nav[aria-label="Primary Navigation"] { padding: 0; & ul { list-style: none; width: 100%; display: flex; flex-direction: row; justify-content: start; align-items: start; gap: 30px; padding: 0; & li { margin: 0; } & ul li { list-style: none; } } }

Authentication Issue in MediaBin

engtat

Hi,

I have some scripts look something like this:

MediaBinServer service = new MediaBinServer();
Uri u = new Uri("http://www.somedomainanem.com/****.aspx")
CredentialCache cache = new CredentialCache();
cache.Add( u,"NTLM", new NetworkCredential( strUsername, strPassword, strDomain ));
service.Credentials = cache;
service.PreAuthenticate=false;
service.Url = u.ToString();
service.LockAsset(AssetID,false);

Assuming all the AssetID is valid and the user is an administrator, why is this page working perfectly in a local browser where the MediaBin webservices is installed but it failed when I access this page from a remote browser? I checked in the Audit log and it looks like the NetworkCredential was not passed to the MediaBin server correctly.

Anyone can help? Is there any setting that I missed out?

Find more posts tagged with

Comments

lyman

I've passed this on to our client/API team. They should get back to you shortly.

Cheers,

Lyman Hurd
MediaBin Server Team

msnider

What type of error are you getting? Does the Audit log show a login at all? Are you able to call any other methods successfully...e.g. ValidateCurrentUser, GetMediaBinServerName, GetInsertionTaskList?

Mark

engtat

This is the exact error I got:

System.Web.Services.Protocols.SoapException: Server was unable to process request. ---> MBPNetModel.MBObjects.MBException: MBException: The user is not authorized for the action or access to the object (0x8004041C) at MBPNetModel.MediaBinScriptModel.MediaBinServerImpl.LockAsset(String assetID, Boolean bLock, MBConnection mbConnection) at MBPNetModel.WebServices.MediaBinServer.LockAsset(String assetID, Boolean bLock) --- End of inner exception stack trace ---

I have tried and validateuser and getmediabinservername works fine. It returns the correct user id and server name.

I checked in the mediabin audit log, it looks like aonymous user was used to login when the page is accessed using a remote browser. Probably that's why it's not working for a remote browser.

Hope you can help. Thanks!

msnider

The problem is that IIS impersonation with NTLM fails to work if there is more then 1 hop involved between the client, IIS server and the MediaBin server which would explain why the local browser works but the remote does not.

The solution is to use Basic authentication instead of NTLM. Goto the IIS MMC and enable Basic Authentication for the MediaBinWebService. Then change your credential cache to the following:

cache.Add( u,"Basic", new NetworkCredential( strDomain + "\\" + strUsername, strPassword ));

engtat

Thanks a lot and it works!

Now, how can I make it work for default credential? Instead of presetting the credential cache, I tried to do the following:

service.Credentials = CredentialCache.DefaultCredentials;

If my webservice and mediabin is installed in two different servers, how should I configure my IIS?

msnider

Are you creating an ASP.NET app? If so, DefaultCredentials won't work unless you disable the anonymous user and then impersonate the user who is using the web app. Here is a snippet of code to use:

System.Security.Principal.WindowsIdentity windowsIdentity = (System.Security.Principal.WindowsIdentity) page.User.Identity ;
windowsIdentity.Impersonate();
server.Credentials = CredentialCache.DefaultCredentials;