Home/ Questions/Q 304151
In Process

The Archive Base Latest Questions

Editorial Team
  • 0
Asked: 2026-05-12T07:15:14+00:00

I’ve created a web application that uses Microsoft AzMan, and it works just fine

  • 0

I’ve created a web application that uses Microsoft AzMan, and it works just fine until you have multiple users. I’m almost 100% certain that AzMan is caching the same stuff for multiple users.

To simplify it a bit, the problem I’m seeing is user A goes to the site and has full access, the user is granted the correct access and can work just fine. Then user B goes to the site, only has view access, but because AzMan has already seen user A’s full access, it grants full access to user B as well.

I’m using the AddStringSids method when creating the client context because it’s the only method that would work for every situation. Is there a problem with this? We used to not have this problem when we were creating client contexts from a token.

The following is the exact code I’m using to create the context. app is an IAzApplication2 variable, and ClientContext.SID is a SecurityIdentifier for the user in question.

IAzClientContext2 cctx = app.InitializeClientContext2("AppNameHere", null);
cctx.AddStringSids(new object[] { (object)ClientContext.SID.ToString() } as object);

EDIT: I am not using the ASP.Net role provider at all since that would require the application to be aware of roles. I’m only using the COM API.

EDIT 2: Also, if user B logged in first, then user A does not have access when he logs in. So it isn’t just keeping the highest level of access.

Share

Leave an answer

You must login to add an answer.

Need An Account,

1 Answer

  1. Editorial Team

    I thought about deleting this question, but I figure it’s better to leave it here to possibly help someone else out with a stupid mistake. AzMan is not caching access check results across multiple users. The AddStringSids method is not a problem. The problem was in my code.

    I had a static variable that was holding a reference to the client context, and only being created once for the life of the application, not the life of the users request. This static variable is what caused it to take on the first-person-to-access-it’s access.

    So it was a stupid programmer mistake, or SBCK (Short Between the Chair and the Keyboard) as my boss would say. So if you’re running into a similar issue in ASP.Net, check your variables and make sure you don’t have a static variable issue.

    • 0