Re: Unable to retrieve user identity using vb6 client

From: Tom Kaminski [MVP] ((A_at_T))
Date: 06/12/03


Date: Thu, 12 Jun 2003 11:33:38 -0400


"Chris Harrison" <chris.harrison@lineone.net> wrote in message
news:000301c330f4$2bd48f90$a301280a@phx.gbl...
>
> >-----Original Message-----
> >"Chris harrison" <chris.harrison@lineone.net> wrote in
> message
> >news:08eb01c330c0$b0fef9a0$a301280a@phx.gbl...
> >> I'm using integrated windows authentication on IIS5 on
> >> win2k server. The server is behind a port80 only
> firewall
> >> on the intranet, and has a one-way-trust to the same NT
> >> domain control that the clients use.
> >>
> >> A webservice sits on the server that amongst other
> things,
> >> authorises access to certain web methods based on a
> >> database table and the user's identity.
> >>
> >> A simple web method called getUserIdentity has been
> >> written that simply has
> >> Return User.Identity.Name
> >> When testing the web service through a browser, the user
> >> identity is correctly returned.
> >>
> >> When testing the web service from a vb6 application
> using
> >> a MSSOAPLib30.SoapClient30 object, access to the service
> >> is denied. It appears that this somehow prevents the
> >> correct user identity being available even though it was
> >> available using a browser front end.
> >>
> >> The same Soap Client code works when integrated windows
> >> security is disabled and the authorisation routine is
> >> circumnavigated.
> >>
> >> I've checked the NTFS permissions and added Everyone
> with
> >> full control as a check but still have the same issue.
> >>
> >> Could anyone suggest what might be happening and a
> >> solution?
> >
> >It sounds like MSSOAPLib30.SoapClient30 doesn't support
> Windows Integrated
> >authentication, which makes sense given that SOAP is an
> open standard while
> >Windows Integrated authentication is proprietary.
> Perhaps you could use an
> >IE object instead?
>
> Thanks for the reply.
> When I set this up on a test network with Active
> Directory, a windowsxp client and a windows2000 server it
> does work. The returned soap message is the correct
> domain\user. Would this rule out the possiblity that Soap
> prevents windows integrated authentication from working?
> My (basic) understanding of win int auth is that no
> windows user info is actually passed across from client to
> server with a request. If both machines are on the same
> domain, IIS simply checks that the client has been
> authenticated by the domain controller and uses that
> identity. Is this right?
> Any more ideas?

I'll admit I don't know much about SOAP, but did your test use a browser or
the VB client? The key is that the client supports the protocol.

-- 
Tom Kaminski IIS MVP
http://www.iistoolshed.com/ - tools, scripts, and utilities for running IIS
http://mvp.support.microsoft.com/
http://www.microsoft.com/windowsserver2003/community/centers/iis/


Relevant Pages

  • Re: HELP PLEASE The request failed with HTTP status 401: Access Denied.
    ... Web Security: Part 2: Introducing the Web Application Manager, Client ... Authentication Options, and Process Isolation ... It introduces the Web Application Manager in IIS that ... logon session, which is dangerous. ...
    (microsoft.public.dotnet.framework.aspnet.security)
  • Re: HTTPWebRequest.request.GetResponse fails: remote server returned error: (401) unauthorized.
    ... "IIS appears to prevent access" because even if IIS prevents access, ... Do you want authenticated user credentials from the client ASP.Net ... authentication protocols as they should be. ... Impersonation is achieved in the Client applications by using the ...
    (microsoft.public.inetserver.iis.security)
  • Authentication troubles
    ... I have a web folder setup on IIS 5 on Win 2K server. ... level is set to Integrated Windows Authentication, ... similar client that is able to logon correctly. ...
    (microsoft.public.inetserver.iis.security)
  • Authentication troubles
    ... I have a web folder setup on IIS 5 on Win 2K server. ... level is set to Integrated Windows Authentication, ... similar client that is able to logon correctly. ...
    (microsoft.public.inetserver.iis)
  • Re: How does IIS handle user impersonation token?
    ... I am trying to understand how IIS handles authentication on subsequent> round ... >: trips to the server. ... how does IIS handle the user>: ... > For HTTP based authentication mechanisms,> the client sends the credentials to IIS using the Authorization: header as> part of each request to the server. ...
    (microsoft.public.inetserver.iis.security)