access to network file server through web server denied

18 Feb 2009 1:44 PM

xcomplus

Here is the setup:
IIS 6 on Windows Server 2003
On IIS: Anonymous access unchecked. Integrated windows authentication checked.
Inside Web.config:
<authentication mode="Windows"/>
<identity impersonate="true"/>

In the code of the problem page, call WindowsIdentity.GetCurrent().Name
returns the domain user logged on that can access the network file server.
However, as soon as it calls Directory.GetDirectories(network_path), the
login dialog to the web server will popup. The login dialog can not recognize
correct credential and continue to popup for three times. After that, the
error message says "Access to path 'network_path' is denied.

20 Feb 2009 5:55 PM

DaveMo

On Feb 18, 5:44 am, xcomplus <xcomp***@discussions.microsoft.com>
wrote:

> Here is the setup:
> IIS 6 on Windows Server 2003
> On IIS: Anonymous access unchecked. Integrated windows authentication checked.
> Inside Web.config:
> <authentication mode="Windows"/>
> <identity impersonate="true"/>
>
> In the code of the problem page, call WindowsIdentity.GetCurrent().Name
> returns the domain user logged on that can access the network file server..
> However, as soon as it calls Directory.GetDirectories(network_path), the
> login dialog to the web server will popup. The login dialog can not recognize
> correct credential and continue to popup for three times. After that, the
> error message says "Access to path 'network_path' is denied.

You are describing a transitive authentication scenario which requires
delegation to be configured. More information on how to do this here:
http://support.microsoft.com/kb/810572

I'm not exactly sure what's driving the login dialog behavior and why
it's rejecting the credentials. If you can provide more information on
the desired behavior - i.e. do you want to have the delegated
authentication experience for your users, or do you want them to be
able to retype their creds (or different creds?) - then other
information might be out there to assist you in solving the problem.

HTH,
Dave

23 Feb 2009 4:31 PM

xcomplus

Thank you very much for the response. Before I check with the network team to
see whether the network has been configured with "Delegation", I have one
question. On our local developer's web server (It can be IIS 5 on Windows XP
or IIS 7 on Vista), we do not have this problem at all. Is that means that
for developer's web server to access network resources, there is no need for
the delegation to be configured?

Thanks.

Show quoteHide quote

"DaveMo" wrote:

> On Feb 18, 5:44 am, xcomplus <xcomp***@discussions.microsoft.com>
> wrote:
> > Here is the setup:
> > IIS 6 on Windows Server 2003
> > On IIS: Anonymous access unchecked. Integrated windows authentication checked.
> > Inside Web.config:
> > <authentication mode="Windows"/>
> > <identity impersonate="true"/>
> >
> > In the code of the problem page, call WindowsIdentity.GetCurrent().Name
> > returns the domain user logged on that can access the network file server..
> > However, as soon as it calls Directory.GetDirectories(network_path), the
> > login dialog to the web server will popup. The login dialog can not recognize
> > correct credential and continue to popup for three times. After that, the
> > error message says "Access to path 'network_path' is denied.
>
> You are describing a transitive authentication scenario which requires
> delegation to be configured. More information on how to do this here:
> http://support.microsoft.com/kb/810572
>
> I'm not exactly sure what's driving the login dialog behavior and why
> it's rejecting the credentials. If you can provide more information on
> the desired behavior - i.e. do you want to have the delegated
> authentication experience for your users, or do you want them to be
> able to retype their creds (or different creds?) - then other
> information might be out there to assist you in solving the problem.
>
> HTH,
> Dave
>

24 Feb 2009 4:31 AM

Ken Schaefer

Is the user who is accessing the webserver on the XP box accessing the
webserver locally (i.e. using a browser on the XP/Vista workstation)? If so,
the authentication token is different, which is why it works

For setting up Kerberos and Delegation, I have a set of FAQ available here:
www.adopenstatic.com/faq (under the IIS and Kerberos heading)

Cheers
Ken

Show quoteHide quote

"xcomplus" <xcomp***@discussions.microsoft.com> wrote in message
news:F712C7B4-C105-4310-80A0-77988F29FCE9@microsoft.com...
> Thank you very much for the response. Before I check with the network team
> to
> see whether the network has been configured with "Delegation", I have one
> question. On our local developer's web server (It can be IIS 5 on Windows
> XP
> or IIS 7 on Vista), we do not have this problem at all. Is that means that
> for developer's web server to access network resources, there is no need
> for
> the delegation to be configured?
>
> Thanks.
>
> "DaveMo" wrote:
>
>> On Feb 18, 5:44 am, xcomplus <xcomp***@discussions.microsoft.com>
>> wrote:
>> > Here is the setup:
>> > IIS 6 on Windows Server 2003
>> > On IIS: Anonymous access unchecked. Integrated windows authentication
>> > checked.
>> > Inside Web.config:
>> > <authentication mode="Windows"/>
>> > <identity impersonate="true"/>
>> >
>> > In the code of the problem page, call WindowsIdentity.GetCurrent().Name
>> > returns the domain user logged on that can access the network file
>> > server..
>> > However, as soon as it calls Directory.GetDirectories(network_path),
>> > the
>> > login dialog to the web server will popup. The login dialog can not
>> > recognize
>> > correct credential and continue to popup for three times. After that,
>> > the
>> > error message says "Access to path 'network_path' is denied.
>>
>> You are describing a transitive authentication scenario which requires
>> delegation to be configured. More information on how to do this here:
>> http://support.microsoft.com/kb/810572
>>
>> I'm not exactly sure what's driving the login dialog behavior and why
>> it's rejecting the credentials. If you can provide more information on
>> the desired behavior - i.e. do you want to have the delegated
>> authentication experience for your users, or do you want them to be
>> able to retype their creds (or different creds?) - then other
>> information might be out there to assist you in solving the problem.
>>
>> HTH,
>> Dave
>>