Joe Kaplan (MVP - ADSI)
2004-07-27 17:05:08 UTC
The first thing I'd do is figure out what mechanism is being used to set the
password. It could be SSL/LDAP, Kerberos or NetUserSetInfo. They all fail
for different reasons.
I tend to find SSL is the most reliable, but you need to have your DC
configured with a valid certificate for it to work.
You might try doing a network sniff of the traffic between the server and
the DC to see what's going on there. Port 636 would indicate SSL/LDAP, 464
for Kerberos password and 135 for the RPC call.
FWIW, you should be able to get this working, but SetPassword can be a bit
of a pain at times.
Joe K.
researches.
first trip to the webservice.
password)
String.Format("{0}\{1}", GetLDAPDomain(LDAPConfigName),
GetLDAPUsername(LDAPConfigName)), GetLDAPPassword(LDAPConfigName),
AD.AuthenticationTypes.ServerBind)
password. It could be SSL/LDAP, Kerberos or NetUserSetInfo. They all fail
for different reasons.
I tend to find SSL is the most reliable, but you need to have your DC
configured with a valid certificate for it to work.
You might try doing a network sniff of the traffic between the server and
the DC to see what's going on there. Port 636 would indicate SSL/LDAP, 464
for Kerberos password and 135 for the RPC call.
FWIW, you should be able to get this working, but SetPassword can be a bit
of a pain at times.
Joe K.
I've been looking around for information about my problem for a couple of
days now and I just can't find any usefull information.I've develop some code that create a user in AD by using the
DirectoryServices.At first I developed everything in a windowsform (everything was fine at
that time).Second I migrated the code to a webservice and everything started to
behave strangely. I managed to make almost everything work after someresearches.
Now the last problem I have is that I can add a user to AD, set his
password and change the "useraccountcontrol" to ADS_UF_NORMAL_ACCOUNT on myfirst trip to the webservice.
My second creation results in an error on the line
newEntry.Invoke("SetPassword", New String() {"Secret"})The strange thing is that if I restart IIS I can add ONE user without any
problem and the second fails just like before.Any solution other than restarting IIS on each user creation would be
good!The Account is created on the second call but it is disabled
I have tried many differents combinasion of impersonate or not, use
logonuser or not... (with all the security consideration that this implies)I have tried many differents combinasion of impersonate or not, use
<authentication mode="None" />
and no settings for impersonation
I keep getting the same error no matter which configuration I use.
One or more input parameters are invalidand no settings for impersonation
I keep getting the same error no matter which configuration I use.
GetLDAPSearchRoot, GetLDAPDomain, GetLDAPUsername, GetLDAPPassword are
just returning settings from the web.config file."Exists" function is working fine and tells me if the useraccount already
exists on any trip to the service.<WebMethod()> _
Public Function Add(ByVal UserInfo As AccountInfo, ByVal
LDAPConfigName As String) As GuidPublic Function Add(ByVal UserInfo As AccountInfo, ByVal
Dim newEntry As AD.DirectoryEntry
'IMPORTANT: Must use ServerBind so Kerberos encryption is used
(using anything else results in a Network path not found when setting the'IMPORTANT: Must use ServerBind so Kerberos encryption is used
password)
'IMPORTANT: User must be part of the Domain Admins otherwise
we cannot Set the passwordDim RootEntry As New
AD.DirectoryEntry(GetLDAPSearchRoot(LDAPConfigName),String.Format("{0}\{1}", GetLDAPDomain(LDAPConfigName),
GetLDAPUsername(LDAPConfigName)), GetLDAPPassword(LDAPConfigName),
AD.AuthenticationTypes.ServerBind)
Try
If Exists(UserInfo, LDAPConfigName) Then
Throw New Exceptions.UserAlreadyExistsException
End If
'Creating the new entry
newEntry = RootEntry.Children.Add("CN=" &
UserInfo.Username, "User")If Exists(UserInfo, LDAPConfigName) Then
Throw New Exceptions.UserAlreadyExistsException
End If
'Creating the new entry
newEntry = RootEntry.Children.Add("CN=" &
newEntry.Properties("sAMAccountName").Value =
UserInfo.Username 'MandatorynewEntry.CommitChanges() 'must be commited before any
modification to other properties are permitted'Set the password
newEntry.Invoke("SetPassword", New String()
{UserInfo.Password})newEntry.Invoke("SetPassword", New String()
'Set UserAccountControl property to Normal Account (not
doing so results in a disabled account)newEntry.Properties("useraccountcontrol").Value =
ADS_UF_NORMAL_ACCOUNT'Set properies received from UserInfo
'For Each prop As String In UserInfo.PropertyNames
' newEntry.Properties(prop).Value =
UserInfo.Properties(prop)'For Each prop As String In UserInfo.PropertyNames
' newEntry.Properties(prop).Value =
'Next
newEntry.CommitChanges()
Return newEntry.Guid
Catch ex As Exception
Throw
Finally
If Not newEntry Is Nothing Then
newEntry.Close()
newEntry.Dispose()
End If
If Not RootEntry Is Nothing Then
RootEntry.Close()
RootEntry.Dispose()
End If
End Try
End Function
--
Eric Beaudry
.Net Architecture Developer
newEntry.CommitChanges()
Return newEntry.Guid
Catch ex As Exception
Throw
Finally
If Not newEntry Is Nothing Then
newEntry.Close()
newEntry.Dispose()
End If
If Not RootEntry Is Nothing Then
RootEntry.Close()
RootEntry.Dispose()
End If
End Try
End Function
--
Eric Beaudry
.Net Architecture Developer