Question

I built a ASP.NET Webapllication that create a User in our ActiveDirectory but if I install it on the IIS7 I get a Error with not rights to add a User in Ad. Now I want create a Service that can do this but I have the same problems. The command is a Powershell command and I have install the modul for ActiveDirectory.

Here a few Informations about my Project:

My asmx code:

using System;
using System.Collections.Generic;
using System.Linq;
using System.Web;
using System.Web.Services;
using System.Security;
using System.Management.Automation;
using System.Management.Automation.Runspaces;
using System.Management.Automation.Remoting;
using System.Security;
using System.Security.Cryptography;
using System.IO;

namespace ActiveDirectoryService
{
    /// <summary>
    /// Zusammenfassungsbeschreibung für Service1
    /// </summary>
    [WebService(Namespace = "http://tempuri.org/")]
    [WebServiceBinding(ConformsTo = WsiProfiles.BasicProfile1_1)]
    [System.ComponentModel.ToolboxItem(false)]
    // Um das Aufrufen dieses Webdiensts aus einem Skript mit ASP.NET AJAX zuzulassen, heben Sie die Auskommentierung der folgenden Zeile auf. 
    // [System.Web.Script.Services.ScriptService]
    public class Service1 : System.Web.Services.WebService
    {

        [WebMethod]
        public string HelloWorld()
        {
            return "Hello World";
        }

        [WebMethod]
        public string Connectiontest()
        {
            return "Die Verbindung besteht";
        }

        [WebMethod]
        public string GetUsername()
        {
            return User.Identity.Name;
        }

        [WebMethod]
        public string CreateADUserInNPS(string macAdress)
        {
            string prefix = "test";
            string principlename = macAdress + "@company-test.com";
            string gn = "test";
            string sn = "test";
            string Path = "..."; //The path is correct but I don't want show this

            return AddNewUser(prefix, macAdress, principlename, gn, sn, Path);

        }

        public string AddNewUser(string prefix, string macAdress, string principlename, 
                               string gn, string sn, string path)
        {
            SecureString SECUREADADMINPASSWORD = new SecureString();

            foreach (char x in macAdress)
            {
                SECUREADADMINPASSWORD.AppendChar(x);
            }

            InitialSessionState initial = InitialSessionState.CreateDefault();
            Environment.SetEnvironmentVariable("ADPS_LoadDefaultDrive", "0");
            initial.ImportPSModule(new string[] { "ActiveDirectory" });

            using (Runspace runspace = RunspaceFactory.CreateRunspace(initial))
            {
                runspace.Open();
                using (Pipeline p = runspace.CreatePipeline())
                {
                    Command command = new Command("New-ADUser");
                    command.Parameters.Add("Name", prefix);
                    command.Parameters.Add("sAMAccountName", macAdress);
                    command.Parameters.Add("UserPrincipalName", principlename);
                    command.Parameters.Add("GivenName", gn);
                    command.Parameters.Add("SurName", sn);
                    command.Parameters.Add("displayname", macAdress);
                    command.Parameters.Add("enabled", true);
                    command.Parameters.Add("Path", path);
                    command.Parameters.Add("AllowReversiblePasswordEncryption", true);
                    command.Parameters.Add("PasswordNeverExpires", true);
                    command.Parameters.Add("AccountPassword", SECUREADADMINPASSWORD);
                    p.Commands.Add(command);

                    string pscommand = "New-ADUser " + prefix + " -SamAccountName " + macAdress +
                    " -UserPrincipalName " + macAdress + "@company-test.com -GivenName " + gn + // @company-test.com aus cfg
                    " -SurName " + sn + " -displayname " + macAdress + " -enabled $true -Path " + path +
                    " -AllowReversiblePasswordEncryption $true -PasswordNeverExpires $true -AccountPassword (ConvertTo-Securestring" +
                    " '" + macAdress + "'" + " -asplaintext -Force)";

                    try
                    {
                        p.Invoke();   //I think here comes the Error with not the rights
                        return "erfolg";
                    }
                    catch (Exception ex)
                    {
                        return "Meldung: " + ex.Message;
                    }
                }
            }
        }
    }
}

On my Client it works but not if I install it on the IIS7.

My aspx code:

using System;
using System.Collections.Generic;
using System.Linq;
using System.Web;
using System.Web.UI;
using System.Web.UI.WebControls;
using ActiveDirectoryCenter.serv;

namespace ActiveDirectoryCenter
{
    public partial class main : System.Web.UI.Page
    {
        protected void Page_Load(object sender, EventArgs e)
        {

        }

        protected void btnConnectionTest_Click(object sender, EventArgs e)
        {
            serv.Service1 service = new Service1();
            service.Credentials = System.Net.CredentialCache.DefaultNetworkCredentials;
            lblConnection.Text = service.Connectiontest();
        }

        protected void btnGetUsername_Click(object sender, EventArgs e)
        {
            serv.Service1 service = new Service1();
            service.Credentials = System.Net.CredentialCache.DefaultCredentials;
            lblUsername.Text = service.GetUsername();
        }

        protected void btncreateADUser_Click(object sender, EventArgs e)
        {
            serv.Service1 service = new Service1();
            service.Credentials = System.Net.CredentialCache.DefaultCredentials;
            lblstatus.Text = service.CreateADUserInNPS(txtMacAdress.Text);

        }
    }
}

Here the Idea

I make it first without a service but now I want a aspx site and a service that have the methods.
I configurate the service so:

I know it is a difficult question but maybe I get help 🙁

Answer 1

just trying to help from my own experience.

service.Credentials = System.Net.CredentialCache.DefaultCredentials;

comment it out, and if it fails figure out which credentials to use.

that is in your web client.

something else: have your own iis application pool.

1. your own
2. you need to find out if it should be classic .net or integrated when it comes to application pool mode. classic .net usually is for old .net web apps, like coming from asp.net 1.1 or 2.0.

by the way, what are error number and message and description and so forth?