Microsoft Knowledge Base Article
This article contents is Microsoft Copyrighted material.
©2005-©2007 Microsoft Corporation. All rights reserved.
Terms
of Use |
Trademarks
Article ID: 168425 - Last Review: July 3, 2008 - Revision: 5.1
Credentials lost inside single-threaded ASP components
This article was previously published under Q168425
We strongly recommend that all users upgrade to Microsoft Internet Information Services (IIS) version 7.0 running on Microsoft Windows Server 2008. IIS 7.0 significantly increases Web infrastructure security. For more information about IIS security-related topics, visit the following Microsoft Web site:
For more information about IIS 7.0, visit the following Microsoft Web site:
If a single-threaded Active Server Pages (ASP) component tries to access
resources on a remote machine, access may denied to these resources. One
example of this scenario would be a Visual Basic 4.0 OLE DLL calling the
DIR command on a UNC path. In this scenario, a "Path Not Found" error is
returned.
This problem is caused by a limitation in the way Internet Information
Server (IIS) uses NT threads to manage single-threaded objects. Because of
this limitation, the security credentials are not propagated between
threads. As a result, the single-threaded component is operating in the
security context of the SYSTEM account. When you try to access resources
on other machines, the SYSTEM account is not recognized and access is
denied.
There are two common workarounds for this problem:
- Components that have their ThreadingModel registry key set to either
"Apartment" or "Both" do not have this problem. Therefore the best
solution is to create components that use Apartment model threading.
Because Visual Basic 4.0 produces only single-threaded objects, you need
to create your components with another tool such as Visual Basic 5.0 or
Visual C++.
- A final workaround is to add impersonation code to your component so
that it inherits the security credentials of another user that has
access to the desired resources. This approach has some limitations and
is not recommended.
This behavior is by design.
For the latest Knowledge Base articles and other support information on
Visual InterDev and Active Server Pages, see the following page on the
Microsoft Technical Support site:
APPLIES TO
- Microsoft Active Server Pages 4.0
- Microsoft Internet Information Server 4.0
- Microsoft Internet Information Services 5.0
| kberrmsg kbprb kbsecurity kbthread kbwebserver KB168425 |
Community Feedback System
Very often, it takes hours to solve a problem. Very often, you've looked high
and low, and have tried a lot of solutions. When you finally found it, chances
are, it was because someone else helped you. Here's your chance to give back.
Use our community feedback tool to let others know what worked for you and what
didn't.
Please also understand that the community feedback system is not warranted to be
correct, it's simply a system that we've built to let people try and help each
other. If something in a feedback response doesn't make sense to you, or you're
not comfortable making changes that the feedback talks about (like registry
edits), please consult a professional.
Thank you for using kbAlertz.com Feedback System.
-- Scott Cate
Be the first to leave feedback, to help others about this knowledge base
article.
(Optional) Name
(Optional)
Public URL Or Email
Comments
No
HTML -- Text Only Please