AzMan + ADAM + ASP .NET 2.0 problems

From: PReichert (PReichert_at_discussions.microsoft.com)
Date: 03/11/05 

Date: Fri, 11 Mar 2005 03:57:04 -0800

Hello there. I have a problem that I'm struggling to solve and I want to see
if anyone there can provide me any help.

The scenario is:

I have a web app written in ASP .NET 2.0 which uses AzMan as authorisation
provider. This app calls a class written by me which then loads a store, an
app, a client context and do an access check on that client context.

For development purposes I have used an XML storage for AzMan and it works
fine. On the test server, though, I have installed ADAM and created an AzMan
store there.

I can then load the WebAdmin.axd tool for my web application on the test
server and configure users and roles. As long as I don't have any user
assigned to any role, the web applicaiton will run fine. When I add a user to
a role, the web application breaks with an error message stating that the
system could not find the file. The method that is failing in my application
is the IAzAuthorisationStore.OpenApplication().

I have then written a console app in .NET 1.1 using the same code I use on
my web app, trying to do access checks agains AzMan with the ADAM store and
it works.

After playing with security stuff I have found that if I configure the web
application to run under the context of the ADAM instance administrator, the
applicaiton works and the security checks are done successfully. Any other
user doesn't work.

I have then tried to install an instance of ADAM setting a group created by
me as administrator, but then members of that group are denied access to ADAM
when trying to create the store.

Does anyone have a clue of what's going on? Is that a bug in ADAM?

PS: I have reproduced my dev server in a Virtual PC VM and I was able to
reproduce the problem. Installing the hotfixes I was able to get from the MS
Premier support web site didn't solve the problem.

Cheers, thanks.

Relevant Pages

  • Re: ADAM - SSO and provisioning considerations
    ... single credential store. ... > that app will launch our app, so it can pass the username or SID on the ... ADAM doesn't simplify your architecture from what I can tell in your posts. ... LDAP bind is not an authentication process. ...
    (microsoft.public.windows.server.active_directory)
  • Re: Bug in ADAM/AzMan integration? Roles placed in AzTaskObjectCon
    ... I was thrown by Role Definitions vs Role Assignments. ... get it all to work now: a full AzMan store deployment using an LDIF file. ... >> in an ADAM partition. ...
    (microsoft.public.windows.server.active_directory)
  • Re: Connecting Azman to ADAM
    ... Azman can use ADAM as a policy store, but not as a user store. ... create a policy store in ADAM, specify the URL as ...
    (microsoft.public.windows.server.active_directory)
  • Re: Adam Sync Issue
    ... That could be the same ADAM instance you use for your ... AzMan policy store or potentially a different one. ... Joe Kaplan-MS MVP Directory Services Programming ...
    (microsoft.public.windows.server.active_directory)
  • Re: Bug in ADAM/AzMan integration? Roles placed in AzTaskObjectContain
    ... > in an ADAM partition. ... AzMan MMC and the role was created in the AzRoleObjectContainer ... > an AzMan store in ADAM. ...
    (microsoft.public.windows.server.active_directory)