Re: InvalidCastException Using AzMan from ASP.NET

Tech Tip: Click here to run a free scan for Windows Errors and optimize PC performance

From: Chris Bilson (cbilson_at_crimes.net)
Date: 02/06/04 

Date: 6 Feb 2004 14:51:36 -0800

Thanks Ying-Shen!

v-yiy@online.microsoft.com ("Ying-Shen Yu[MSFT]") wrote in message news:<zBkIsdK7DHA.808@cpmsftngxa07.phx.gbl>...
> First I'd like you check the sample in this article,
>
> <Role-Based Access Control for Multi-tier Applications Using Authorization
> Manager>
> http://www.microsoft.com/technet/treeview/default.asp?url=/technet/prodtechn
> ol/windowsserver2003/maintain/security/athmanwp.asp

Have it right here on my desk. It's the article that convinced me that
AuthMan was what I had been looking for for authorization.

That sample works fine on my machine no matter how many requests I
make, even if I include the ASP.NET page in the article in my
application's vdir.

The only problem is that that sample initializes the AzManStore and
Opens the application on every request. That just seems very
inefficient for my application, since everything in the application
will be using the same IAzApplication.

> especially make sure you are running the application server in a service
> account.

OK. My application is running in it's own app pool, as NETWORK
SERVICE. I assume that is what you mean by a service account (it has
the login as service right). Since you mentioned this, I tried
changing the identity for the app pool to local service and then local
system. No help.

I also tried running the application on a test server that has an app
pool that runs as a domain account (which has login as service on that
machine). Same problem.

BTW, the NETWORK SERVICE account on my machine has read access to my
auth man file.

> In Addition, I'd like you try turning on the ASP Compatibility mode, add
> the aspcompat=true attribute to the Page Directive.

I tried this for the page I have been getting the fault on, it didn't
help, so I went back and turned on aspcompat for all the pages I view
before I get to that page. That didn't help either.

> Also, just to confirm does this problem also occur if deployed your program
> on some other windows 2003 servers?

Yes. We only have Windows Server 2003 servers, so I can't confirm if
this is a problem on older machines.

For now, I think I will just change my SecurityMgr class to initialize
the IAzApplication for each request, until I can find a better work
around. Really wish I knew what caused this.

Relevant Pages

  • [REVS] NTLM HTTP Authentication is Insecure By Design
    ... in front of a web server, and that proxy server shares a single TCP ... These are attacks that make use of non-RFC HTTP requests (HTTP Request ... the authentication is associated with the ...
    (Securiteam)
  • [NT] 04WebServer Multiple Vulnerabilities (CSS, Log File Injection, AUX DoS)
    ... 04WebServer is a HTTP server developed by Soft3304 for Windows platforms. ... Characters into Log File ... filtering on the request URL before writing it into the log file. ... following HTTP request, when submitted to a vulnerable 04WebServer, will ...
    (Securiteam)
  • Re: breaking the model
    ... > The forms data then is in the Request object. ... HTTP Request; in this case, the form POST Request from the Page. ... client and server. ...
    (microsoft.public.dotnet.framework.aspnet)
  • Re: Anonymous Anonymity - Request For Comments
    ... > and request that you reply directly to my e-mail address. ... > for the entity wishing to preserve their anonymity. ... > the machine can perform as a Intermediary Server and / or as a Intermediary ... > The software then attempts connection to a Intermediary Server. ...
    (Bugtraq)
  • Multiple Vulnerabilities in Sun-One Application Server
    ... Multiple Vulnerabilities in Sun-One Application Server ... on Windows 2000, SPI Labs discovered a number of vulnerabilities. ... the case of the file extension in the HTTP request. ...
    (Bugtraq)