IsInRole & SID/Token Caching in .NET v1.1

From: Mark Seward (mark.seward.spamkiller_at_convergence-comm.com)
Date: 07/15/05

  • Next message: Joe Kaplan \(MVP - ADSI\): "Re: IsInRole & SID/Token Caching in .NET v1.1" 
    Date: Fri, 15 Jul 2005 14:43:05 -0700

    I have a win2003 server that needs to do IsInRole queries aganist users
    ("targets") other than the thread-executing user (the "operator"). The class
    I'm building will be used by ASP.NET apps and also by Windows Services.

    I know about using protocol transition to get an unauthenticated
    WindowsIdentity from the target UPNName, then getting the corresponding
    WindowsPrincipal and doing an IsInRole on that. Works great, if a little
    slow.

    But if I then change the target user's group membership in AD on our DC and
    re-execute the code, the update isn't reflected in the results. Apparently
    my local server is caching the underlying SID / token data someplace.
    Stopping & restarting my WinService app does NOT trigger a refresh.

    Eventually, usually after several minutes, the update propagates & I get
    correct results again. (Presumably after the entry gets flushed from
    aforesaid cache due to age / LRU??). So I conclude the issue is somewhere in
    the bowels of Win2003 SID / LSSAS processing, about which I have no clue.

    Is there an accessible cache-flush function I could wrap and then call from
    .NET? Or at least something to force a fresh look at the particluar target
    WindowIdentity / WindowsPrincipal I'm interested in? Would calling it
    destroy the performance of the IIS server my app is running on?

    Thanks in advance,
    Mark Seward, MCAD .NET

  • Next message: Joe Kaplan \(MVP - ADSI\): "Re: IsInRole & SID/Token Caching in .NET v1.1"

    Relevant Pages

    • Re: Windows 2000 vs. XP Home Edition ?
      ... Professional, Server, Advanced Server and Datacenter Server. ... Windows 2000 is a downgrade in versions from XP but in alot of peoples ... their manner and XP is an easy OS to target. ...
      (microsoft.public.win2000.general)
    • Re: Does Microsoft lie about the Linux features?
      ... Nimda and all those other worms that target Windows. ... >> I've copied files between NTFS partitions on different machines and had ... > That's because that software only ships with server versions of the OS. ...
      (comp.os.linux.misc)
    • Re: Does Microsoft lie about the Linux features?
      ... Nimda and all those other worms that target Windows. ... >> I've copied files between NTFS partitions on different machines and had ... > That's because that software only ships with server versions of the OS. ...
      (comp.os.linux.hardware)
    • Re: Does Microsoft lie about the Linux features?
      ... Nimda and all those other worms that target Windows. ... >> I've copied files between NTFS partitions on different machines and had ... > That's because that software only ships with server versions of the OS. ...
      (comp.os.linux.networking)
    • SecurityFocus Microsoft Newsletter #154
      ... MICROSOFT VULNERABILITY SUMMARY ... ISS RealSecure Server Sensor SSL Denial Of Service Vulnerabi... ... Roger Wilco Remote Server Side Buffer Overrun Vulnerability ... available for Microsoft Windows operating systems. ...
      (Focus-Microsoft)
    • Quantcast