icelava.net

Authorization Manager (AzMan) is an incredibly helpful feature of Windows 2003 for any development team who seeks to deliver a solid and fluid security framework in their applications. I have experienced its benefits in a past project, allowing dynamic designation of roles and authorized tasks to manage an entire enterprise of users' rights to the system. However, that was not on a web front.

In some upcoming projects, we stand a chance of re-staging AzMan as the bouncer for the ASP.NET web applications we are to develop. The catch, though, is we may not get permission to stash the AzMan policy store directly in the corporate domain. The obvious alternative is to get ASP.NET to refer to an AzMan store located in an ADAM partition. That tutorial was pretty straightforward to execute, when I was using Visual Studio's file-based web site to it; with the built-in WebDev server running as my administrator account. When I took the next step of setting up the site to operate off IIS (5.1), it would bail when I tried to use the Roles class.

System.IO.FileNotFoundException: The system cannot find the file specified. (Exception from HRESULT: 0x80070002)

Despite me assigning the ASPNET account as an Administrator of the AzMan store, I could not overcome this error. I sought high and low for that divine revelation that would explain why ADAM had fallen from grace in this situation, and it was many days later did I obtain a subtle hint as to just was serving as the road block.

1. Open up ADAM ADSI Edit. (All Programs > ADAM > ADAM ADSI Edit)
2. Connect to... the ADAM partition that contains the AzMan store. In my case, a DN of CN=Authorization,DC=group,DC=testdomain,DC=org.
3. Once connected, it should expose a node CN=Roles. Click on it.
4. The right pane should list three roles, CN=Administrators, CN=Readers, CN=Users. Right-click CN=Readers and select Properties in the context menu.
5. The Properties dialog box will expose an Attributes grid. Locate the members property in it and double click the entry.
6. Multi-valued Distinguished Name With Security Principal Editor dialog appears. Click Add Windows Account... and add in the ASPNET account.

ASPNET, as the ASP.NET worker process, should now be able to read through the ADAM partition to access the AzMan store within.

Hi,

Thanks for the tip, you saved me some days of searching for a solution.

I was testing on Windows 2003 Server with SP2 and had the same problem. The solution was to give read access in ADAM to NETWORK SERVICE user, just as you said. 

Cheers,

Stefan Hornea
 

Hello!

 I hope someone is still following this thread somewhere!  I've run into the same exact issue.  When I log into my local machine as a domain admin and run the application that uses AzMan, everything is great.  When I log into my machine as a Domain User, then I get the following 

System.IO.FileNotFoundException: The system cannot find the file specified. (Exception from HRESULT: 0x80070002)
   at Microsoft.Interop.Security.AzRoles.AzAuthorizationStoreClass.Initialize(Int32 lFlags, String bstrPolicyURL, Object varReserved)

Policy Url is as follows:

msldap://MYAZMANSERVER:389/CN=EnterpriseADAMStore,OU=SecNetPartition,O=SecNet,C=US

I added Domain Admins as a "member" in the Readers role, but still nothing.

Any ideas what this could be?

Thanks a bunch in advance

Sergio

Sergio,

If I read your steps correctly, you still need to give Domain Users membership to the Readers role as well, else they won't have permission to access it.