Self Service Password Reset

[boomam]

boomam: do you have friendly errors turned on in internet explorer on the client you are using to test?

 

If so please turn them off and post the real error message.

 

Ben

 

Friendly errors?

Its not an error that IE generates, like a generic HTTP one.

Its one that is part of the page that looks identical to the rest of SSPR.

[plexer]

The 500 error is an error from the server and was probably it not being able to connect to the database due to a misconfiguration of the DB location in config.asp.

 

Friendly errors don't display the real reason and can be turned of in your ie settings, tools, internet options, advanced.

 

The new username and groups are for the impersantion so that the website doesn't have to be run as a domain admin for all functions.

 

It uses the impersanation for the reset functionality.

 

Ben

[boomam]

The 500 error is an error from the server and was probably it not being able to connect to the database due to a misconfiguration of the DB location in config.asp.

##EDIT##

Fixed the problem. I replaced the config.asp and the Db with the originals.

 

The 'Error: unable to bind container' error still happens though.

 

Those errors were fixed. Its just the bind container error now.

 

The new username and groups are for the impersantion so that the website doesn't have to be run as a domain admin for all functions.

 

It uses the impersanation for the reset functionality.

 

Ben

I understand the user, as thats needed for access to passwords.

But the security groups: why are the needed?

The guide/video said set make them, so i did, then nothing else. They literally are just two security groups, with no special options, no special gpos, just two blank groups?

[Irazmus]

Error: unable to bind container

The 'Error: unable to bind to container' is caused when SSPR can not connect to Active Directory. This is most likely due to a problem with the FQDN specified in config.asp, the logon credentials in cred.ini, the IIS server's ability to find/contact a DC or insufficient access rights for the impersonation user.

 

is there a way to have this self contained in its own folder

Yes, easily. Simply setup a new website in IIS with a custom folder (I run my dev version from c:\SSPR) and substitute that folder for Inetpub in the instructions and config.asp

 

Whats the point in the two security groups ive had to create?

The two security groups are for controlling who can reset passwords using the admin pages, and whose passwords they can reset. They have no bearing on the register, update or reset pages.

 

These groups are specified in resetGroup and usersGroup in config.asp, and are defaulted to SSPR_PasswordChangers and Students.

I'll update the screencast to make this clearer.

[boomam]

The 'Error: unable to bind to container' is caused when SSPR can not connect to Active Directory. This is most likely due to a problem with the FQDN specified in config.asp, the logon credentials in cred.ini, the IIS server's ability to find/contact a DC or insufficient access rights for the impersonation user.

Ive checked the FQDN, it is set correctly.

The login credentials are correct also.

The IIS can see the domain controller as well.

The impersonation user ive set as a staff user. Staff users can reset pupil passwords normally though MMC.

 

The annonymous security thing on the reset folder, does that need setting to the user i set up? Or leave at default?

 

 

The two security groups are for controlling who can reset passwords using the admin pages, and whose passwords they can reset. They have no bearing on the register, update or reset pages.

So if i dont want admin access on it, as i'll just use AD myself, the program will work fine without them?

Edited January 25, 2008 by boomam

[boomam]

Ive noticed, if i log into the admin pages through the IIS manager and look at my test user, it can see everything about the user, like his home folder locations, what OU its in, etc;

So SSPR does seem to be seeing/accessing AD?

 

Very odd this is.

[plexer]

Correct that if you don't want staff to use the webpages to reset passwords you don't need to create or use this group.

 

The "Students" group needs to be changed to whatever your default group for student is.

 

If you don't have 1 group that all students belong to then it's going to break.

 

Ben

[plexer]

reset folder is anonymous.

 

Try the impersanation user as a domain admin just to check.

 

Ben

[boomam]

Tryed. Still no luck..

[plexer]

Do all your students or even your test student belong to the group specified in config.asp i.e students???

 

Ben

[plexer]

Anyway Irazmus or I can get remote access to your network?

 

Ben

[Irazmus]

@Plexer: You beat me to it ^^

 

One slight correction though, resetGroup and usersGroup are only used by the admin pages, they don't control which users can use SSPR's register or reset pages. There is currently no restriction on who can use these, although there probably should be.

* Adds to ToDo list for 2.3 *

[plexer]

Ok thought it was but yes remembers that it's who they can reset the passwords of.

 

 

Ben

[boomam]

It was set as 'student', so i changed it to the group that we use 'pupil', and it still doesnt work. .

[plexer]

Boomam: sorry my bad it doesn't have anything to do with that side of things, again any chance of remote access?

 

Maybe using http://express.gotoassist.com ???

 

Ben

[Irazmus]

@rvdmast:

 

1 - You're quite right this isn't the last version, I'm already planning some new features/modifications for 2.3.

I did give consideration to language files when prepping 2.2 but opted to leave it out as I didn't think there would be much call for it (more fool me it seems), and it would have delayed the release which I didn't want since the main point of 2.2 was to fix a serious fault in 2.0/2.1. I will definately look to implement it in 2.3 or 2.4.

Also, since 2.2 was mainly a bug fix release and 2.2.1 is to allow tracking of which kids use "forgotten" passwords to waste time, if you're running SSPR on a DC and it's working fine for you, you'll probably not see enough difference between 2 and 2.2.1 to warrant re-translating the text strings if you've done it once already.

 

2 - As for the installer, it's something we're looking into, but havn't as of yet found a suitable (read free and easy) way of achieving this. Although a couple of ideas do spring to mind.

[Geoff]

As for the installer, it's something we're looking into, but havn't as of yet found a suitable (read free and easy) way of achieving this. Although a couple of ideas do spring to mind.

 

How about MakeMSI?

[boomam]

Boomam: sorry my bad it doesn't have anything to do with that side of things, again any chance of remote access?

 

Maybe using http://express.gotoassist.com ???

 

Ben

Check your PMs. .

[boomam]

Ive just gone through the install video again, and checking what i already did. Everything is how it should be.

[boomam]

Right, ive gone through the process of setting it up on our DC.

Now i get to the same point as before, just with a different error:

 

Resetting password for test2008...
An unexpected error occurred in the execution of this page
Please report the following information to an Administrator
Page Error Object
Error Number: -2147024891
Error Description: General access denyed error
Source: Active Directory
LineNumber: 0

 

Any ideas?

 

I'd also like to thank Ben for the dialogue yesterday between us. .

[boomam]

Ah.

Ive set the SSPR_SERVER login to domain admin and it goes through fine. Odd.

Just need to find the lowest login level i can give it for SSPR to still work.

[boomam]

Hmm.

The lowest its letting me give is account operator. Which is too high for my liking.

Ive delegated control out to the SSPR objects for the pupil OUs. Still no luck.

Odd really, as the staff group can do pupil passwords, but SSPR wont allow with the login set to Staff.

 

Ideas?

[plexer]

Must be something wrong with your delegation of password changing then?

 

Presume you'd delegated it to staff.

 

All though having a really long password for sspr_reset user and also the cred file is not readible means it's secure enough.

 

Ben

[boomam]

Which delegation options do i need to set, just to double check what im doing?

[plexer]

If you've run the delegate authority wizard to delegate it to staff for say the students ou that should be ok.

 

Ben