IIS Server Security, AD user name changed, IIS still sees old user name

microsoft.public.inetserver.iis.security - About IIS Web Server Security Issues


IIS Server Security >> AD user name changed, IIS still sees old user name

by QWFyb24 » Tue, 29 Mar 2005 03:49:01 GMT

We have an ASP.NET application running on Windows Server 2003, using IIS 6.0,
and integrated windows authentication with SQL Server 2000 on the back-end.
We store active directory user names in the SQL Server database for use in
mapping application user accounts to active directory user accounts. We
created a user account for one of our users some time last year (i.e. -
_joeuser), and added them to the database as an active user (i.e. - inserted
"_joeuser" into user's table). This year the user's name was changed in
Active Directory from "_joeuser" to "jimuser". Of course, we also updated
the user name in the application's user table.

The problem is, even though we have changed the name in both Active
Directory and in the user table in the database, when calling
Context.User.Identity from within our ASP.NET application we receive the old
user name when the user connects to the site (i.e. - "_joeuser"). Neither
restarting IIS nor restarting the worker process fixes the problem. A full
server reboot will fix the problem; however, we do not want to reboot one of
the servers everytime we change a username in Active Directory. Is there a
way to force these changes down to the server(s) on-demand when making this
kind of user name change in the Active Directory?

Additionally, we also wrote a small tool to query the AD from the
command-line on the web server, and it is able to find the SID for the new
user name (i.e. - "jimuser") as expected. When the tool is asked to query
the AD for a SID for the old user name (i.e. - "_joeuser"), it cannot find
the name as expected.

Any ideas or thoughts would be greatly appreciated! We have a developer who
is "on-the-edge" as a result of this issue, and we are trying to solve his
problem.

Thank you,

Aaron

Top

IIS Server Security >> AD user name changed, IIS still sees old user name

by David Wang [Msft] » Tue, 29 Mar 2005 06:33:00 GMT


Did you change the user's name, user's SID, or both?

IIS definitely caches user tokens for performance reasons (can't be hitting
the DC on every single request...), and since the DC doesn't tell IIS when
such AD data changes, you'll have to do it yourself. Restarting IIS (either
recycling the ApplicationPool or W3SVC service) should be sufficient to
clear out the user tokens. I also believe IIS refreshes such user tokens
after 15 minutes or so, so unless you are in a hurry, things should just
magically work.

Now, ASP.Net/.Net Framework may do its own caching, and since
Context.User.Identity is within ASP.Net, you will need to make sure their
caches are cleared as well.

--
//David
IIS
http://blogs.msdn.com/David.Wang
This posting is provided "AS IS" with no warranties, and confers no rights.
//


We have an ASP.NET application running on Windows Server 2003, using IIS
6.0,
and integrated windows authentication with SQL Server 2000 on the back-end.
We store active directory user names in the SQL Server database for use in
mapping application user accounts to active directory user accounts. We
created a user account for one of our users some time last year (i.e. -
_joeuser), and added them to the database as an active user (i.e. - inserted
"_joeuser" into user's table). This year the user's name was changed in
Active Directory from "_joeuser" to "jimuser". Of course, we also updated
the user name in the application's user table.

The problem is, even though we have changed the name in both Active
Directory and in the user table in the database, when calling
Context.User.Identity from within our ASP.NET application we receive the old
user name when the user connects to the site (i.e. - "_joeuser"). Neither
restarting IIS nor restarting the worker process fixes the problem. A full
server reboot will fix the problem; however, we do not want to reboot one of
the servers everytime we change a username in Active Directory. Is there a
way to force these changes down to the server(s) on-demand when making this
kind of user name change in the Active Directory?

Additionally, we also wrote a small tool to query the AD from the
command-line on the web server, and it is able to find the SID for the new
user name (i.e. - "jimuser") as expected. When the tool is asked to query
the AD for a SID for the old user name (i.e. - "_joeuser"), it cannot find
the name as expected.

Any ideas or thoughts would be greatly appreciated! We have a developer who
is "on-the-edge" as a result of this issue, and we are trying to solve his
problem.

Thank you,

Aaron




Top

IIS Server Security >> AD user name changed, IIS still sees old user name

by QWFyb24 » Tue, 29 Mar 2005 10:07:03 GMT

David,

We did not change the user's SID, only the user's logon username. The
change was made a couple weeks ago in fact, so it should not still be cached
by IIS. This is what puzzles us the most, and why we are asking the question
here. If ASP.NET was caching credentials in session or application memory
space, this should be cleared when an IIS reset is performed and the worker
process is recycled. This is why we are wondering what we are doing wrong.
Please advise.

Thanks,

Aaron






Top

AD user name changed, IIS still sees old user name

by QWFyb24 » Wed, 30 Mar 2005 22:33:06 GMT

Any other ideas? We really need to resolve this issue. We cannot go around
rebooting all the servers in our environment everytime we have to change a
user's logon username. Please help.

Thanks,

Aaron





Top

RE: AD user name changed, IIS still sees old user name

by S2Vu » Wed, 06 Apr 2005 12:05:02 GMT

Aaron:

Did you ever find a resolution for this? I am experiencing the exact same
problem, down to the app versions. The issue manifests itself when
atttempting to retrieve group memberships for the user with the changed
logon. At first we thought it might be an issue with the global catalog being
updated but booting the IIS server resolves it so that doesn't really point
to the GC. It certainly seems as though the old credentials are being cached
somewhere. I tried a registry setting for default IIS User token time to live
but it had no effect. I haven't found anything to this point on ASP caching.

Thanks,

Ken




Top
Similar Threads

1. system.web.httpcontext.current.user.identity.name shows old usenam - ASP

2. How To change IWAM user to a AD domain user 

I have two IIS Servers running our ASP/COM applications in the same AD domain.

Now the anonymous user of IIS was set to a domain user such as : "IUSER_myDomain",
and IWAM user is the local machine's user account(i.e. IWAM_machineName). 

How can I change the IWAM user from a local machine's account to 
a domain user's account?

Thanks.

3. Rename IIS server - IUSR and IWAM user names do not change

4. Changing the name of the website without changing the name of the server

5. I need to write an ASP that requires a user to give a User Name an - Asp.Net

6. Security Threat MSN User Name and Password Changes 

I have been trying for hours to get a hold of a person at 
MSN CHAT or Microsoft I have a serious problem, Someone 
has got into my MSN and changed my User and 
password ...they have posted a new users name that is very 
offinsive.  I can not change it nor get a hold of anyone 
to get this off.  No one has my password...this software 
is full of security holes...

Microsoft MSN has the weekest security and support I have 
ever seen.

Joe B

7. Changing the IWAM User name - IIS Server Security

8. Disallow other isolated users from seeing an isolated user's virtual directory 

I have been experimenting with setup of isolated users on IIS6 with
Windows Server 2003 SP2, and I ran into an issue I don't understand.

I have these 3 local users on the computer: Larry, Curly and Moe.

Within C:\Inetpub\ftproot\LocalUser I have directories called Larry,
Curly and Moe. Inside only Moe's directory is a subdirectory called
Data. The FTP site has a virtual directory called Data which is mapped
to C:\Inetpub\ftproot\LocalUser\Moe\. Larry and Curly do not have any
subdirectories, and certainly none called "Data".

I have set UserIsolationMode to 1.

I expected only Moe to be able to see the Data virtual directory's
contents since it's inside /Moe and other users are supposedly isolated
to their own directories. However I can log on as Larry and ask for
/Data and I can see its contents.

How come Larry and Curly are able to see inside a virtual directory
which is mapped to Moe's (isolated) directory space?

Is there a way to disallow it?

Thanks