Logon failure error when attempting UserPrincipal.FindByIdentity

Question

I've been searching for solutions on this for a while now, but each thread a dead-end unfortunately. I'm working on a C#/ASP.net web app that will only be used internally by our company. Anonymous access has been switched off both in IIS and my web.config file forcing IIS to use the windows authenticated user (Active Dir user). My problem is that the following code works perfectly to get the required (or any) AD user: ``` using System.DirectoryServices.AccountManagement; ... other code ... PrincipalContext ctx = new PrincipalContext(ContextType.Domain, "mydomain", "someADuser", "someADuserpassword"); UserPrincipal winuser = UserPrincipal.FindByIdentity(ctx, IdentityType.SamAccountName, "samaccountname"); ``` "someADuser" used in the PrincipalContext above is the current logged in user through windows, thus authenticated and a valid AD user. Using the following code (with the exact same user still logged in) gives me a "Logon failure: unknown user name or bad password" error: ``` Princ…

Accepted Answer

It seems UserPrincipal.FindByIdentity doesn't use the logged in user's validated credentials for some reason if it's not specified in the PrincipalContext object - something I don't want to do.

UserPrincipal.FindByIdentity doesn't care about the user's credentials at all. You're just performing a look up to see if the account exists. The reason you're getting an error is because the default user credentials (i.e. the identity that your web application is running as) doesn't have access to the directory, so it can't perform the look up. When you pass in the client's credentials to the PrincipalContext then the problem goes away because your client has a valid AD account with access to the directory.

You should investigate which identity is being used to run the application pool and make sure it has access to the directory.

Logon failure error when attempting UserPrincipal.FindByIdentity

Solution

Problem