Developer forum

Forum » Development » AD integration - Prompted for login when uploading

AD integration - Prompted for login when uploading


Reply
Hi guys,

We've setup an intranet in Dynamicweb, and we've enabled AD integration to use the AD groups to limit access to certain pages.

We disabled "Anonymous Authentication" and enabled "Windows authentication".

Everything in the frontend works fine.

Our problem is that when the intranet administrators want to upload files in the backend, they are prompted to login again.

When Windows authentication is enabled, which directory permissions do i need to set? NETWORK SERVICES isn't enough anymore.

Regards
 Martin


Replies

 
Nicolai Høeg Pedersen
Reply
Hi Martin

It is a browser setting and/or a AD policy.

Have a look in the "(en-US) Installation Guide, Dynamicweb 7 on IIS 5-6.pdf" installation guide placed here: http://engage.dynamicweb-cms.com/Installation-201.aspx - you have to take a look in appendix B.
 
Reply
Hi Nicolai,

A group policy is set, so the intranet adresss is added to the Intranet zone, and IE is setup to login with windows credentials. Windows authentication is also in effect.

Still there's a problem with uploading files.

We know windows authentication work, because users aren't prompted to login, and Dynamicweb AD page permissions are in effect.

But uploading to the files archieve prompts the users to login, and it's probably due to file system permission.

We're added "Domain Users" the permission page and gave modify rights. But uploading still fails.

Any thoughts in what's wrong?

Regards
 Martin
 
Nicolai Høeg Pedersen
Reply
The website still runs under w3wp.exe which has a user - that user also needs permissions to write to that folder.

Also in the installation guide there are an appendix with permissions setup. Be aware, that the root for some reason needs list rights for things to work - on Windows 2003 for sure, maybe also on Windows 2008.

Also note, that 2008 and 2008 R2 have very different security setup.

BR Nicolai
 
Reply
Hi Nicolai,

We're still having problems with the permission settings for the Files folder.

Currently our Files folder has these permissions:

IUSR: Read, List
System: Full control
Network services: Modify
DOMAIN\Domain Users: Modify

But when users try to upload, they are still prompted for login.
Weird thing is, it's not all users.

I've checked inheritance and all subfolders have the same rights.

Do you have any ideas?

Regards
 Martin
 
Nicolai Høeg Pedersen
Reply
Well - I'm not a system administrator, but I'll give it a try. If they are prompted for login it is because they do not have enough permissions... Question is what is missing.

I take it that "Network services" is the user under which w3wp.exe runs.

Try replacing the permissions on all sub folders first.

Then give more permissions to Domain Users - full access to see if that helps. Then full access to network services and see if that helps.

If not, try giving "Authenticated users" access. If that helps, it could be that not all users are member of domain users.
 
Reply
Hi,

We've been trying a lot of things, at we finally found how to fix the problem. but only temporary.

Clearing the cache and removing all cookies fixes the problem, and allows the user to upload again. But after restaring the browser, the problem returns. Clearing the cache fixes the problem again, but only for the current session.

Our permissions on the server weren't wrong, but caching or cookies messes things up again.

Has anyone experiences anything similar?
We're getting reports that other people inside our customers organization have the same problems as described above.

Regards
 Martin

 
Reply
Hi Nicolai,

I'm still trying to figure out this bug, and to test a theory, i've made a small html page out side of Dynamicweb that uploads a file to the file archieve.
This page is capable of uploading a file.

Does your upload module do anything special?

// Martin

 
Nicolai Høeg Pedersen
Reply
No - our upload module does nothing out of the ordinary.

It is like this:

fifiles = System.Web.HttpContext.Current.Request.Files
Do While iFile < fifiles.Count
    fiPostedFile.SaveAs(myPath & "\" & FileName)
Loop

Pretty simple. Use fidler on the client side to ses response/request header information and a windows file security monitoring tool to see what is happening on the server.

It can very well be a firewall or something that does not allow for this. But fiddler should provide information on what is denying access...
 
Reply
Only problem with Fiddler is that as soon as it's running, i can't recreate the error :-(

Fiddler does something to the response/request making upload work.

I've changed my upload sample page to do what you do, and uploading with this tiny app works.

if (IsPostBack)
{
    Response.Write("Test");
    HttpFileCollection fifiles = System.Web.HttpContext.Current.Request.Files;
    for (int i = 0; i < fifiles.Count; i++)
    {
        HttpPostedFile file = fifiles[i];
        file.SaveAs(AppDomain.CurrentDomain.BaseDirectory + "" + file.FileName);
    }
}

Do you know a file system monitoring tool that works?

//Martin
 
Nicolai Høeg Pedersen
Reply
If it works with fiddler on - it is not a file system issue.

Then it is something else. You only have the problem with XP with a IE7 or how was it? I think it is some policy in the domain or something in the firewall...

Take a look at the websites log files - what does they say to the request not working?

 

You must be logged in to post in the forum