EWS create forlder on behalf

Guy_Pomerleau

We need to write a web application that will create a folder on behalf of a users who does not have the "create folder privileges"

The user will access a web app that will run under an application pool that have a windows domain account as an identidy that also have a livelinkaccount (we are running directory services module) The web app will call the EWS to create folder. We were able to make it happen with https and a normal livelink account but we want to make it work with windows authentication.

Here our setup:

 

Client: running vista, visual studio and IIS,.net 4.0 Application pool running with domain account that has a  windows livelink account

 

Server: windows server 2003, IIs6, Application pool .net 2.0, running livelink and EWS. We have one site that is running livelink with windows authenticated and another site that is https and we use it for administration.

 

 

 We get an error such as: Invalid username/password specifed. attache you will find the client web.config and the EWS web.config

Here the code on the client and the error we get:

 

 

              //---------------------------------------------------------------------------------------------------------------------------

              private static LLDocument.OTAuthentication Login()

              {

                     LLDocument.OTAuthentication tp = null;

                     try

                     {

                           tp = new LLDocument.OTAuthentication();

                           LLAuthentication.AuthenticationClient LLAuth = new LLAuthentication.AuthenticationClient();

                           //LLAuth.ChannelFactory.Credentials.Windows.AllowedImpersonationLevel = System.Security.Principal.TokenImpersonationLevel.None;

                          

                           //LLAuth.ChannelFactory.Credentials.Windows.ClientCredential.UserName = Username;

                           //LLAuth.ChannelFactory.Credentials.Windows.ClientCredential.Password = Password;

                           //LLAuth.ClientCredentials.Windows.AllowNtlm = true;

                           //LLAuth.ClientCredentials.Windows.AllowedImpersonationLevel = System.Security.Principal.TokenImpersonationLevel.Impersonation;

 

                           //string LLToken = LLAuth.AuthenticateUser("usernamexyz", "xxxxxxxx");

                           //string LLToken = LLAuth.AuthenticateUser(Username, Password);

                           //tp.AuthenticationToken = LLToken;

 

                           tp.AuthenticationToken = string.Empty;

                     }

                     catch(System.Exception ex)

                     {

                           tp = null;

                           throw ex;

                     }

 

                     return tp;

              }

 

 

              public static List<LiveLinkDocument> GetDocuments(Int32 folderId)

              {

                     List<LiveLinkDocument> documentToReturn = new List<LiveLinkDocument>();

                     //LLDocument.OTAuthentication Auth = Login();

                     LLDocument.DocumentManagementClient LLDoc = new LLDocument.DocumentManagementClient();

                     //LLDoc.ClientCredentials.Windows.AllowNtlm = true;

                     //LLDoc.ClientCredentials.Windows.AllowedImpersonationLevel = System.Security.Principal.TokenImpersonationLevel.Impersonation;

                     //LLDocument.Node[] nodes = LLDoc.ListNodes(Auth, folderId, true);

                     LLDocument.Node[] nodes = LLDoc.ListNodes(null, folderId, true);

                     foreach (LLDocument.Node node in nodes)

                     {

                           if(!node.IsContainer)

                                  documentToReturn.Add(new LiveLinkDocument{ Id = node.ID, Name = node.Name, Description = node.Comment });

                     }

                     return documentToReturn;

              }

server-web.config

Web.config

Kyle_Swidrovich

Bonjour Guy,

I think the best approach to understanding what's happening here is to examine the Content Server logs.

In the opentext.ini of the Content Server instance, set [general] Debug=2 and [options] wantLAPILogs=TRUE and attempt the authentication again.

The resultant thread#.log in the /logs directory should show the input arguments if the request is reaching Content Server.  This should show us the user it is attempting to authenticate as in your system.

Regards,

Kyle