Problem using Allow Roles

[Brian Doyle]

Dear All,

I have an application secured using the following in the web.config file...

<authorization>
<deny users = "?" />
<allow roles = "role1, role2, role3 etc. " /> (up to 8 different roles)
<deny users = "*" />
</authorization>

This works fine for new users I create and assign to these roles (AD
security groups) but not for any existing users who I have added the roles
to. The existing users have 20 or more pre-existing roles each whereas the
new users work fine until I get to 8 or 9 roles when they too start to fail
authentication! (Error 401.2 is generated in all cases).

I have looked into the possibility of this being a problem with the size of
the Kerebos token and applied a number of fixes that would correct that,
though these seemed to be targetted at users with 200+ roles. None of these
fixes has worked. W2K is now at SP4 on .NET 1.1.

Has anyone seen this type of behaviour or got any thoughts on how to resolve
this issue.

Many thanks,

Brian Doyle
Wellington, New Zealand

[Tom Vande Stouwe MCSD.net]

I SUSPECT that one of the existing groups has a DISALLOW property for some
part of the application. That will block you even if you give ALLOW
permission in another group. Add the existing groups one at a time to a user
and watch for the failure. Then look at the security of that group and the
problem should show it's ugly head ;)

Tom
--
==========================================
= Tom Vande Stouwe MCSD.net, MCAD.net, MCP
= 45Wallstreet.com ([url]www.45wallstreet.com[/url])
= (803)-345-5001
==========================================
= If you are not making any mistakes
..= ..you are not trying hard enough.
==========================================
This is the spam catching address: [email]gotcha@conpro.net[/email] do not use this address
or you will be blocked at the server ;)

"Brian Doyle" <brian.doyle@xacta.co.nz> wrote in message
news:uKBQ3KadDHA.3448@TK2MSFTNGP11.phx.gbl...

> Dear All,
>
> I have an application secured using the following in the web.config

file...

>
> <authorization>
> <deny users = "?" />
> <allow roles = "role1, role2, role3 etc. " /> (up to 8 different roles)
> <deny users = "*" />
> </authorization>
>
> This works fine for new users I create and assign to these roles (AD
> security groups) but not for any existing users who I have added the roles
> to. The existing users have 20 or more pre-existing roles each whereas the
> new users work fine until I get to 8 or 9 roles when they too start to

fail

> authentication! (Error 401.2 is generated in all cases).
>
> I have looked into the possibility of this being a problem with the size

of

> the Kerebos token and applied a number of fixes that would correct that,
> though these seemed to be targetted at users with 200+ roles. None of

these

> fixes has worked. W2K is now at SP4 on .NET 1.1.
>
> Has anyone seen this type of behaviour or got any thoughts on how to

resolve

> this issue.
>
> Many thanks,
>
> Brian Doyle
> Wellington, New Zealand
>
>

[Brian Doyle]

An interesting resolution to the issues described below.

The application in was actually .NET 1.0 and not 1.1 as I mistakenly put in
my original post.

To correct the problem I had to install .NET 1.1 on the same server.
Apparantley the two versions are not as independent as the documentation
would lead you to believe! The root cause has yet to be identified but that
task is now relegated to the "to be done sometime" pile.

Thanks

Brian Doyle


"Brian Doyle" <brian.doyle@xacta.co.nz> wrote in message
news:uKBQ3KadDHA.3448@TK2MSFTNGP11.phx.gbl...

> Dear All,
>
> I have an application secured using the following in the web.config

file...

>
> <authorization>
> <deny users = "?" />
> <allow roles = "role1, role2, role3 etc. " /> (up to 8 different roles)
> <deny users = "*" />
> </authorization>
>
> This works fine for new users I create and assign to these roles (AD
> security groups) but not for any existing users who I have added the roles
> to. The existing users have 20 or more pre-existing roles each whereas the
> new users work fine until I get to 8 or 9 roles when they too start to

fail

> authentication! (Error 401.2 is generated in all cases).
>
> I have looked into the possibility of this being a problem with the size

of

> the Kerebos token and applied a number of fixes that would correct that,
> though these seemed to be targetted at users with 200+ roles. None of

these

> fixes has worked. W2K is now at SP4 on .NET 1.1.
>
> Has anyone seen this type of behaviour or got any thoughts on how to

resolve

> this issue.
>
> Many thanks,
>
> Brian Doyle
> Wellington, New Zealand
>
>