Random logon failure with ADAM Bind Proxy

From: Seetha (seethaj_at_yahoo.com)
Date: 06/09/04 

Date: Wed, 9 Jun 2004 17:35:40 -0400

I have an isolated test environment with two servers -AD domain controller and Windows 2003 server with ADAM on it. ADAM is used as a store for user profiles and AD stores just the username/password and is solely used for authentication.

I have been using ADAM bind proxy to authenticate users against AD. I have two questions relate to this setup.

a.ADAM bindproxy authentication was working fine. But suddenly this has been creating random authentication errors with 'There is no object in the server' during bind. The main problem is that authentication does not fail consistently , it fails for few minutes, if I come back and test after an hour it works, and fails after some time. The one thing that changed is that we have been running a job that migrates ~350K users to AD and ADAM.

If I authenticate directly against AD , authentication works consistently. Not sure if adding too many users (all added to Readers role individually) is having an effect on Bind proxy. Any ideas?

Here is a code that I use to authenticate using ADAM bind proxy
---------------------------------------------------------------------------------------------
  public bool adamAuthenticate(string username, string password)
  {
     userDN = "LDAP://" + m_adamServer+ "/" + "CN=" + username + "," + this.m_adamUsersContainerPath;
     userLoginName = "CN=" + username + ", " + this.m_adamUsersContainerPath;
      
     entry = new DirectoryEntry( userDN, userLoginName, password, AuthenticationTypes.None);
     try
     {
      // Bind to the native AdsObject to force authentication.
      Object obj = entry.NativeObject;
     }
     catch(System.Exception ex)
     {}

---------------------------------------------------------------------------------------------

  The following that authenticates against AD works

---------------------------------------------------------------------------------------------

 public bool ADAuthenticate(string username, string password)
{
       userDN = "LDAP://" + this.m_adServer+ "/" + "CN=" + username + "," + this.m_adUsersContainerPath;
       DirectoryEntry user = new DirectoryEntry(userDN, this.m_adAdminUsername, this.m_adAdminPassword);

     try
     {
      // get the logon name from Active Directory
      userLoginName = (String) user.Properties["samAccountName"].Value;

      // use the logon name and the password entered by user against active directory to bind
      DirectoryEntry entryAD = new DirectoryEntry( userDN, userLoginName, password, AuthenticationTypes.Secure|AuthenticationTypes.ServerBind);
      Object obj = entryAD.NativeObject;
     }
     catch(Exception ex)
     { }

   
b. Through adamAuthenticate() , username seems to be case sensitive and the auth fails if I dont pass in the username that does not match the CN exactly with the case. Is there some setting that can be changed to avoid this?

Thanks
Seetha

Relevant Pages

  • ADAM proxy authentication + Old password still working after resetPassword
    ... I have AD and ADAM setup in a Win 2003 server. ... Here is the code for authenticate() and resetPassword. ... public bool ResetPassword(string username, string password) ...
    (microsoft.public.windows.server.active_directory)
  • Re: ADAM Authentication
    ... But I'm not trying to authenticate as HOME\joebob. ... The ADAM ADSI editor ... Lets say my domain username is CAMPUS/aaron. ...
    (microsoft.public.windows.server.active_directory)
  • Re: Authenticate UsernameToken against Active Directory
    ... Actually I am running ADAM and ASP.NET on Win XP Pro, ... When I am authenticating UsernameToken against my Windows account, ... username and password so that WSE can do a match with the all ADAM ... user accounts created and authenticate accordingly. ...
    (microsoft.public.dotnet.framework.webservices.enhancements)
  • Re: Security Logging in ADAM
    ... How does an anonymous login authenticate anyone? ... If a bind was performed against ADAM, there should be a matching audit event ... in the security event log on the ADAM machine assuming that logon events are ...
    (microsoft.public.windows.server.active_directory)
  • Re: ADAM Authentication
    ... The client app in question is the Windows Address Book. ... Joe Kaplan wrote: ... The ADAM ADSI editor ... then ADAM would be able to authenticate users from HOME. ...
    (microsoft.public.windows.server.active_directory)
Loading