Asynchronous multithreads and Kerberos

We had an issue with MOSS 2007 and Kerberos during the implementation of a new application some weeks ago. Our application load several web parts on a MOSS2007 web-part page and each one of these web parts call to a different web service requesting data from an enterprise data storage. The page is a dashboard that display sales information to our executive team.

At the beginning we loaded the web parts in a synchronous way but after see the time taken by the page to load all the web parts (some web services returned a big number of rows) we decided to use asynchronous multithreads using ASP.NET.

But an strange error appeared then, two of the web parts were not loaded correctly the first time a user call to the page. They reported an error, when he refreshes the page one of them was loaded correctly and the other one not, and then if we refreshed the page again both of them were loaded correctly. The error didn’t appear again until any user call the page for 5 minutes, then the error appeared again for the first user to load it.

Event Viewer logs shown a Kerberos impersonation problem, when the error appeared the credential received by the destination server was Network Services one, instead of the User ID, so the impersonation was not working correctly.

After work with Microsoft for several days on the issue and didn’t find any logical explanation, we started to think the problem could be generated by the asynchronous call (I don’t know how to explain why… we were desperate I suppose so…).

Finally, the solution is to change some settings on ASPNet.config file (located in the Microsoft.Net folder) to the following values:

legacyImpresonationPolicy enabled

alwaysFlowImpresonationPolicy enabled

On the following links you can find the description of both entries but as a summary this is the values that they can have and the meaning of each one:

<legacyImpersonationPolicy enabled="true|false"/>   http://msdn.microsoft.com/en-us/library/ms229296.aspx

Value	Description
false	WindowsIdentity flows across asynchronous points depending upon the ExecutionContext flow settings for the current thread.
true	WindowsIdentity does not flow across asynchronous points, regardless of the ExecutionContext flow settings on the current thread.

<alwaysFlowImpersonationPolicy enabled="true|false"/>   http://msdn.microsoft.com/en-us/library/ms229553.aspx

Value	Description
false	The Windows identity does not flow across asynchronous points, unless the impersonation is performed through managed methods such as Impersonate.
true	The Windows identity always flows across asynchronous points, regardless of how impersonation was performed.

So to impersonate on a multithreading asynchronous scenario we have to apply the following values to these two entries:

<legacyImpresonationPolicy enabled=”false”/>

<alwaysFlowImpresonationPolicy enabled=”true”/>

Continue Reading...

Kerberos Delegation and ADSI Edit tool

We can check and configure the Kerberos Delegation for an account using ADSI Edit tool  although this way is more difficult than dsa.msc tool that we viewed on our last post.

To open ADSI Edit tool, select Start, Run, type adsiedit.msc and click OK. Now search an account using the Query option and then right click on it and select Properties. As you can see the Properties of ADSI Edit tool are very different from other ones as DSA tool. You can see a tab name Attribute Editor where a list of attributes with different values is showed.

On ADSI Edit console the way to view the user account properties is reading the value assigned to userAccountControl property. The value assigned to this property depends on the “flags” assigned to this account. Each flag has a value and userAccountControl shows the sum total of all of these values.

The typical flags and their values are representing on the following table:

You can find a description of each flag on the following links:

http://msdn.microsoft.com/en-us/library/ms680832(VS.85).aspx

http://support.microsoft.com/kb/305144/en-us

An application ID account on Accenture has the following flags enabled by default:

• NORMAL_ACCOUNT
• PASSWD_NOTREQD
• ENCRYPTED_TEXT_PWD_ALLOWED
• DONT_EXPIRE_PASSWORD

So the value of its userAccountControl property is:

512 + 32 + 128 + 65536 = 66208

When you enable the Trusted to Authenticate for Delegation option on an application ID account you are enabling the TRUSTED_TO_AUTH_FOR_DELEGATION flag, so the value of userAccountControl would be:

66208 + 16777216 = 16843424

Continue Reading...

How to check the current Kerberos Delegation configuration of an account

In this case you can use two mmc consoles, the first one is Active Directory Users and Computers console (dsa.msc) and the other one is the ADSI Edit console. In this post, we will use the first one and in a next post we will view how to use the ADSI Edit console.

From any server joined to the same environment than the account that you want to check, select Start –> Run, type dsa.msc and click OK. Right click on domain tree and select Find…

On Find combo-box select “Users, Contacts, and Groups” if you are searching a user account or “Computer” if you are searching a computer account. Type the name of the account on the Name field and click on Find Now button. The results will appear on the Search Results section.

Right click on the result and select Properties, and then select Delegation tab. In this tab you can see all information related to the Kerberos Delegation configuration for this account.

Continue Reading...