Another SSO Issue

[Sale_El]

Hey All,

 

Trying to implement the SSO from this video. all i am getting now is this on all users;

 

401 - Unauthorized: Access is denied due to invalid credentials.

 

You do not have permission to view this directory or page using the credentials that you supplied.

 

 

In the video it said about editing the kerberos.aspx but didnt really say what we need to do with it? Not sure if thats important? Also the code in the applicationhost.config was different from mine which i am not sure if it is related... but when i only changed the files that were stated in the video i recieved a 500 error. when i copied them just as the video has it written i now get this error. bellow are the codes in their before and after state.

 

this gave 500 error

 

This gives current error

 

I have seen a few threads about SSO and the reverse DNS appears to be thrown around a lot but i am not 100% sure what needs to be done there, i have added the hap servers ip into the reserse lookup zone and added an A record in the forward lookup, not sure if more needs to be done here?

 

Finally, i am unable to find any decent documentation on where this code is meant to actually go;

 

 

it has been mentioned it goes before the but i have tried before after and in the one of them breaks the site and the others do no change. I really want to get this working as it has potential to be awesome but i am really struggling. Any help greatly appreciated.

 

HAP version 10.5

IIS 8.5

Windows 2012R2

 

Sal

Edited May 15, 2015 by Sale_El

[Sale_El]

I have reverted back to how it was before i even started doing this and now i've noticed that the SSO works with IE, it signs in with my HAP user from AD, is this usual behaviour? Or am i meant to be able to see my username? Also when this user logs in i receive a error about Padding, possibly related?

 

Page: mscorlib

Padding is invalid and cannot be removed.




System.Security.Cryptography.CryptographicException: Padding is invalid and cannot be removed.
  at System.Security.Cryptography.RijndaelManagedTransform.DecryptData(Byte[] inputBuffer, Int32 inputOffset, Int32 inputCount, Byte[]& outputBuffer, Int32 outputOffset, PaddingMode paddingMode, Boolean fLast)
  at System.Security.Cryptography.RijndaelManagedTransform.TransformFinalBlock(Byte[] inputBuffer, Int32 inputOffset, Int32 inputCount)
  at System.Security.Cryptography.CryptoStream.FlushFinalBlock()
  at System.Security.Cryptography.CryptoStream.Dispose(Boolean disposing)
  at System.IO.Stream.Close()
  at System.IO.StreamReader.Dispose(Boolean disposing)
  at System.IO.TextReader.Dispose()
  at HAP.AD.TokenGenerator.ConvertToPlain(String token)
  at HAP.MyFiles.API.Drives()
  at SyncInvokeDrives(Object , Object[] , Object[] )
  at System.ServiceModel.Dispatcher.SyncMethodInvoker.Invoke(Object instance, Object[] inputs, Object[]& outputs)
  at System.ServiceModel.Dispatcher.DispatchOperationRuntime.InvokeBegin(MessageRpc& rpc)
  at System.ServiceModel.Dispatcher.ImmutableDispatchRuntime.ProcessMessage5(MessageRpc& rpc)
  at System.ServiceModel.Dispatcher.ImmutableDispatchRuntime.ProcessMessage31(MessageRpc& rpc)
  at System.ServiceModel.Dispatcher.MessageRpc.Process(Boolean isOperationContextSet)




  at System.Security.Cryptography.RijndaelManagedTransform.DecryptData(Byte[] inputBuffer, Int32 inputOffset, Int32 inputCount, Byte[]& outputBuffer, Int32 outputOffset, PaddingMode paddingMode, Boolean fLast)
  at System.Security.Cryptography.RijndaelManagedTransform.TransformFinalBlock(Byte[] inputBuffer, Int32 inputOffset, Int32 inputCount)
  at System.Security.Cryptography.CryptoStream.FlushFinalBlock()
  at System.Security.Cryptography.CryptoStream.Dispose(Boolean disposing)
  at System.IO.Stream.Close()
  at System.IO.StreamReader.Dispose(Boolean disposing)
  at System.IO.TextReader.Dispose()
  at HAP.AD.TokenGenerator.ConvertToPlain(String token)
  at HAP.MyFiles.API.Drives()
  at SyncInvokeDrives(Object , Object[] , Object[] )
  at System.ServiceModel.Dispatcher.SyncMethodInvoker.Invoke(Object instance, Object[] inputs, Object[]& outputs)
  at System.ServiceModel.Dispatcher.DispatchOperationRuntime.InvokeBegin(MessageRpc& rpc)
  at System.ServiceModel.Dispatcher.ImmutableDispatchRuntime.ProcessMessage5(MessageRpc& rpc)
  at System.ServiceModel.Dispatcher.ImmutableDispatchRuntime.ProcessMessage31(MessageRpc& rpc)
  at System.ServiceModel.Dispatcher.MessageRpc.Process(Boolean isOperationContextSet)

 

and another error that keeps popping up which i wonder if anyone has seen before?

 

An error occurred in Home Access Plus+

Page: HAP.Web.API.MyPic


Creating Directory Search and Searching for then current user
Using filter: (&(objectClass=user) (sAMAccountName=HAP))
Found 1 results, processing 1st result
Found 0 thumnbnailPhotos

 

Anyone know what SSO doesnt work in chrome?

[Sale_El]

I could really use some help with this, ive like got everything ready to go it just need to iron out this one issue of single sign on.

 

i figured out that the SSO i was experiencing was anonymous authentication of some kind and not sso at all which is no good for booking system etc. I just cant figure out for love nore money what is happening. I have put the changes in again as per the video and now i am back to stage one of getting the unauthorised 401 error, i don't understand why the credentials are not being sent through?

 

When i access it from an external connection i get the same issue, same error etc so its not even like its trying to login...

 

I havn't changed anything in the Kerberos.aspx am i meant to? If so, what am i meant to put in there.

 

I am still confused about where i am meant to put in the IP addresses of my network.

 

There must be an SSO God out there somewhere that can help me with this... Please

 

Sal