TrustedLogin error

stmoore1

I'm receiving this error when trying to deploy my site to the customer. It works on our servers, but for some reason not on theirs:

System.Runtime.InteropServices.COMException (0x8004012E): [NRTSession ][TrustedLogin ]This operation is currently not available (0x8004012e)
at IManage.IManSession.TrustedLogin2(Int32 AccessToken)


Here is the code that throws the error:
// Create a session with the file server
IManSession oSession = _dms.Sessions.Add(ConfigurationManager.AppSettings["DMSServer"]);

try
{
// Start impersonating
impersonationContext = ((WindowsIdentity)HttpContext.Current.User.Identity).Impersonate();
oSession.TrustedLogin2(System.Security.Principal.WindowsIdentity.GetCurrent().Token.ToInt32());
}
catch
{
throw;
}
finally
{
// Revert impersonation
if (impersonationContext != null)
impersonationContext.Undo();
}


They have trusted login enabled, because they have WorksiteWeb running with trusted login.

I also changed to an interactive login, just to be sure the rest of the iManage SDK is working properly, which it was (no exceptions were thrown). What could cause TrustedLogin2 to work in our environment but not in theirs?

Thanks,
Seth

Migrateduser

Have they got trusted Authentication turned on on the DMS Server settings and in Worksite Web? Trusted Authentication gets turned off each time you upgrade the DMS...

stmoore1

I think so, because TrustedLogin works with WorkSite Web, just not in our application.

Our application is running under a separate service account and app pool if that makes any difference.

stmoore1

So I have narrowed down the issue now. Setting the "Enforce Kerberos Authentication" registry value to 1 is what makes TrustedLogin not work. If I set it to 0 everything works fine. Any ideas on how to get around this? I don't believe changing it to 0 is a viable option.

stmoore1

If it helps at all, we're using the 8.5 SDK, but running Worksite 9.0. Are there any known compatibility issues between the two in regards to kerberos authentication?

stmoore1

Can anyone confirm that TrustedLogin in the 8.5 SDK actually works with Kerberos authentication?

JHDEV

I too could use some help on this issue. I am having issues now with the SDK trying to create a Workspace via a template using WorksiteWeb.

I either get a "401 not authenticated" error in code, or if I try in the web login page I just keep getting a windows credentials form when trying Trusted Login... but it works ok if I enter the same credentials not using the Trusted Login option.

JHDEV

Can anyone confirm that TrustedLogin in the 8.5 SDK actually works with Kerberos authentication?

If this helps...

I am using 8.5 SDK. I have used TrustedLogin and was able to connect to a remote computer but not yet to my local development computer. Issue with my loopback I think?.

I checked my registry and I have "Enforce Kerberos" to 0
WorksiteWeb is Version 8.5

JHDEV

I too could use some help on this issue. I am having issues now with the SDK trying to create a Workspace via a template using WorksiteWeb. I either get a "401 not authenticated" error in code, or if I try in the web login page I just keep getting a windows credentials form when trying Trusted Login... but it works ok if I enter the same credentials not using the Trusted Login option.

I got this to work with W2k8 server, with Trusted Login, via Web API and Desktop Application. The Trusted Login issue was solved my making sure the server settings allow Trusted Login... simple fix once I found out where to look. Plus it seems the user using Trusted Login needs to use a domain account if using WebAPI.

voyager26

Hi,
I'm on the same team as the original poster and we still need assistance. TrustedLogin is enabled on the server. The users have domain accounts. The issue is with the registry key that enforces kerberos authentication. Should the trustedlogin method work with Kerberos? If so, is there anything we may be missing in our configuration.

Migrateduser

Trusted logon will work with Kerberos, however there's more to consider with Kerberos as the Server needs to have a trust relationship with the AD domain. I've posted up some more details on the other thread, and there's some tools from Microsoft for testing kerberos based Authentication.

Hope this helps