for a couple
of
Post by Joe Kaplan (MVP - ADSI)
days now and I just can't find any usefull information.
I've develop some code that create a user in AD by using the
DirectoryServices.
At first I developed everything in a windowsform (everything was fine
at
Post by Joe Kaplan (MVP - ADSI)
that time).
Second I migrated the code to a webservice and everything started to
behave strangely. I managed to make almost everything work after some
researches.
Now the last problem I have is that I can add a user to AD, set his
password and change the "useraccountcontrol" to ADS_UF_NORMAL_ACCOUNT on
my
Post by Joe Kaplan (MVP - ADSI)
first trip to the webservice.
My second creation results in an error on the line
newEntry.Invoke("SetPassword", New String() {"Secret"})
The strange thing is that if I restart IIS I can add ONE user without
any
Post by Joe Kaplan (MVP - ADSI)
problem and the second fails just like before.
Any solution other than restarting IIS on each user creation would be
good!
The Account is created on the second call but it is disabled
I have tried many differents combinasion of impersonate or not, use
logonuser or not... (with all the security consideration that this
implies)
Post by Joe Kaplan (MVP - ADSI)
<authentication mode="None" />
and no settings for impersonation
I keep getting the same error no matter which configuration I use.
The error is: System.Runtime.InteropServices.COMException
One or more input parameters are invalid
GetLDAPSearchRoot, GetLDAPDomain, GetLDAPUsername, GetLDAPPassword are
just returning settings from the web.config file.
"Exists" function is working fine and tells me if the useraccount
already
Post by Joe Kaplan (MVP - ADSI)
exists on any trip to the service.
<WebMethod()> _
Public Function Add(ByVal UserInfo As AccountInfo, ByVal
LDAPConfigName As String) As Guid
Dim newEntry As AD.DirectoryEntry
'IMPORTANT: Must use ServerBind so Kerberos encryption is
used
Post by Joe Kaplan (MVP - ADSI)
(using anything else results in a Network path not found when setting
the
Post by Joe Kaplan (MVP - ADSI)
password)
'IMPORTANT: User must be part of the Domain Admins
otherwise
Post by Joe Kaplan (MVP - ADSI)
we cannot Set the password
Dim RootEntry As New
AD.DirectoryEntry(GetLDAPSearchRoot(LDAPConfigName),
String.Format("{0}\{1}", GetLDAPDomain(LDAPConfigName),
GetLDAPUsername(LDAPConfigName)), GetLDAPPassword(LDAPConfigName),
AD.AuthenticationTypes.ServerBind)
Try
If Exists(UserInfo, LDAPConfigName) Then
Throw New Exceptions.UserAlreadyExistsException
End If
'Creating the new entry
newEntry = RootEntry.Children.Add("CN=" &
UserInfo.Username, "User")
newEntry.Properties("sAMAccountName").Value =
UserInfo.Username 'Mandatory
newEntry.CommitChanges() 'must be commited before any
modification to other properties are permitted
'Set the password
newEntry.Invoke("SetPassword", New String()
{UserInfo.Password})
'Set UserAccountControl property to Normal Account
(not
Post by Joe Kaplan (MVP - ADSI)
doing so results in a disabled account)
newEntry.Properties("useraccountcontrol").Value =
ADS_UF_NORMAL_ACCOUNT
'Set properies received from UserInfo
'For Each prop As String In UserInfo.PropertyNames
' newEntry.Properties(prop).Value =
UserInfo.Properties(prop)
'Next
newEntry.CommitChanges()
Return newEntry.Guid
Catch ex As Exception
Throw
Finally
If Not newEntry Is Nothing Then
newEntry.Close()
newEntry.Dispose()
End If
If Not RootEntry Is Nothing Then
RootEntry.Close()
RootEntry.Dispose()
End If
End Try
End Function
--
Eric Beaudry
.Net Architecture Developer
Joe Kaplan (MVP - ADSI)
2004-07-28 14:01:26 UTC
Permalink
Just out of curiosity, is your AD server configured with an SSL cert so that
you can do secure LDAP? You can test this if you try your bind with
AuthenticationTypes.SecureSocketsLayer. I'm still of the opinion that SSL
LDAP is the way to go for doing password stuff.

Also, another thing that would be interesting to try is doing
AuthenticationTypes.Secure without the other three parameters
(Signing/Sealing/Delegation) to see if it is just the Kerberos part that is
failing. When you specify Secure for your bind, Windows will use the
negotiate protocol to authenticate and that will fail over to NTLM if
Kerberos isn't available. However, the Signing/Sealing/Delegation stuff
forces Kerberos.

Sorry this is so painful. Hopefully we'll be able to get this.

Joe K.
Post by Eric Beaudry
A precision
After some testing the flag AuthenticationTypes.Secure is the one causing
the error "the network path could not be found" when I remove this one I get
the same error as before "One or more input parameters are invalid"
Post by Eric Beaudry
--
Eric Beaudry
.Net Architecture Developer
I've tried to use: AuthenticationTypes.Secure Or
AuthenticationTypes.Sealing Or AuthenticationTypes.Signing Or
AuthenticationTypes.Delegation Or AuthenticationTypes.ServerBind in my
constructor and now I have "The network path could not be found" When I call
Invoke("SetPassword", password)
Post by Eric Beaudry
does this point to another problem present on the network? Note that the
account is still created but the password is not set.
Post by Eric Beaudry
LDAP://YMQ-DEV6/OU=Collaboration Test,DC=YMQ-DEV,DC=IATA,DC=ORG
YMQ-DEV6 is the DC and the user I supply to the constructor is a domain admin
And there are no events about Schannel in the event viewer.
--
Eric Beaudry
.Net Architecture Developer
Post by Joe Kaplan (MVP - ADSI)
I agreee that the problem is probably security-related.
The idea behind the diagnostics is to just try to figure out what mechanism
is being used for the password change as they all fail for different
reasons. However, if that isn't possible or is too much trouble, then you
can try other stuff. I understand that doing network sniffs can be a pain,
especially if you don't control the hardware.
One thing you said concerns me regarding Kerberos and
AuthenticationTypes.
Post by Eric Beaudry
Post by Joe Kaplan (MVP - ADSI)
ServerBind simply saves a DNS lookup if you have specified a full server
name instead of a domain name or nothing, so it is just a perf tweak.
It
Post by Eric Beaudry
Post by Joe Kaplan (MVP - ADSI)
doesn't force Kerberos. If you want to force a Kerberos bind, you should
AuthenticationTypes.Secure or AuthenticationTypes.Sealing or
AuthenticationTypes.Signing or AuthenticationTypes.Delegation. You can
combine that with ServerBind if you are specifying a specific server.
What format are you using for your binding string? Is it the full server
DNS name?
Another thing to do is check to see if there are any Schannel errors in the
event log on the web server as that might indicate an SSL/LDAP problem
between the web server and the DC.
Joe K.
Since the procedures your are asking me to try can be a bit long "and
painfull" to get in place.
Can you confirm that they can solve my problem. I'm a bit sckeptical about
it because my code did work on any first attempt and fails for every
following attempt until I restart IIS.
A cut & paste of this code in a dll used within a windowsform is also
working fine.
I'm not sure but I think my problem have to do with IIS/ASPNET and some
rights or privileges around that.
I'm also using the AuthenticationTypes.ServerBind flag in my constructor
to force Kerberos encryption. We do not have a valid certificat on the DC
and it would take months to have the admins do it.
If after all that you do think I should use a sniffer please can you
provide me with a link on good tools to do it and a procedure to test that.
thanks a lot for your help,
--
Eric Beaudry
.Net Architecture Developer
Post by Joe Kaplan (MVP - ADSI)
The first thing I'd do is figure out what mechanism is being used to set
the
Post by Joe Kaplan (MVP - ADSI)
password. It could be SSL/LDAP, Kerberos or NetUserSetInfo. They all
fail
Post by Joe Kaplan (MVP - ADSI)
for different reasons.
I tend to find SSL is the most reliable, but you need to have your DC
configured with a valid certificate for it to work.
You might try doing a network sniff of the traffic between the server
and
Post by Joe Kaplan (MVP - ADSI)
the DC to see what's going on there. Port 636 would indicate SSL/LDAP,
464
Post by Joe Kaplan (MVP - ADSI)
for Kerberos password and 135 for the RPC call.
FWIW, you should be able to get this working, but SetPassword can be a
bit
Post by Joe Kaplan (MVP - ADSI)
of a pain at times.
Joe K.
I've been looking around for information about my problem for a couple
of
Post by Joe Kaplan (MVP - ADSI)
days now and I just can't find any usefull information.
I've develop some code that create a user in AD by using the
DirectoryServices.
At first I developed everything in a windowsform (everything was fine
at
Post by Joe Kaplan (MVP - ADSI)
that time).
Second I migrated the code to a webservice and everything started to
behave strangely. I managed to make almost everything work after some
researches.
Now the last problem I have is that I can add a user to AD, set his
password and change the "useraccountcontrol" to
ADS_UF_NORMAL_ACCOUNT on
Post by Eric Beaudry
Post by Joe Kaplan (MVP - ADSI)
my
Post by Joe Kaplan (MVP - ADSI)
first trip to the webservice.
My second creation results in an error on the line
newEntry.Invoke("SetPassword", New String() {"Secret"})
The strange thing is that if I restart IIS I can add ONE user without
any
Post by Joe Kaplan (MVP - ADSI)
problem and the second fails just like before.
Any solution other than restarting IIS on each user creation would be
good!
The Account is created on the second call but it is disabled
I have tried many differents combinasion of impersonate or not, use
logonuser or not... (with all the security consideration that this
implies)
Post by Joe Kaplan (MVP - ADSI)
<authentication mode="None" />
and no settings for impersonation
I keep getting the same error no matter which configuration I use.
The error is: System.Runtime.InteropServices.COMException
One or more input parameters are invalid
GetLDAPSearchRoot, GetLDAPDomain, GetLDAPUsername,
GetLDAPPassword are
Post by Eric Beaudry
Post by Joe Kaplan (MVP - ADSI)
Post by Joe Kaplan (MVP - ADSI)
just returning settings from the web.config file.
"Exists" function is working fine and tells me if the useraccount
already
Post by Joe Kaplan (MVP - ADSI)
exists on any trip to the service.
<WebMethod()> _
Public Function Add(ByVal UserInfo As AccountInfo, ByVal
LDAPConfigName As String) As Guid
Dim newEntry As AD.DirectoryEntry
'IMPORTANT: Must use ServerBind so Kerberos encryption is
used
Post by Joe Kaplan (MVP - ADSI)
(using anything else results in a Network path not found when setting
the
Post by Joe Kaplan (MVP - ADSI)
password)
'IMPORTANT: User must be part of the Domain Admins
otherwise
Post by Joe Kaplan (MVP - ADSI)
we cannot Set the password
Dim RootEntry As New
AD.DirectoryEntry(GetLDAPSearchRoot(LDAPConfigName),
String.Format("{0}\{1}", GetLDAPDomain(LDAPConfigName),
GetLDAPUsername(LDAPConfigName)), GetLDAPPassword(LDAPConfigName),
AD.AuthenticationTypes.ServerBind)
Try
If Exists(UserInfo, LDAPConfigName) Then
Throw New
Exceptions.UserAlreadyExistsException
Post by Eric Beaudry
Post by Joe Kaplan (MVP - ADSI)
Post by Joe Kaplan (MVP - ADSI)
End If
'Creating the new entry
newEntry = RootEntry.Children.Add("CN=" &
UserInfo.Username, "User")
newEntry.Properties("sAMAccountName").Value =
UserInfo.Username 'Mandatory
newEntry.CommitChanges() 'must be commited before any
modification to other properties are permitted
'Set the password
newEntry.Invoke("SetPassword", New String()
{UserInfo.Password})
'Set UserAccountControl property to Normal Account
(not
Post by Joe Kaplan (MVP - ADSI)
doing so results in a disabled account)
newEntry.Properties("useraccountcontrol").Value =
ADS_UF_NORMAL_ACCOUNT
'Set properies received from UserInfo
'For Each prop As String In
UserInfo.PropertyNames
Post by Eric Beaudry
Post by Joe Kaplan (MVP - ADSI)
Post by Joe Kaplan (MVP - ADSI)
' newEntry.Properties(prop).Value =
UserInfo.Properties(prop)
'Next
newEntry.CommitChanges()
Return newEntry.Guid
Catch ex As Exception
Throw
Finally
If Not newEntry Is Nothing Then
newEntry.Close()
newEntry.Dispose()
End If
If Not RootEntry Is Nothing Then
RootEntry.Close()
RootEntry.Dispose()
End If
End Try
End Function
--
Eric Beaudry
.Net Architecture Developer
Joe Kaplan (MVP - ADSI)
2004-07-28 15:44:34 UTC
Permalink
I'm really surprised that you can't get Secure binding to work. Just doing
AuthenticationTypes.Secure should always work with AD as far as I know.
Kerberos might not work, but I'm surprised it fails totally.

Here is a KBase article on setting up SSL on AD:
http://support.microsoft.com/default.aspx?scid=kb;en-us;321051

Hopefully that will help. Maybe someone else has some ideas why Secure
binding and Kerberos aren't working in IIS, but do work in a console app
(unless the console app is actually using NetUserSetInfo under the hood).

Just out of curiosity, does the console/forms app run on XP on a domain
member machine?

Joe K.
Don't be sorry (unless you're the one who made AD so complex!)
For the moment I appreciate your help and that's what is important.
So using: AuthenticationTypes.SecureSocketsLayer alone gives
"The server is not operational"
The account is NOT created
Seams like I'm not configured with an SSL certificat at all!
Using: AuthenticationTypes.Secure
System.IO.FileNotFoundException: The network path was not found.
The account gets created and SetPassword fails
Since you believe SSL is the way to go (And I'm starting to believe in it
too) Can you point me at some documentation on how to do that. I'll try to
convince the techs here to make that happen.
Again thanks a lot for your help,
Eric Beaudry
.Net Architecture Developer
Post by Joe Kaplan (MVP - ADSI)
Just out of curiosity, is your AD server configured with an SSL cert so that
you can do secure LDAP? You can test this if you try your bind with
AuthenticationTypes.SecureSocketsLayer. I'm still of the opinion that SSL
LDAP is the way to go for doing password stuff.
Also, another thing that would be interesting to try is doing
AuthenticationTypes.Secure without the other three parameters
(Signing/Sealing/Delegation) to see if it is just the Kerberos part that is
failing. When you specify Secure for your bind, Windows will use the
negotiate protocol to authenticate and that will fail over to NTLM if
Kerberos isn't available. However, the Signing/Sealing/Delegation stuff
forces Kerberos.
Sorry this is so painful. Hopefully we'll be able to get this.
Joe K.
Post by Eric Beaudry
A precision
After some testing the flag AuthenticationTypes.Secure is the one causing
the error "the network path could not be found" when I remove this one I get
the same error as before "One or more input parameters are invalid"
Post by Eric Beaudry
--
Eric Beaudry
.Net Architecture Developer
I've tried to use: AuthenticationTypes.Secure Or
AuthenticationTypes.Sealing Or AuthenticationTypes.Signing Or
AuthenticationTypes.Delegation Or AuthenticationTypes.ServerBind in my
constructor and now I have "The network path could not be found" When I call
Invoke("SetPassword", password)
Post by Eric Beaudry
does this point to another problem present on the network? Note that the
account is still created but the password is not set.
Post by Eric Beaudry
LDAP://YMQ-DEV6/OU=Collaboration Test,DC=YMQ-DEV,DC=IATA,DC=ORG
YMQ-DEV6 is the DC and the user I supply to the constructor is a
domain
Post by Joe Kaplan (MVP - ADSI)
admin
Post by Eric Beaudry
And there are no events about Schannel in the event viewer.
--
Eric Beaudry
.Net Architecture Developer
Post by Joe Kaplan (MVP - ADSI)
I agreee that the problem is probably security-related.
The idea behind the diagnostics is to just try to figure out what
mechanism
Post by Eric Beaudry
Post by Joe Kaplan (MVP - ADSI)
is being used for the password change as they all fail for different
reasons. However, if that isn't possible or is too much trouble,
then
Post by Joe Kaplan (MVP - ADSI)
you
Post by Eric Beaudry
Post by Joe Kaplan (MVP - ADSI)
can try other stuff. I understand that doing network sniffs can
be a
Post by Joe Kaplan (MVP - ADSI)
pain,
Post by Eric Beaudry
Post by Joe Kaplan (MVP - ADSI)
especially if you don't control the hardware.
One thing you said concerns me regarding Kerberos and
AuthenticationTypes.
Post by Eric Beaudry
Post by Joe Kaplan (MVP - ADSI)
ServerBind simply saves a DNS lookup if you have specified a full
server
Post by Eric Beaudry
Post by Joe Kaplan (MVP - ADSI)
name instead of a domain name or nothing, so it is just a perf tweak.
It
Post by Eric Beaudry
Post by Joe Kaplan (MVP - ADSI)
doesn't force Kerberos. If you want to force a Kerberos bind, you
should
Post by Eric Beaudry
Post by Joe Kaplan (MVP - ADSI)
AuthenticationTypes.Secure or AuthenticationTypes.Sealing or
AuthenticationTypes.Signing or AuthenticationTypes.Delegation.
You
Post by Joe Kaplan (MVP - ADSI)
can
Post by Eric Beaudry
Post by Joe Kaplan (MVP - ADSI)
combine that with ServerBind if you are specifying a specific server.
What format are you using for your binding string? Is it the full
server
Post by Eric Beaudry
Post by Joe Kaplan (MVP - ADSI)
DNS name?
Another thing to do is check to see if there are any Schannel
errors
Post by Joe Kaplan (MVP - ADSI)
in the
Post by Eric Beaudry
Post by Joe Kaplan (MVP - ADSI)
event log on the web server as that might indicate an SSL/LDAP problem
between the web server and the DC.
Joe K.
Since the procedures your are asking me to try can be a bit long
"and
Post by Eric Beaudry
Post by Joe Kaplan (MVP - ADSI)
painfull" to get in place.
Can you confirm that they can solve my problem. I'm a bit
sckeptical
Post by Joe Kaplan (MVP - ADSI)
about
Post by Eric Beaudry
Post by Joe Kaplan (MVP - ADSI)
it because my code did work on any first attempt and fails for every
following attempt until I restart IIS.
A cut & paste of this code in a dll used within a windowsform is
also
Post by Eric Beaudry
Post by Joe Kaplan (MVP - ADSI)
working fine.
I'm not sure but I think my problem have to do with IIS/ASPNET
and
Post by Joe Kaplan (MVP - ADSI)
some
Post by Eric Beaudry
Post by Joe Kaplan (MVP - ADSI)
rights or privileges around that.
I'm also using the AuthenticationTypes.ServerBind flag in my
constructor
Post by Eric Beaudry
Post by Joe Kaplan (MVP - ADSI)
to force Kerberos encryption. We do not have a valid certificat on
the
Post by Joe Kaplan (MVP - ADSI)
DC
Post by Eric Beaudry
Post by Joe Kaplan (MVP - ADSI)
and it would take months to have the admins do it.
If after all that you do think I should use a sniffer please can you
provide me with a link on good tools to do it and a procedure to
test
Post by Joe Kaplan (MVP - ADSI)
that.
Post by Eric Beaudry
Post by Joe Kaplan (MVP - ADSI)
thanks a lot for your help,
--
Eric Beaudry
.Net Architecture Developer
Post by Joe Kaplan (MVP - ADSI)
The first thing I'd do is figure out what mechanism is being
used
Post by Joe Kaplan (MVP - ADSI)
to set
Post by Eric Beaudry
Post by Joe Kaplan (MVP - ADSI)
the
Post by Joe Kaplan (MVP - ADSI)
password. It could be SSL/LDAP, Kerberos or NetUserSetInfo.
They
Post by Joe Kaplan (MVP - ADSI)
all
Post by Eric Beaudry
Post by Joe Kaplan (MVP - ADSI)
fail
Post by Joe Kaplan (MVP - ADSI)
for different reasons.
I tend to find SSL is the most reliable, but you need to have
your
Post by Joe Kaplan (MVP - ADSI)
DC
Post by Eric Beaudry
Post by Joe Kaplan (MVP - ADSI)
Post by Joe Kaplan (MVP - ADSI)
configured with a valid certificate for it to work.
You might try doing a network sniff of the traffic between the
server
Post by Eric Beaudry
Post by Joe Kaplan (MVP - ADSI)
and
Post by Joe Kaplan (MVP - ADSI)
the DC to see what's going on there. Port 636 would indicate
SSL/LDAP,
Post by Eric Beaudry
Post by Joe Kaplan (MVP - ADSI)
464
Post by Joe Kaplan (MVP - ADSI)
for Kerberos password and 135 for the RPC call.
FWIW, you should be able to get this working, but SetPassword
can
Post by Joe Kaplan (MVP - ADSI)
be a
Post by Eric Beaudry
Post by Joe Kaplan (MVP - ADSI)
bit
Post by Joe Kaplan (MVP - ADSI)
of a pain at times.
Joe K.
I've been looking around for information about my problem
for a
Post by Joe Kaplan (MVP - ADSI)
couple
Post by Eric Beaudry
Post by Joe Kaplan (MVP - ADSI)
of
Post by Joe Kaplan (MVP - ADSI)
days now and I just can't find any usefull information.
I've develop some code that create a user in AD by using the
DirectoryServices.
At first I developed everything in a windowsform (everything
was
Post by Joe Kaplan (MVP - ADSI)
fine
Post by Eric Beaudry
Post by Joe Kaplan (MVP - ADSI)
at
Post by Joe Kaplan (MVP - ADSI)
that time).
Second I migrated the code to a webservice and everything
started to
Post by Eric Beaudry
Post by Joe Kaplan (MVP - ADSI)
Post by Joe Kaplan (MVP - ADSI)
behave strangely. I managed to make almost everything work
after
Post by Joe Kaplan (MVP - ADSI)
some
Post by Eric Beaudry
Post by Joe Kaplan (MVP - ADSI)
Post by Joe Kaplan (MVP - ADSI)
researches.
Now the last problem I have is that I can add a user to AD,
set
Post by Joe Kaplan (MVP - ADSI)
his
Post by Eric Beaudry
Post by Joe Kaplan (MVP - ADSI)
Post by Joe Kaplan (MVP - ADSI)
password and change the "useraccountcontrol" to
ADS_UF_NORMAL_ACCOUNT on
Post by Eric Beaudry
Post by Joe Kaplan (MVP - ADSI)
my
Post by Joe Kaplan (MVP - ADSI)
first trip to the webservice.
My second creation results in an error on the line
newEntry.Invoke("SetPassword", New String() {"Secret"})
The strange thing is that if I restart IIS I can add ONE
user
Post by Joe Kaplan (MVP - ADSI)
without
Post by Eric Beaudry
Post by Joe Kaplan (MVP - ADSI)
any
Post by Joe Kaplan (MVP - ADSI)
problem and the second fails just like before.
Any solution other than restarting IIS on each user creation
would be
Post by Eric Beaudry
Post by Joe Kaplan (MVP - ADSI)
Post by Joe Kaplan (MVP - ADSI)
good!
The Account is created on the second call but it is disabled
I have tried many differents combinasion of impersonate or
not,
Post by Joe Kaplan (MVP - ADSI)
use
Post by Eric Beaudry
Post by Joe Kaplan (MVP - ADSI)
Post by Joe Kaplan (MVP - ADSI)
logonuser or not... (with all the security consideration that this
implies)
Post by Joe Kaplan (MVP - ADSI)
<authentication mode="None" />
and no settings for impersonation
I keep getting the same error no matter which configuration
I
Post by Joe Kaplan (MVP - ADSI)
use.
Post by Eric Beaudry
Post by Joe Kaplan (MVP - ADSI)
Post by Joe Kaplan (MVP - ADSI)
The error is: System.Runtime.InteropServices.COMException
One or more input parameters are invalid
GetLDAPSearchRoot, GetLDAPDomain, GetLDAPUsername,
GetLDAPPassword are
Post by Eric Beaudry
Post by Joe Kaplan (MVP - ADSI)
Post by Joe Kaplan (MVP - ADSI)
just returning settings from the web.config file.
"Exists" function is working fine and tells me if the
useraccount
Post by Eric Beaudry
Post by Joe Kaplan (MVP - ADSI)
already
Post by Joe Kaplan (MVP - ADSI)
exists on any trip to the service.
<WebMethod()> _
Public Function Add(ByVal UserInfo As AccountInfo, ByVal
LDAPConfigName As String) As Guid
Dim newEntry As AD.DirectoryEntry
'IMPORTANT: Must use ServerBind so Kerberos
encryption is
Post by Eric Beaudry
Post by Joe Kaplan (MVP - ADSI)
used
Post by Joe Kaplan (MVP - ADSI)
(using anything else results in a Network path not found when
setting
Post by Eric Beaudry
Post by Joe Kaplan (MVP - ADSI)
the
Post by Joe Kaplan (MVP - ADSI)
password)
'IMPORTANT: User must be part of the Domain Admins
otherwise
Post by Joe Kaplan (MVP - ADSI)
we cannot Set the password
Dim RootEntry As New
AD.DirectoryEntry(GetLDAPSearchRoot(LDAPConfigName),
String.Format("{0}\{1}", GetLDAPDomain(LDAPConfigName),
GetLDAPUsername(LDAPConfigName)),
GetLDAPPassword(LDAPConfigName),
Post by Joe Kaplan (MVP - ADSI)
Post by Eric Beaudry
Post by Joe Kaplan (MVP - ADSI)
Post by Joe Kaplan (MVP - ADSI)
AD.AuthenticationTypes.ServerBind)
Try
If Exists(UserInfo, LDAPConfigName) Then
Throw New
Exceptions.UserAlreadyExistsException
Post by Eric Beaudry
Post by Joe Kaplan (MVP - ADSI)
Post by Joe Kaplan (MVP - ADSI)
End If
'Creating the new entry
newEntry = RootEntry.Children.Add("CN=" &
UserInfo.Username, "User")
newEntry.Properties("sAMAccountName").Value =
UserInfo.Username 'Mandatory
newEntry.CommitChanges() 'must be commited
before any
Post by Eric Beaudry
Post by Joe Kaplan (MVP - ADSI)
Post by Joe Kaplan (MVP - ADSI)
modification to other properties are permitted
'Set the password
newEntry.Invoke("SetPassword", New String()
{UserInfo.Password})
'Set UserAccountControl property to Normal
Account
Post by Eric Beaudry
Post by Joe Kaplan (MVP - ADSI)
(not
Post by Joe Kaplan (MVP - ADSI)
doing so results in a disabled account)
newEntry.Properties("useraccountcontrol").Value
Post by Joe Kaplan (MVP - ADSI)
=
Post by Eric Beaudry
Post by Joe Kaplan (MVP - ADSI)
Post by Joe Kaplan (MVP - ADSI)
ADS_UF_NORMAL_ACCOUNT
'Set properies received from UserInfo
'For Each prop As String In
UserInfo.PropertyNames
Post by Eric Beaudry
Post by Joe Kaplan (MVP - ADSI)
Post by Joe Kaplan (MVP - ADSI)
' newEntry.Properties(prop).Value =
UserInfo.Properties(prop)
'Next
newEntry.CommitChanges()
Return newEntry.Guid
Catch ex As Exception
Throw
Finally
If Not newEntry Is Nothing Then
newEntry.Close()
newEntry.Dispose()
End If
If Not RootEntry Is Nothing Then
RootEntry.Close()
RootEntry.Dispose()
End If
End Try
End Function
--
Eric Beaudry
.Net Architecture Developer
Eric Beaudry
2004-07-28 17:02:01 UTC
Permalink
Yes the console app is running on XP pro and is member of the domain.

In the console app I'm using ServerBind not Secure just to be sure there's no confusion.

I'll check the article you sent me but chance are now big that we switch back to a database for our username password. We have lost about a week with that AD thing and we still cannot make it work.

Thanks again,
--
Eric Beaudry
.Net Architecture Developer
Post by Joe Kaplan (MVP - ADSI)
I'm really surprised that you can't get Secure binding to work. Just doing
AuthenticationTypes.Secure should always work with AD as far as I know.
Kerberos might not work, but I'm surprised it fails totally.
http://support.microsoft.com/default.aspx?scid=kb;en-us;321051
Hopefully that will help. Maybe someone else has some ideas why Secure
binding and Kerberos aren't working in IIS, but do work in a console app
(unless the console app is actually using NetUserSetInfo under the hood).
Just out of curiosity, does the console/forms app run on XP on a domain
member machine?
Joe K.
Don't be sorry (unless you're the one who made AD so complex!)
For the moment I appreciate your help and that's what is important.
So using: AuthenticationTypes.SecureSocketsLayer alone gives
"The server is not operational"
The account is NOT created
Seams like I'm not configured with an SSL certificat at all!
Using: AuthenticationTypes.Secure
System.IO.FileNotFoundException: The network path was not found.
The account gets created and SetPassword fails
Since you believe SSL is the way to go (And I'm starting to believe in it
too) Can you point me at some documentation on how to do that. I'll try to
convince the techs here to make that happen.
Again thanks a lot for your help,
Eric Beaudry
.Net Architecture Developer
Post by Joe Kaplan (MVP - ADSI)
Just out of curiosity, is your AD server configured with an SSL cert so
that
Post by Joe Kaplan (MVP - ADSI)
you can do secure LDAP? You can test this if you try your bind with
AuthenticationTypes.SecureSocketsLayer. I'm still of the opinion that
SSL
Post by Joe Kaplan (MVP - ADSI)
LDAP is the way to go for doing password stuff.
Also, another thing that would be interesting to try is doing
AuthenticationTypes.Secure without the other three parameters
(Signing/Sealing/Delegation) to see if it is just the Kerberos part that
is
Post by Joe Kaplan (MVP - ADSI)
failing. When you specify Secure for your bind, Windows will use the
negotiate protocol to authenticate and that will fail over to NTLM if
Kerberos isn't available. However, the Signing/Sealing/Delegation stuff
forces Kerberos.
Sorry this is so painful. Hopefully we'll be able to get this.
Joe K.
Post by Eric Beaudry
A precision
After some testing the flag AuthenticationTypes.Secure is the one
causing
Post by Joe Kaplan (MVP - ADSI)
the error "the network path could not be found" when I remove this one I
get
Post by Joe Kaplan (MVP - ADSI)
the same error as before "One or more input parameters are invalid"
Post by Eric Beaudry
--
Eric Beaudry
.Net Architecture Developer
I've tried to use: AuthenticationTypes.Secure Or
AuthenticationTypes.Sealing Or AuthenticationTypes.Signing Or
AuthenticationTypes.Delegation Or AuthenticationTypes.ServerBind in my
constructor and now I have "The network path could not be found" When I
call
Post by Joe Kaplan (MVP - ADSI)
Invoke("SetPassword", password)
Post by Eric Beaudry
does this point to another problem present on the network? Note that
the
Post by Joe Kaplan (MVP - ADSI)
account is still created but the password is not set.
Post by Eric Beaudry
LDAP://YMQ-DEV6/OU=Collaboration Test,DC=YMQ-DEV,DC=IATA,DC=ORG
YMQ-DEV6 is the DC and the user I supply to the constructor is a
domain
Post by Joe Kaplan (MVP - ADSI)
admin
Post by Eric Beaudry
And there are no events about Schannel in the event viewer.
--
Eric Beaudry
.Net Architecture Developer
Post by Joe Kaplan (MVP - ADSI)
I agreee that the problem is probably security-related.
The idea behind the diagnostics is to just try to figure out what
mechanism
Post by Eric Beaudry
Post by Joe Kaplan (MVP - ADSI)
is being used for the password change as they all fail for
different
Post by Joe Kaplan (MVP - ADSI)
Post by Eric Beaudry
Post by Joe Kaplan (MVP - ADSI)
reasons. However, if that isn't possible or is too much trouble,
then
Post by Joe Kaplan (MVP - ADSI)
you
Post by Eric Beaudry
Post by Joe Kaplan (MVP - ADSI)
can try other stuff. I understand that doing network sniffs can
be a
Post by Joe Kaplan (MVP - ADSI)
pain,
Post by Eric Beaudry
Post by Joe Kaplan (MVP - ADSI)
especially if you don't control the hardware.
One thing you said concerns me regarding Kerberos and
AuthenticationTypes.
Post by Eric Beaudry
Post by Joe Kaplan (MVP - ADSI)
ServerBind simply saves a DNS lookup if you have specified a full
server
Post by Eric Beaudry
Post by Joe Kaplan (MVP - ADSI)
name instead of a domain name or nothing, so it is just a perf
tweak.
Post by Joe Kaplan (MVP - ADSI)
It
Post by Eric Beaudry
Post by Joe Kaplan (MVP - ADSI)
doesn't force Kerberos. If you want to force a Kerberos bind, you
should
Post by Eric Beaudry
Post by Joe Kaplan (MVP - ADSI)
AuthenticationTypes.Secure or AuthenticationTypes.Sealing or
AuthenticationTypes.Signing or AuthenticationTypes.Delegation.
You
Post by Joe Kaplan (MVP - ADSI)
can
Post by Eric Beaudry
Post by Joe Kaplan (MVP - ADSI)
combine that with ServerBind if you are specifying a specific
server.
Post by Joe Kaplan (MVP - ADSI)
Post by Eric Beaudry
Post by Joe Kaplan (MVP - ADSI)
What format are you using for your binding string? Is it the full
server
Post by Eric Beaudry
Post by Joe Kaplan (MVP - ADSI)
DNS name?
Another thing to do is check to see if there are any Schannel
errors
Post by Joe Kaplan (MVP - ADSI)
in the
Post by Eric Beaudry
Post by Joe Kaplan (MVP - ADSI)
event log on the web server as that might indicate an SSL/LDAP
problem
Post by Joe Kaplan (MVP - ADSI)
Post by Eric Beaudry
Post by Joe Kaplan (MVP - ADSI)
between the web server and the DC.
Joe K.
Since the procedures your are asking me to try can be a bit long
"and
Post by Eric Beaudry
Post by Joe Kaplan (MVP - ADSI)
painfull" to get in place.
Can you confirm that they can solve my problem. I'm a bit
sckeptical
Post by Joe Kaplan (MVP - ADSI)
about
Post by Eric Beaudry
Post by Joe Kaplan (MVP - ADSI)
it because my code did work on any first attempt and fails for
every
Post by Joe Kaplan (MVP - ADSI)
Post by Eric Beaudry
Post by Joe Kaplan (MVP - ADSI)
following attempt until I restart IIS.
A cut & paste of this code in a dll used within a windowsform is
also
Post by Eric Beaudry
Post by Joe Kaplan (MVP - ADSI)
working fine.
I'm not sure but I think my problem have to do with IIS/ASPNET
and
Post by Joe Kaplan (MVP - ADSI)
some
Post by Eric Beaudry
Post by Joe Kaplan (MVP - ADSI)
rights or privileges around that.
I'm also using the AuthenticationTypes.ServerBind flag in my
constructor
Post by Eric Beaudry
Post by Joe Kaplan (MVP - ADSI)
to force Kerberos encryption. We do not have a valid certificat on
the
Post by Joe Kaplan (MVP - ADSI)
DC
Post by Eric Beaudry
Post by Joe Kaplan (MVP - ADSI)
and it would take months to have the admins do it.
If after all that you do think I should use a sniffer please can
you
Post by Joe Kaplan (MVP - ADSI)
Post by Eric Beaudry
Post by Joe Kaplan (MVP - ADSI)
provide me with a link on good tools to do it and a procedure to
test
Post by Joe Kaplan (MVP - ADSI)
that.
Post by Eric Beaudry
Post by Joe Kaplan (MVP - ADSI)
thanks a lot for your help,
--
Eric Beaudry
.Net Architecture Developer
Post by Joe Kaplan (MVP - ADSI)
The first thing I'd do is figure out what mechanism is being
used
Post by Joe Kaplan (MVP - ADSI)
to set
Post by Eric Beaudry
Post by Joe Kaplan (MVP - ADSI)
the
Post by Joe Kaplan (MVP - ADSI)
password. It could be SSL/LDAP, Kerberos or NetUserSetInfo.
They
Post by Joe Kaplan (MVP - ADSI)
all
Post by Eric Beaudry
Post by Joe Kaplan (MVP - ADSI)
fail
Post by Joe Kaplan (MVP - ADSI)
for different reasons.
I tend to find SSL is the most reliable, but you need to have
your
Post by Joe Kaplan (MVP - ADSI)
DC
Post by Eric Beaudry
Post by Joe Kaplan (MVP - ADSI)
Post by Joe Kaplan (MVP - ADSI)
configured with a valid certificate for it to work.
You might try doing a network sniff of the traffic between the
server
Post by Eric Beaudry
Post by Joe Kaplan (MVP - ADSI)
and
Post by Joe Kaplan (MVP - ADSI)
the DC to see what's going on there. Port 636 would indicate
SSL/LDAP,
Post by Eric Beaudry
Post by Joe Kaplan (MVP - ADSI)
464
Post by Joe Kaplan (MVP - ADSI)
for Kerberos password and 135 for the RPC call.
FWIW, you should be able to get this working, but SetPassword
can
Post by Joe Kaplan (MVP - ADSI)
be a
Post by Eric Beaudry
Post by Joe Kaplan (MVP - ADSI)
bit
Post by Joe Kaplan (MVP - ADSI)
of a pain at times.
Joe K.
I've been looking around for information about my problem
for a
Post by Joe Kaplan (MVP - ADSI)
couple
Post by Eric Beaudry
Post by Joe Kaplan (MVP - ADSI)
of
Post by Joe Kaplan (MVP - ADSI)
days now and I just can't find any usefull information.
I've develop some code that create a user in AD by using the
DirectoryServices.
At first I developed everything in a windowsform (everything
was
Post by Joe Kaplan (MVP - ADSI)
fine
Post by Eric Beaudry
Post by Joe Kaplan (MVP - ADSI)
at
Post by Joe Kaplan (MVP - ADSI)
that time).
Second I migrated the code to a webservice and everything
started to
Post by Eric Beaudry
Post by Joe Kaplan (MVP - ADSI)
Post by Joe Kaplan (MVP - ADSI)
behave strangely. I managed to make almost everything work
after
Post by Joe Kaplan (MVP - ADSI)
some
Post by Eric Beaudry
Post by Joe Kaplan (MVP - ADSI)
Post by Joe Kaplan (MVP - ADSI)
researches.
Now the last problem I have is that I can add a user to AD,
set
Post by Joe Kaplan (MVP - ADSI)
his
Post by Eric Beaudry
Post by Joe Kaplan (MVP - ADSI)
Post by Joe Kaplan (MVP - ADSI)
password and change the "useraccountcontrol" to
ADS_UF_NORMAL_ACCOUNT on
Post by Eric Beaudry
Post by Joe Kaplan (MVP - ADSI)
my
Post by Joe Kaplan (MVP - ADSI)
first trip to the webservice.
My second creation results in an error on the line
newEntry.Invoke("SetPassword", New String() {"Secret"})
The strange thing is that if I restart IIS I can add ONE
user
Post by Joe Kaplan (MVP - ADSI)
without
Post by Eric Beaudry
Post by Joe Kaplan (MVP - ADSI)
any
Post by Joe Kaplan (MVP - ADSI)
problem and the second fails just like before.
Any solution other than restarting IIS on each user creation
would be
Post by Eric Beaudry
Post by Joe Kaplan (MVP - ADSI)
Post by Joe Kaplan (MVP - ADSI)
good!
The Account is created on the second call but it is disabled
I have tried many differents combinasion of impersonate or
not,
Post by Joe Kaplan (MVP - ADSI)
use
Post by Eric Beaudry
Post by Joe Kaplan (MVP - ADSI)
Post by Joe Kaplan (MVP - ADSI)
logonuser or not... (with all the security consideration that
this
Post by Joe Kaplan (MVP - ADSI)
Post by Eric Beaudry
Post by Joe Kaplan (MVP - ADSI)
implies)
Post by Joe Kaplan (MVP - ADSI)
<authentication mode="None" />
and no settings for impersonation
I keep getting the same error no matter which configuration
I
Post by Joe Kaplan (MVP - ADSI)
use.
Post by Eric Beaudry
Post by Joe Kaplan (MVP - ADSI)
Post by Joe Kaplan (MVP - ADSI)
The error is: System.Runtime.InteropServices.COMException
One or more input parameters are invalid
GetLDAPSearchRoot, GetLDAPDomain, GetLDAPUsername,
GetLDAPPassword are
Post by Eric Beaudry
Post by Joe Kaplan (MVP - ADSI)
Post by Joe Kaplan (MVP - ADSI)
just returning settings from the web.config file.
"Exists" function is working fine and tells me if the
useraccount
Post by Eric Beaudry
Post by Joe Kaplan (MVP - ADSI)
already
Post by Joe Kaplan (MVP - ADSI)
exists on any trip to the service.
<WebMethod()> _
Public Function Add(ByVal UserInfo As AccountInfo,
ByVal
Post by Joe Kaplan (MVP - ADSI)
Post by Eric Beaudry
Post by Joe Kaplan (MVP - ADSI)
Post by Joe Kaplan (MVP - ADSI)
LDAPConfigName As String) As Guid
Dim newEntry As AD.DirectoryEntry
'IMPORTANT: Must use ServerBind so Kerberos
encryption is
Post by Eric Beaudry
Post by Joe Kaplan (MVP - ADSI)
used
Post by Joe Kaplan (MVP - ADSI)
(using anything else results in a Network path not found when
setting
Post by Eric Beaudry
Post by Joe Kaplan (MVP - ADSI)
the
Post by Joe Kaplan (MVP - ADSI)
password)
'IMPORTANT: User must be part of the Domain
Admins
Post by Joe Kaplan (MVP - ADSI)
Post by Eric Beaudry
Post by Joe Kaplan (MVP - ADSI)
otherwise
Post by Joe Kaplan (MVP - ADSI)
we cannot Set the password
Dim RootEntry As New
AD.DirectoryEntry(GetLDAPSearchRoot(LDAPConfigName),
String.Format("{0}\{1}", GetLDAPDomain(LDAPConfigName),
GetLDAPUsername(LDAPConfigName)),
GetLDAPPassword(LDAPConfigName),
Post by Joe Kaplan (MVP - ADSI)
Post by Eric Beaudry
Post by Joe Kaplan (MVP - ADSI)
Post by Joe Kaplan (MVP - ADSI)
AD.AuthenticationTypes.ServerBind)
Try
If Exists(UserInfo, LDAPConfigName) Then
Throw New
Exceptions.UserAlreadyExistsException
Post by Eric Beaudry
Post by Joe Kaplan (MVP - ADSI)
Post by Joe Kaplan (MVP - ADSI)
End If
'Creating the new entry
newEntry = RootEntry.Children.Add("CN=" &
UserInfo.Username, "User")
newEntry.Properties("sAMAccountName").Value
=
Post by Joe Kaplan (MVP - ADSI)
Post by Eric Beaudry
Post by Joe Kaplan (MVP - ADSI)
Post by Joe Kaplan (MVP - ADSI)
UserInfo.Username 'Mandatory
newEntry.CommitChanges() 'must be commited
before any
Post by Eric Beaudry
Post by Joe Kaplan (MVP - ADSI)
Post by Joe Kaplan (MVP - ADSI)
modification to other properties are permitted
'Set the password
newEntry.Invoke("SetPassword", New String()
{UserInfo.Password})
'Set UserAccountControl property to Normal
Account
Post by Eric Beaudry
Post by Joe Kaplan (MVP - ADSI)
(not
Post by Joe Kaplan (MVP - ADSI)
doing so results in a disabled account)
newEntry.Properties("useraccountcontrol").Value
Post by Joe Kaplan (MVP - ADSI)
=
Post by Eric Beaudry
Post by Joe Kaplan (MVP - ADSI)
Post by Joe Kaplan (MVP - ADSI)
ADS_UF_NORMAL_ACCOUNT
'Set properies received from UserInfo
'For Each prop As String In
UserInfo.PropertyNames
Post by Eric Beaudry
Post by Joe Kaplan (MVP - ADSI)
Post by Joe Kaplan (MVP - ADSI)
' newEntry.Properties(prop).Value =
UserInfo.Properties(prop)
'Next
newEntry.CommitChanges()
Return newEntry.Guid
Catch ex As Exception
Throw
Finally
If Not newEntry Is Nothing Then
newEntry.Close()
newEntry.Dispose()
End If
If Not RootEntry Is Nothing Then
RootEntry.Close()
RootEntry.Dispose()
End If
End Try
End Function
--
Eric Beaudry
.Net Architecture Developer
Joe Kaplan (MVP - ADSI)
2004-07-28 18:30:34 UTC
Permalink
An interesting difference between XP and 2000 is that in XP, normal users
can call the LogonUser function, where as in 2000, only SYSTEM can by
default. I know for a fact that the code in SetPassword that uses
NetUserSetInfo calls LogonUser first to make sure it can impersonate
properly, but that will fail on 2000 in ASP.NET as it is probably running as
the ASPNET account which is a local user account and doesn't have SYSTEM
privileges.

A test would be to change your processModel in IIS to SYSTEM to see if that
fixes things.

I'd still suggest the SSL route as it is best for long term.

Joe K.
Post by Eric Beaudry
Yes the console app is running on XP pro and is member of the domain.
In the console app I'm using ServerBind not Secure just to be sure there's no confusion.
I'll check the article you sent me but chance are now big that we switch
back to a database for our username password. We have lost about a week with
that AD thing and we still cannot make it work.
Post by Eric Beaudry
Thanks again,
--
Eric Beaudry
.Net Architecture Developer
Post by Joe Kaplan (MVP - ADSI)
I'm really surprised that you can't get Secure binding to work. Just doing
AuthenticationTypes.Secure should always work with AD as far as I know.
Kerberos might not work, but I'm surprised it fails totally.
http://support.microsoft.com/default.aspx?scid=kb;en-us;321051
Hopefully that will help. Maybe someone else has some ideas why Secure
binding and Kerberos aren't working in IIS, but do work in a console app
(unless the console app is actually using NetUserSetInfo under the hood).
Just out of curiosity, does the console/forms app run on XP on a domain
member machine?
Joe K.
Don't be sorry (unless you're the one who made AD so complex!)
For the moment I appreciate your help and that's what is important.
So using: AuthenticationTypes.SecureSocketsLayer alone gives
"The server is not operational"
The account is NOT created
Seams like I'm not configured with an SSL certificat at all!
Using: AuthenticationTypes.Secure
System.IO.FileNotFoundException: The network path was not found.
The account gets created and SetPassword fails
Since you believe SSL is the way to go (And I'm starting to believe in it
too) Can you point me at some documentation on how to do that. I'll try to
convince the techs here to make that happen.
Again thanks a lot for your help,
Eric Beaudry
.Net Architecture Developer
Post by Joe Kaplan (MVP - ADSI)
Just out of curiosity, is your AD server configured with an SSL cert so
that
Post by Joe Kaplan (MVP - ADSI)
you can do secure LDAP? You can test this if you try your bind with
AuthenticationTypes.SecureSocketsLayer. I'm still of the opinion that
SSL
Post by Joe Kaplan (MVP - ADSI)
LDAP is the way to go for doing password stuff.
Also, another thing that would be interesting to try is doing
AuthenticationTypes.Secure without the other three parameters
(Signing/Sealing/Delegation) to see if it is just the Kerberos part that
is
Post by Joe Kaplan (MVP - ADSI)
failing. When you specify Secure for your bind, Windows will use the
negotiate protocol to authenticate and that will fail over to NTLM if
Kerberos isn't available. However, the Signing/Sealing/Delegation stuff
forces Kerberos.
Sorry this is so painful. Hopefully we'll be able to get this.
Joe K.
Post by Eric Beaudry
A precision
After some testing the flag AuthenticationTypes.Secure is the one
causing
Post by Joe Kaplan (MVP - ADSI)
the error "the network path could not be found" when I remove this one I
get
Post by Joe Kaplan (MVP - ADSI)
the same error as before "One or more input parameters are invalid"
Post by Eric Beaudry
--
Eric Beaudry
.Net Architecture Developer
I've tried to use: AuthenticationTypes.Secure Or
AuthenticationTypes.Sealing Or AuthenticationTypes.Signing Or
AuthenticationTypes.Delegation Or AuthenticationTypes.ServerBind in my
constructor and now I have "The network path could not be found" When I
call
Post by Joe Kaplan (MVP - ADSI)
Invoke("SetPassword", password)
Post by Eric Beaudry
does this point to another problem present on the network? Note that
the
Post by Joe Kaplan (MVP - ADSI)
account is still created but the password is not set.
Post by Eric Beaudry
LDAP://YMQ-DEV6/OU=Collaboration Test,DC=YMQ-DEV,DC=IATA,DC=ORG
YMQ-DEV6 is the DC and the user I supply to the constructor is a
domain
Post by Joe Kaplan (MVP - ADSI)
admin
Post by Eric Beaudry
And there are no events about Schannel in the event viewer.
--
Eric Beaudry
.Net Architecture Developer
Post by Joe Kaplan (MVP - ADSI)
I agreee that the problem is probably security-related.
The idea behind the diagnostics is to just try to figure out what
mechanism
Post by Eric Beaudry
Post by Joe Kaplan (MVP - ADSI)
is being used for the password change as they all fail for
different
Post by Joe Kaplan (MVP - ADSI)
Post by Eric Beaudry
Post by Joe Kaplan (MVP - ADSI)
reasons. However, if that isn't possible or is too much trouble,
then
Post by Joe Kaplan (MVP - ADSI)
you
Post by Eric Beaudry
Post by Joe Kaplan (MVP - ADSI)
can try other stuff. I understand that doing network sniffs can
be a
Post by Joe Kaplan (MVP - ADSI)
pain,
Post by Eric Beaudry
Post by Joe Kaplan (MVP - ADSI)
especially if you don't control the hardware.
One thing you said concerns me regarding Kerberos and
AuthenticationTypes.
Post by Eric Beaudry
Post by Joe Kaplan (MVP - ADSI)
ServerBind simply saves a DNS lookup if you have specified a full
server
Post by Eric Beaudry
Post by Joe Kaplan (MVP - ADSI)
name instead of a domain name or nothing, so it is just a perf
tweak.
Post by Joe Kaplan (MVP - ADSI)
It
Post by Eric Beaudry
Post by Joe Kaplan (MVP - ADSI)
doesn't force Kerberos. If you want to force a Kerberos bind, you
should
Post by Eric Beaudry
Post by Joe Kaplan (MVP - ADSI)
AuthenticationTypes.Secure or AuthenticationTypes.Sealing or
AuthenticationTypes.Signing or AuthenticationTypes.Delegation.
You
Post by Joe Kaplan (MVP - ADSI)
can
Post by Eric Beaudry
Post by Joe Kaplan (MVP - ADSI)
combine that with ServerBind if you are specifying a specific
server.
Post by Joe Kaplan (MVP - ADSI)
Post by Eric Beaudry
Post by Joe Kaplan (MVP - ADSI)
What format are you using for your binding string? Is it the full
server
Post by Eric Beaudry
Post by Joe Kaplan (MVP - ADSI)
DNS name?
Another thing to do is check to see if there are any Schannel
errors
Post by Joe Kaplan (MVP - ADSI)
in the
Post by Eric Beaudry
Post by Joe Kaplan (MVP - ADSI)
event log on the web server as that might indicate an SSL/LDAP
problem
Post by Joe Kaplan (MVP - ADSI)
Post by Eric Beaudry
Post by Joe Kaplan (MVP - ADSI)
between the web server and the DC.
Joe K.
Since the procedures your are asking me to try can be a bit long
"and
Post by Eric Beaudry
Post by Joe Kaplan (MVP - ADSI)
painfull" to get in place.
Can you confirm that they can solve my problem. I'm a bit
sckeptical
Post by Joe Kaplan (MVP - ADSI)
about
Post by Eric Beaudry
Post by Joe Kaplan (MVP - ADSI)
it because my code did work on any first attempt and fails for
every
Post by Joe Kaplan (MVP - ADSI)
Post by Eric Beaudry
Post by Joe Kaplan (MVP - ADSI)
following attempt until I restart IIS.
A cut & paste of this code in a dll used within a windowsform is
also
Post by Eric Beaudry
Post by Joe Kaplan (MVP - ADSI)
working fine.
I'm not sure but I think my problem have to do with IIS/ASPNET
and
Post by Joe Kaplan (MVP - ADSI)
some
Post by Eric Beaudry
Post by Joe Kaplan (MVP - ADSI)
rights or privileges around that.
I'm also using the AuthenticationTypes.ServerBind flag in my
constructor
Post by Eric Beaudry
Post by Joe Kaplan (MVP - ADSI)
to force Kerberos encryption. We do not have a valid certificat on
the
Post by Joe Kaplan (MVP - ADSI)
DC
Post by Eric Beaudry
Post by Joe Kaplan (MVP - ADSI)
and it would take months to have the admins do it.
If after all that you do think I should use a sniffer please can
you
Post by Joe Kaplan (MVP - ADSI)
Post by Eric Beaudry
Post by Joe Kaplan (MVP - ADSI)
provide me with a link on good tools to do it and a procedure to
test
Post by Joe Kaplan (MVP - ADSI)
that.
Post by Eric Beaudry
Post by Joe Kaplan (MVP - ADSI)
thanks a lot for your help,
--
Eric Beaudry
.Net Architecture Developer
Post by Joe Kaplan (MVP - ADSI)
The first thing I'd do is figure out what mechanism is being
used
Post by Joe Kaplan (MVP - ADSI)
to set
Post by Eric Beaudry
Post by Joe Kaplan (MVP - ADSI)
the
Post by Joe Kaplan (MVP - ADSI)
password. It could be SSL/LDAP, Kerberos or
NetUserSetInfo.
Post by Eric Beaudry
Post by Joe Kaplan (MVP - ADSI)
They
Post by Joe Kaplan (MVP - ADSI)
all
Post by Eric Beaudry
Post by Joe Kaplan (MVP - ADSI)
fail
Post by Joe Kaplan (MVP - ADSI)
for different reasons.
I tend to find SSL is the most reliable, but you need to have
your
Post by Joe Kaplan (MVP - ADSI)
DC
Post by Eric Beaudry
Post by Joe Kaplan (MVP - ADSI)
Post by Joe Kaplan (MVP - ADSI)
configured with a valid certificate for it to work.
You might try doing a network sniff of the traffic between the
server
Post by Eric Beaudry
Post by Joe Kaplan (MVP - ADSI)
and
Post by Joe Kaplan (MVP - ADSI)
the DC to see what's going on there. Port 636 would indicate
SSL/LDAP,
Post by Eric Beaudry
Post by Joe Kaplan (MVP - ADSI)
464
Post by Joe Kaplan (MVP - ADSI)
for Kerberos password and 135 for the RPC call.
FWIW, you should be able to get this working, but SetPassword
can
Post by Joe Kaplan (MVP - ADSI)
be a
Post by Eric Beaudry
Post by Joe Kaplan (MVP - ADSI)
bit
Post by Joe Kaplan (MVP - ADSI)
of a pain at times.
Joe K.
I've been looking around for information about my problem
for a
Post by Joe Kaplan (MVP - ADSI)
couple
Post by Eric Beaudry
Post by Joe Kaplan (MVP - ADSI)
of
Post by Joe Kaplan (MVP - ADSI)
days now and I just can't find any usefull information.
I've develop some code that create a user in AD by using the
DirectoryServices.
At first I developed everything in a windowsform (everything
was
Post by Joe Kaplan (MVP - ADSI)
fine
Post by Eric Beaudry
Post by Joe Kaplan (MVP - ADSI)
at
Post by Joe Kaplan (MVP - ADSI)
that time).
Second I migrated the code to a webservice and everything
started to
Post by Eric Beaudry
Post by Joe Kaplan (MVP - ADSI)
Post by Joe Kaplan (MVP - ADSI)
behave strangely. I managed to make almost everything work
after
Post by Joe Kaplan (MVP - ADSI)
some
Post by Eric Beaudry
Post by Joe Kaplan (MVP - ADSI)
Post by Joe Kaplan (MVP - ADSI)
researches.
Now the last problem I have is that I can add a user to AD,
set
Post by Joe Kaplan (MVP - ADSI)
his
Post by Eric Beaudry
Post by Joe Kaplan (MVP - ADSI)
Post by Joe Kaplan (MVP - ADSI)
password and change the "useraccountcontrol" to
ADS_UF_NORMAL_ACCOUNT on
Post by Eric Beaudry
Post by Joe Kaplan (MVP - ADSI)
my
Post by Joe Kaplan (MVP - ADSI)
first trip to the webservice.
My second creation results in an error on the line
newEntry.Invoke("SetPassword", New String() {"Secret"})
The strange thing is that if I restart IIS I can add ONE
user
Post by Joe Kaplan (MVP - ADSI)
without
Post by Eric Beaudry
Post by Joe Kaplan (MVP - ADSI)
any
Post by Joe Kaplan (MVP - ADSI)
problem and the second fails just like before.
Any solution other than restarting IIS on each user creation
would be
Post by Eric Beaudry
Post by Joe Kaplan (MVP - ADSI)
Post by Joe Kaplan (MVP - ADSI)
good!
The Account is created on the second call but it is disabled
I have tried many differents combinasion of impersonate or
not,
Post by Joe Kaplan (MVP - ADSI)
use
Post by Eric Beaudry
Post by Joe Kaplan (MVP - ADSI)
Post by Joe Kaplan (MVP - ADSI)
logonuser or not... (with all the security consideration that
this
Post by Joe Kaplan (MVP - ADSI)
Post by Eric Beaudry
Post by Joe Kaplan (MVP - ADSI)
implies)
Post by Joe Kaplan (MVP - ADSI)
<authentication mode="None" />
and no settings for impersonation
I keep getting the same error no matter which configuration
I
Post by Joe Kaplan (MVP - ADSI)
use.
System.Runtime.InteropServices.COMException
Post by Eric Beaudry
Post by Joe Kaplan (MVP - ADSI)
Post by Joe Kaplan (MVP - ADSI)
Post by Eric Beaudry
Post by Joe Kaplan (MVP - ADSI)
Post by Joe Kaplan (MVP - ADSI)
One or more input parameters are invalid
GetLDAPSearchRoot, GetLDAPDomain, GetLDAPUsername,
GetLDAPPassword are
Post by Eric Beaudry
Post by Joe Kaplan (MVP - ADSI)
Post by Joe Kaplan (MVP - ADSI)
just returning settings from the web.config file.
"Exists" function is working fine and tells me if the
useraccount
Post by Eric Beaudry
Post by Joe Kaplan (MVP - ADSI)
already
Post by Joe Kaplan (MVP - ADSI)
exists on any trip to the service.
<WebMethod()> _
Public Function Add(ByVal UserInfo As AccountInfo,
ByVal
Post by Joe Kaplan (MVP - ADSI)
Post by Eric Beaudry
Post by Joe Kaplan (MVP - ADSI)
Post by Joe Kaplan (MVP - ADSI)
LDAPConfigName As String) As Guid
Dim newEntry As AD.DirectoryEntry
'IMPORTANT: Must use ServerBind so Kerberos
encryption is
Post by Eric Beaudry
Post by Joe Kaplan (MVP - ADSI)
used
Post by Joe Kaplan (MVP - ADSI)
(using anything else results in a Network path not found when
setting
Post by Eric Beaudry
Post by Joe Kaplan (MVP - ADSI)
the
Post by Joe Kaplan (MVP - ADSI)
password)
'IMPORTANT: User must be part of the Domain
Admins
Post by Joe Kaplan (MVP - ADSI)
Post by Eric Beaudry
Post by Joe Kaplan (MVP - ADSI)
otherwise
Post by Joe Kaplan (MVP - ADSI)
we cannot Set the password
Dim RootEntry As New
AD.DirectoryEntry(GetLDAPSearchRoot(LDAPConfigName),
String.Format("{0}\{1}", GetLDAPDomain(LDAPConfigName),
GetLDAPUsername(LDAPConfigName)),
GetLDAPPassword(LDAPConfigName),
Post by Joe Kaplan (MVP - ADSI)
Post by Eric Beaudry
Post by Joe Kaplan (MVP - ADSI)
Post by Joe Kaplan (MVP - ADSI)
AD.AuthenticationTypes.ServerBind)
Try
If Exists(UserInfo, LDAPConfigName) Then
Throw New
Exceptions.UserAlreadyExistsException
Post by Eric Beaudry
Post by Joe Kaplan (MVP - ADSI)
Post by Joe Kaplan (MVP - ADSI)
End If
'Creating the new entry
newEntry = RootEntry.Children.Add("CN=" &
UserInfo.Username, "User")
newEntry.Properties("sAMAccountName").Value
Post by Eric Beaudry
Post by Joe Kaplan (MVP - ADSI)
=
Post by Joe Kaplan (MVP - ADSI)
Post by Eric Beaudry
Post by Joe Kaplan (MVP - ADSI)
Post by Joe Kaplan (MVP - ADSI)
UserInfo.Username 'Mandatory
newEntry.CommitChanges() 'must be commited
before any
Post by Eric Beaudry
Post by Joe Kaplan (MVP - ADSI)
Post by Joe Kaplan (MVP - ADSI)
modification to other properties are permitted
'Set the password
newEntry.Invoke("SetPassword", New String()
{UserInfo.Password})
'Set UserAccountControl property to Normal
Account
Post by Eric Beaudry
Post by Joe Kaplan (MVP - ADSI)
(not
Post by Joe Kaplan (MVP - ADSI)
doing so results in a disabled account)
newEntry.Properties("useraccountcontrol").Value
Post by Joe Kaplan (MVP - ADSI)
=
Post by Eric Beaudry
Post by Joe Kaplan (MVP - ADSI)
Post by Joe Kaplan (MVP - ADSI)
ADS_UF_NORMAL_ACCOUNT
'Set properies received from UserInfo
'For Each prop As String In
UserInfo.PropertyNames
Post by Eric Beaudry
Post by Joe Kaplan (MVP - ADSI)
Post by Joe Kaplan (MVP - ADSI)
' newEntry.Properties(prop).Value =
UserInfo.Properties(prop)
'Next
newEntry.CommitChanges()
Return newEntry.Guid
Catch ex As Exception
Throw
Finally
If Not newEntry Is Nothing Then
newEntry.Close()
newEntry.Dispose()
End If
If Not RootEntry Is Nothing Then
RootEntry.Close()
RootEntry.Dispose()
End If
End Try
End Function
--
Eric Beaudry
.Net Architecture Developer
Eric Beaudry
2004-07-28 19:33:05 UTC
Permalink
Using SYSTEM did not change a thing and I must admit that I'm really surprised about this one. All the posting I've seen were saying that one solution was to swith ASPNET to SYSTEM. But for security reason many also unrecommend doing so.

I just had some news about the TS team and we will be able to install the sniffers sometime next week. We should then be able to pin-point the problem. I have also recommended to install an SSL certificate.

I'll start another thread when I have some new information.

In the mean time, thanks for your help and if you have any other recommendations on how we should setup our AD to have better chances of success I'm open to suggestions.
Joe Kaplan (MVP - ADSI)
2004-07-28 20:09:56 UTC
Permalink
Definitely don't run as SYSTEM. That was just a trouble-shooting step to
try to diagnose it.

Loop back around when SSL is set up on the DC and we'll see if we can make
more progress.

Joe K.
Post by Eric Beaudry
Using SYSTEM did not change a thing and I must admit that I'm really
surprised about this one. All the posting I've seen were saying that one
solution was to swith ASPNET to SYSTEM. But for security reason many also
unrecommend doing so.
Post by Eric Beaudry
I just had some news about the TS team and we will be able to install the
sniffers sometime next week. We should then be able to pin-point the
problem. I have also recommended to install an SSL certificate.
Post by Eric Beaudry
I'll start another thread when I have some new information.
In the mean time, thanks for your help and if you have any other
recommendations on how we should setup our AD to have better chances of
success I'm open to suggestions.
schoneme
2004-10-08 14:03:04 UTC
Permalink
Did you ever solve this. I have the same problem
I've been looking around for information about my problem for a couple of days now and I just can't find any usefull information.
I've develop some code that create a user in AD by using the DirectoryServices.
At first I developed everything in a windowsform (everything was fine at that time).
Second I migrated the code to a webservice and everything started to behave strangely. I managed to make almost everything work after some researches.
Now the last problem I have is that I can add a user to AD, set his password and change the "useraccountcontrol" to ADS_UF_NORMAL_ACCOUNT on my first trip to the webservice.
My second creation results in an error on the line newEntry.Invoke("SetPassword", New String() {"Secret"})
The strange thing is that if I restart IIS I can add ONE user without any problem and the second fails just like before.
Any solution other than restarting IIS on each user creation would be good!
The Account is created on the second call but it is disabled
I have tried many differents combinasion of impersonate or not, use logonuser or not... (with all the security consideration that this implies)
<authentication mode="None" />
and no settings for impersonation
I keep getting the same error no matter which configuration I use.
The error is: System.Runtime.InteropServices.COMException (0x80005008): One or more input parameters are invalid
GetLDAPSearchRoot, GetLDAPDomain, GetLDAPUsername, GetLDAPPassword are just returning settings from the web.config file.
"Exists" function is working fine and tells me if the useraccount already exists on any trip to the service.
<WebMethod()> _
Public Function Add(ByVal UserInfo As AccountInfo, ByVal LDAPConfigName As String) As Guid
Dim newEntry As AD.DirectoryEntry
'IMPORTANT: Must use ServerBind so Kerberos encryption is used (using anything else results in a Network path not found when setting the password)
'IMPORTANT: User must be part of the Domain Admins otherwise we cannot Set the password
Dim RootEntry As New AD.DirectoryEntry(GetLDAPSearchRoot(LDAPConfigName), String.Format("{0}\{1}", GetLDAPDomain(LDAPConfigName), GetLDAPUsername(LDAPConfigName)), GetLDAPPassword(LDAPConfigName), AD.AuthenticationTypes.ServerBind)
Try
If Exists(UserInfo, LDAPConfigName) Then
Throw New Exceptions.UserAlreadyExistsException
End If
'Creating the new entry
newEntry = RootEntry.Children.Add("CN=" & UserInfo.Username, "User")
newEntry.Properties("sAMAccountName").Value = UserInfo.Username 'Mandatory
newEntry.CommitChanges() 'must be commited before any modification to other properties are permitted
'Set the password
newEntry.Invoke("SetPassword", New String() {UserInfo.Password})
'Set UserAccountControl property to Normal Account (not doing so results in a disabled account)
newEntry.Properties("useraccountcontrol").Value = ADS_UF_NORMAL_ACCOUNT
'Set properies received from UserInfo
'For Each prop As String In UserInfo.PropertyNames
' newEntry.Properties(prop).Value = UserInfo.Properties(prop)
'Next
newEntry.CommitChanges()
Return newEntry.Guid
Catch ex As Exception
Throw
Finally
If Not newEntry Is Nothing Then
newEntry.Close()
newEntry.Dispose()
End If
If Not RootEntry Is Nothing Then
RootEntry.Close()
RootEntry.Dispose()
End If
End Try
End Function
--
Eric Beaudry
.Net Architecture Developer
g***@gmail.com
2012-07-05 21:24:20 UTC
Permalink
Me too...

How solve this problem?
Post by schoneme
Did you ever solve this. I have the same problem
I've been looking around for information about my problem for a couple of days now and I just can't find any usefull information.
I've develop some code that create a user in AD by using the DirectoryServices.
At first I developed everything in a windowsform (everything was fine at that time).
Second I migrated the code to a webservice and everything started to behave strangely. I managed to make almost everything work after some researches.
Now the last problem I have is that I can add a user to AD, set his password and change the "useraccountcontrol" to ADS_UF_NORMAL_ACCOUNT on my first trip to the webservice.
My second creation results in an error on the line newEntry.Invoke("SetPassword", New String() {"Secret"})
The strange thing is that if I restart IIS I can add ONE user without any problem and the second fails just like before.
Any solution other than restarting IIS on each user creation would be good!
The Account is created on the second call but it is disabled
I have tried many differents combinasion of impersonate or not, use logonuser or not... (with all the security consideration that this implies)
<authentication mode="None" />
and no settings for impersonation
I keep getting the same error no matter which configuration I use.
The error is: System.Runtime.InteropServices.COMException (0x80005008): One or more input parameters are invalid
GetLDAPSearchRoot, GetLDAPDomain, GetLDAPUsername, GetLDAPPassword are just returning settings from the web.config file.
"Exists" function is working fine and tells me if the useraccount already exists on any trip to the service.
<WebMethod()> _
Public Function Add(ByVal UserInfo As AccountInfo, ByVal LDAPConfigName As String) As Guid
Dim newEntry As AD.DirectoryEntry
'IMPORTANT: Must use ServerBind so Kerberos encryption is used (using anything else results in a Network path not found when setting the password)
'IMPORTANT: User must be part of the Domain Admins otherwise we cannot Set the password
Dim RootEntry As New AD.DirectoryEntry(GetLDAPSearchRoot(LDAPConfigName), String.Format("{0}\{1}", GetLDAPDomain(LDAPConfigName), GetLDAPUsername(LDAPConfigName)), GetLDAPPassword(LDAPConfigName), AD.AuthenticationTypes.ServerBind)
Try
If Exists(UserInfo, LDAPConfigName) Then
Throw New Exceptions.UserAlreadyExistsException
End If
'Creating the new entry
newEntry = RootEntry.Children.Add("CN=" & UserInfo.Username, "User")
newEntry.Properties("sAMAccountName").Value = UserInfo.Username 'Mandatory
newEntry.CommitChanges() 'must be commited before any modification to other properties are permitted
'Set the password
newEntry.Invoke("SetPassword", New String() {UserInfo.Password})
'Set UserAccountControl property to Normal Account (not doing so results in a disabled account)
newEntry.Properties("useraccountcontrol").Value = ADS_UF_NORMAL_ACCOUNT
'Set properies received from UserInfo
'For Each prop As String In UserInfo.PropertyNames
' newEntry.Properties(prop).Value = UserInfo.Properties(prop)
'Next
newEntry.CommitChanges()
Return newEntry.Guid
Catch ex As Exception
Throw
Finally
If Not newEntry Is Nothing Then
newEntry.Close()
newEntry.Dispose()
End If
If Not RootEntry Is Nothing Then
RootEntry.Close()
RootEntry.Dispose()
End If
End Try
End Function
--
Eric Beaudry
.Net Architecture Developer
r***@gmail.com
2013-05-27 15:38:59 UTC
Permalink
Hi Please use a third party tool such as Lepide Auditor for Active Directory for the same. This tool will enable your all the active directory user a specific search and moreover it will give you a compliance report also for the same.

Please download the tool from the given link..

http://www.lepide.com/active-directory-audit/

Download and test it today.

Thanks.
I've been looking around for information about my problem for a couple of days now and I just can't find any usefull information.
I've develop some code that create a user in AD by using the DirectoryServices.
At first I developed everything in a windowsform (everything was fine at that time).
Second I migrated the code to a webservice and everything started to behave strangely. I managed to make almost everything work after some researches.
Now the last problem I have is that I can add a user to AD, set his password and change the "useraccountcontrol" to ADS_UF_NORMAL_ACCOUNT on my first trip to the webservice.
My second creation results in an error on the line newEntry.Invoke("SetPassword", New String() {"Secret"})
The strange thing is that if I restart IIS I can add ONE user without any problem and the second fails just like before.
Any solution other than restarting IIS on each user creation would be good!
The Account is created on the second call but it is disabled
I have tried many differents combinasion of impersonate or not, use logonuser or not... (with all the security consideration that this implies)
<authentication mode="None" />
and no settings for impersonation
I keep getting the same error no matter which configuration I use.
The error is: System.Runtime.InteropServices.COMException (0x80005008): One or more input parameters are invalid
GetLDAPSearchRoot, GetLDAPDomain, GetLDAPUsername, GetLDAPPassword are just returning settings from the web.config file.
"Exists" function is working fine and tells me if the useraccount already exists on any trip to the service.
<WebMethod()> _
Public Function Add(ByVal UserInfo As AccountInfo, ByVal LDAPConfigName As String) As Guid
Dim newEntry As AD.DirectoryEntry
'IMPORTANT: Must use ServerBind so Kerberos encryption is used (using anything else results in a Network path not found when setting the password)
'IMPORTANT: User must be part of the Domain Admins otherwise we cannot Set the password
Dim RootEntry As New AD.DirectoryEntry(GetLDAPSearchRoot(LDAPConfigName), String.Format("{0}\{1}", GetLDAPDomain(LDAPConfigName), GetLDAPUsername(LDAPConfigName)), GetLDAPPassword(LDAPConfigName), AD.AuthenticationTypes.ServerBind)
Try
If Exists(UserInfo, LDAPConfigName) Then
Throw New Exceptions.UserAlreadyExistsException
End If
'Creating the new entry
newEntry = RootEntry.Children.Add("CN=" & UserInfo.Username, "User")
newEntry.Properties("sAMAccountName").Value = UserInfo.Username 'Mandatory
newEntry.CommitChanges() 'must be commited before any modification to other properties are permitted
'Set the password
newEntry.Invoke("SetPassword", New String() {UserInfo.Password})
'Set UserAccountControl property to Normal Account (not doing so results in a disabled account)
newEntry.Properties("useraccountcontrol").Value = ADS_UF_NORMAL_ACCOUNT
'Set properies received from UserInfo
'For Each prop As String In UserInfo.PropertyNames
' newEntry.Properties(prop).Value = UserInfo.Properties(prop)
'Next
newEntry.CommitChanges()
Return newEntry.Guid
Catch ex As Exception
Throw
Finally
If Not newEntry Is Nothing Then
newEntry.Close()
newEntry.Dispose()
End If
If Not RootEntry Is Nothing Then
RootEntry.Close()
RootEntry.Dispose()
End If
End Try
End Function
--
Eric Beaudry
.Net Architecture Developer
Loading...