I have two Active Directory forests on separate domains. Call them Domain1 and Domain2.
I want to be able to run this application from a computer in Domain1 and it will create an account in Domain2. I know this can be done in PowerShell by using new-pssession. Any help is appreciated.
-M
Excellent tutorial on all things .net -> AD.
http://www.codeproject.com/Articles/19689/Working-with-Active-Directory-in-VB-NET
You'll need to make sure that you have access to LDAP/ADSI from where ever you run the application though. Being on another domain isn't the issue, not being inside the current network where the AD server resides is, usually these things aren't internet facing due to it being a massive security concern.
Related
I have a php application on openshift. This main application is actually made of 2 different parts: Students & Employees. As I want to keep the code clear and separate for each (even though they share some common data), I need to create Virtual Host in Openshift.
After the user logs in, depending on what his setting was - I want to direct him to either the student or the employee management section. For example say my main application is https://manage.example.com, when the user logs in I want to be able to direct him to a virtual directory(host?) such as
https://manage.example.com/student OR
https://manage.example.com/employee
I am a little new to web related development but I 'assume' that Virtual host may be the right thing? If yes then any clues or leads on how to set up Virtual hosts on Openshift as I understand I have limited access to server configuration files on Openshift.
You will not be able to create more virtual hosts on OpenShift Online for one application, however, there are a couple of other routes that you can go.
You could create two separate applications (each having their own gears) and run each part of your code on a different application. If you need to share a database between them, make sure that you create one of them as scaled (the one you add the database to). Note that these two applications will not share a filesystem.
You could setup each application to run in it's own "subdirectory", something like you had proposed above, you should be able to easily setup the different routes in your application, this would also allow the applications to share a filesystem.
Obviously I am very new, so please bear with me.
I installed Kohana Framework in my localhost. To do is so we have to set two specific folders with write permissions to all. "chmod 666" is suggested. (here)
The remaining directories are set to 755.
My question is more directed to Apache.
Will the use of "chmod 666" create a vulnerability in a webserver?
What exacly means "write access for everyone"?
Many thanks in advance!
666 is almost always a really bad idea. The web site where you read that needs a good flogging.
"Write access for everyone" means that anyone with a user account on your system can write to that directory.
These rights are only for your current server, so if you are the only one with access to a user account on your machine you should be pretty safe. Write access for everyone means everyone with a user account on your machine has the right to write. Please note that 3rd party software (like apache) can have it's own user as well and this could be compromised if there's a exploit in that software. This way someone from the outside could gain access to that folder. It's a common practice to only give rights to users that really need access.
Note: On a normal Windows machine (don't know if this is still true with Windows 7 though) everyone has access to everyone's files. So this is just another security measure.
Hi Guys any help would be much appreciated.
We have an application that’s installed at several locations but we are having an issue at one particular site. In short the application settings (My.) are not being saved after a reboot. The application is build in VB.Net v3.5 Framework and we are not experiencing any issues elsewhere.
This particular site is using roaming profiles and the network administrator ensures us that the correct permissions are applied to the user account(s) and all application data is being saved to the server. I’ve asked the network admin to check for the existence of the user settings file user.config in the Application Data directory and he says it doesn’t exist.
In our application we store the connection string to the database in the application settings under the user scope. If no connection string is present or if one is present and a connection to the database cannot be made then a form is shown asking the user for the database credentials. Each morning when the users boot the machine and opens the application for the first time they are asked for these credentials but if they close the application and restart it they are not asked for them. This indicates to us that the settings are being saved but once the pc is rebooted and the application is opened for the first time they are asked for the database credentials. This seems like the settings are not persisting after a reboot.
Any thoughts/feedback would be much appreciated.
I'm wondering if it's Code Access Security preventing the file from being written?
If the sysadmin at trouble site has implemented group policy folder redirection, the user's local/roaming profile could be getting stored on a network fileshare. Code Access Security is fairly picky about letting code read/write to/from network resources.
I'm sorry that I don't have more details than this, and I didn't find any sure-fire hits on google, but searching for "code access security", "fulltrust" and any network/fileshare keywords you can think of may get you farther.
I have an app that uploads documents to the server through the standard
When sent my application to the production server, I found out that they had the server load balanced. My solution to this was to place the upload directory into a network share and then create a virtual directory pointing to the share.
I have set permissions on the share and the file itself, but I keep getting "access denied" whenever I try to upload a document.
Where could I be missing permissions? Is it possible that IUSR needs to have access to the share?
Thanks.
FYI,
The answer to this solution for me was to setup temporary impersonation with a user account that had access to the share, the folder and the virtual directory.
Here's a link to the code that worked for me:
http://support.microsoft.com/kb/306158#4
I hope your site use anonymous access. Otherwise you will have a painful experience.
If it is so ( anonymous acess), then: The IUSR is a local user on the production servers and not a domain user. So it don't have access the the share. You will have to change that to a domain user ( in the site configuration and not on the application pool). And make sure that the application pool run on a network service ( this is the default ) and it should work.
Chances are that whatever your ASP.Net process is running as does not have access to the share.
So chances are you need to set up an IIS6 application pool to run as a domain user and have that domain user have access rights to the file share.
Don't forget to aspnet_regiis -ga {domainuser} so that the domain user can actually run asp.net applications.
When an ASP.NET application is running under IIS6.0 in Windows 2003 Server with impersonation, what user account is relevant for deciding file read/write/execute access privileges? I have two scenarios where I am trying to understand what access to grant/revoke. I thought the most relevant user is probably the identity specified in the Application Pool, but that doesn't seem to be the whole story.
The first issue concerns executing a local batch file via System.Diagnostics.Process.Start()--I can't do so when the AppPool is set to IWAM_WIN2K3WEB user, but it works fine if it is set to the Network Service identity. I of course made sure that the IWAM user has execute rights on the file.
The second involves writing to a file on the local hard drive--I'd like to be able to prevent doing so via the access control list via folder properties, but even when I set up all users in the folder as "read" (no users/groups with "write" at all), our ASP.NET still writes out the file no problem. How can it if it doesn't have write access?
Google search turns up bits and pieces but never the whole story.
what user account is relevant for [..] file read/write/execute access
As a rule: Always the user account the application/page runs under.
The IWAM account is pretty limited. I don't think it has permissions to start an external process. File access rights are irrelevant at this point.
If a user account (Network Service in your case) owns a file (i.e. has created it), it can do anything to this file, even if not explicitly allowed. Check who owns your file.
Process Monitor from Microsoft is a great tool to track down subtleties like this one.
A bit more searching reveals that the IWAM user isn't that well documented and we should stick with NETWORK SERVICE or a manually-supplied identity if we want to specify permissions for that user.