Blog posts by Leif Boström

Exposing the root cause of ActiveDirectoryRoleProvider errors

Sun, 18 Jul 2010 15:00:03 GMT

Have you ever had issues when connecting to a Windows Active Directory using the ActiveDirectoryRoleProvider? The Error message thrown at you can be somewhat descriptive but doesn't really give you any idea about what is actually causing the crash. Here are two exceptions I've seen in the past:

[DirectoryServicesCOMException (0x80072030): There is no such object on the server. ]
[DirectoryServicesCOMException (0x80072032): An invalid dn syntax has been specified. ]

The later is due to the fact that an "illegal" character is used in a DirectoryEntry, e.g. a decimal comma "," in a CN (username) or a backslash "\" in a group name. Johan Olofsson wrote a blog post on how to handle this, Some ActiveDirectoryRoleProvider issues.

There is no such object on the server

I just recently came across the "There is no such object on the server" error in a project once again so I thought I'd share a little remedy to the problem. It won't fix the actual problem but it will tell you what is causing it so that you can fix it in your Active Directory.

The error usually shows itself when you try to set access rights for a page or try to load groups in Admin mode. The GetAllRoles method in the ActiveDirectoryRoleProvider class gets executed and subsequent calls to CreateDirectoryDataFromDirectoryEntry are made. Here is part of the Stack Trace:

[DirectoryServicesCOMException (0x80072030): There is no such object on the server.]
System.DirectoryServices.DirectoryEntry.Bind(Boolean throwIfFail) +557
System.DirectoryServices.DirectoryEntry.Bind() +44
System.DirectoryServices.DirectoryEntry.get_AdsObject() +42
System.DirectoryServices.PropertyCollection.Contains(String propertyName) +29
EPiServer.Security.AdsiDataFactory.CreateDirectoryDataFromDirectoryEntry(DirectoryEntry entry) +216
EPiServer.Security.AdsiDataFactory.GetEntry(String distinguishedName) +137
EPiServer.Security.ActiveDirectoryRoleProvider.GetAllRoles() +184

There is no way to figure out which propertyName or DirectoryEntry is being sought for without catching the error a little bit more gracefully, so I extracted EPiServer's AdsiDataFactory with .NET Reflector and added some error handling to the CreateDirectoryDataFromDirectoryEntry method. I also changed the signature a bit passing in the distinguishedName so that the object (user or group) that was causing the error could be displayed in the error message.

       1: protected DirectoryData CreateDirectoryDataFromDirectoryEntry(DirectoryEntry entry, string distinguishedName)

       2: {

       3:   if (entry == null)

       4:   {

       5:     return null;

       6:   }

       7:   Dictionary<string, string[]> properties = new Dictionary<string, string[]>(this._propertiesToLoad.Count);

       8:   foreach (string str in this._propertiesToLoad)

       9:   {

    try

    {

      if (entry.Properties.Contains(str))

      {

        PropertyValueCollection values = entry.Properties[str];

        string[] strArray = new string[values.Count];

        for (int i = 0; i < values.Count; i++)

        {

          strArray[i] = values[i].ToString();

        }

        properties.Add(str, strArray);

      }

    }

    catch (DirectoryServicesCOMException ex)

    {

      StringBuilder sb = new StringBuilder();

      foreach (string s in this._propertiesToLoad)

      {

        sb.Append(" | " + s);

      }

      throw new Exception("Error in CreateDirectoryDataFromDirectoryEntry!" + Environment.NewLine +

          "Value of last str: " + str + Environment.NewLine +

          "All Properties: " + sb.ToString() + Environment.NewLine +

          "distinguishedName: " + distinguishedName, ex);

    }

  }

  return new DirectoryData(this.DistinguishedName(properties), entry.SchemaClassName, properties);

}

With this try/catch block in place we now know the value of the last property and all other properties that were loaded including the DistinguishedName.

All that's missing now is to instantiate the "new" AdsiDataFactory with a new ADRoleProvider that inherits from EPiServer.Security. ActiveDirectoryRoleProvider and to change the roleManager section in web.config to use our new RoleProvider.

       1: namespace MyWebSite.Security

       2: {

       3:     public class ADRoleProvider : EPiServer.Security.ActiveDirectoryRoleProvider

       4:     {

       5:         public ADRoleProvider()

       6:         {

       7:             base.DirectoryDataFactory = new AdsiDataFactory();

       8:         }

       9:     }

      10: }

<roleManager enabled="true" 
             defaultProvider="ActiveDirectoryRoleProvider" 
             cacheRolesInCookie="true">
  <providers>
    <clear />
    <add name="ActiveDirectoryRoleProvider"
         type="MyWebSite.Security.ADRoleProvider, MyWebSite.Security"
         connectionStringName="ActiveDirectoryProviderConnection"
         connectionUsername="username"
         connectionPassword="password" />
  </providers>
</roleManager>

Hope this helps anyone else having the same issues.

Here’s the complete code for the altered AdsiDataFactory with error handling in place (had some trouble attaching files :-) )

       1: using System;

       2: using System.Collections.Generic;

       3: using System.Collections.Specialized;

       4: using System.Configuration;

       5: using System.Configuration.Provider;

       6: using System.DirectoryServices;

       7: using System.Text;

       8: using System.Web;

       9: using System.Web.Caching;

using System.Web.Configuration;

using EPiServer.Security;

  

namespace MyWebSite.Security

{

    public class AdsiDataFactory : DirectoryDataFactory

    {

        // Fields

        private string _baseConnectionString;

        private const string _cacheKeyEntryPrefix = "EPiServer:DirectoryServiceEntry:";

        private const string _cacheKeyFindAllPrefix = "EPiServer:DirectoryServiceFindAll:";

        private const string _cacheKeyFindOnePrefix = "EPiServer:DirectoryServiceFindOne:";

        private TimeSpan _cacheTimeout;

        private AuthenticationTypes _connectionProtection;

        private string _connectionString;

        private const string _distingushedNameAttribute = "distinguishedName";

        private const string _objectClassAttribute = "objectClass";

        private string _password;

        private List<string> _propertiesToLoad;

        private const string _reservedCharacters = "\r\n+\\\"<>;/";

        private const string _rootCacheKey = "EPiServer:DirectoryServiceRoot";

        private string _username;

  

        // Methods

        public AdsiDataFactory()

        {

        }

  

        public AdsiDataFactory(string connectionString, string username, string password, AuthenticationTypes connectionProtection, TimeSpan absoluteCacheTimeout)

        {

            this._connectionString = connectionString;

            this._username = username;

            this._password = password;

            this._connectionProtection = connectionProtection;

            this._cacheTimeout = absoluteCacheTimeout;

            this.Initialize();

        }

  

        public override void AddPropertyToLoad(string propertyName)

        {

            if (!this._propertiesToLoad.Contains(propertyName))

            {

                this._propertiesToLoad.Add(propertyName);

                this.ClearCache();

            }

        }

  

        public void ClearCache()

        {

            HttpRuntime.Cache.Remove("EPiServer:DirectoryServiceRoot");

        }

  

        protected DirectoryData CreateDirectoryDataFromDirectoryEntry(DirectoryEntry entry, string distinguishedName)

        {

            if (entry == null)

            {

                return null;

            }

            Dictionary<string, string[]> properties = new Dictionary<string, string[]>(this._propertiesToLoad.Count);

            foreach (string str in this._propertiesToLoad)

            {

                try

                {

                    if (entry.Properties.Contains(str))

                    {

                        PropertyValueCollection values = entry.Properties[str];

                        string[] strArray = new string[values.Count];

                        for (int i = 0; i < values.Count; i++)

                        {

                            strArray[i] = values[i].ToString();

                        }

                        properties.Add(str, strArray);

                    }

                }

                catch (DirectoryServicesCOMException ex)

                {

                    StringBuilder sb = new StringBuilder();

                    foreach (string s in this._propertiesToLoad)

                    {

                        sb.Append(" | " + s);

                    }

  

                    throw new Exception("Error in CreateDirectoryDataFromDirectoryEntry!" + Environment.NewLine +

                                    "Value of last str: " + str + Environment.NewLine +

                                    "All Properties: " + sb.ToString() + Environment.NewLine +

                                    "distinguishedName: " + distinguishedName, ex);

                }

            }

            return new DirectoryData(this.DistinguishedName(properties), entry.SchemaClassName, properties);

        }

  

        protected DirectoryData CreateDirectoryDataFromSearchResult(SearchResult result)

        {

            if (result == null)

            {

                return null;

            }

            Dictionary<string, string[]> properties = new Dictionary<string, string[]>(this._propertiesToLoad.Count);

            foreach (string str in this._propertiesToLoad)

            {

                if (result.Properties.Contains(str))

                {

                    ResultPropertyValueCollection values = result.Properties[str];

                    string[] strArray = new string[values.Count];

                    for (int i = 0; i < values.Count; i++)

                    {

                        strArray[i] = values[i].ToString();

                    }

                    properties.Add(str, strArray);

                }

            }

            return new DirectoryData(this.DistinguishedName(properties), this.SchemaClassName(properties), properties);

        }

  

        protected DirectoryEntry CreateDirectoryEntry()

        {

            return new DirectoryEntry(this._connectionString, this._username, this._password, this._connectionProtection);

        }

  

        protected DirectoryEntry CreateDirectoryEntry(string rootDistinguishedName)

        {

            if (!base.IsWithinSubtree(rootDistinguishedName))

            {

                return null;

            }

            return new DirectoryEntry(this._baseConnectionString + this.EscapeDistinguishedName(rootDistinguishedName), this._username, this._password, this._connectionProtection);

        }

  

        protected string DistinguishedName(Dictionary<string, string[]> properties)

        {

            return properties["distinguishedName"][0];

        }

  

        protected string EscapeDistinguishedName(string distinguishedName)

        {

            StringBuilder builder = new StringBuilder(distinguishedName.Length);

            foreach (char ch in distinguishedName)

            {

                if (_reservedCharacters.IndexOf(ch) >= 0)

                {

                    builder.Append('\\');

                }

                builder.Append(ch);

            }

            return builder.ToString();

        }

  

        public override IList<DirectoryData> FindAll(string filter, SearchScope scope, string sortByProperty)

        {

            string cacheKey = "EPiServer:DirectoryServiceFindAll:" + filter + scope.ToString();

            IList<DirectoryData> values = (IList<DirectoryData>)HttpRuntime.Cache[cacheKey];

            if (values == null)

            {

                using (DirectorySearcher searcher = new DirectorySearcher(this.CreateDirectoryEntry(), filter, this._propertiesToLoad.ToArray(), scope))

                {

                    using (SearchResultCollection results = searcher.FindAll())

                    {

                        if (results == null)

                        {

                            return null;

                        }

                        if (sortByProperty == null)

                        {

                            values = new List<DirectoryData>(results.Count);

                            foreach (SearchResult result in results)

                            {

                                values.Add(this.CreateDirectoryDataFromSearchResult(result));

                            }

                        }

                        else

                        {

                            SortedList<string, DirectoryData> list2 = new SortedList<string, DirectoryData>(results.Count);

                            foreach (SearchResult result2 in results)

                            {

                                DirectoryData data = this.CreateDirectoryDataFromSearchResult(result2);

                                list2.Add(data.GetFirstPropertyValue(sortByProperty), data);

                            }

                            values = list2.Values;

                        }

                    }

                }

                this.StoreInCache(cacheKey, values);

            }

            return values;

        }

  

        public override DirectoryData FindOne(string filter, SearchScope scope)

        {

            string cacheKey = "EPiServer:DirectoryServiceFindOne:" + filter + scope.ToString();

            DirectoryData data = (DirectoryData)HttpRuntime.Cache[cacheKey];

            if (data == null)

            {

                using (DirectorySearcher searcher = new DirectorySearcher(this.CreateDirectoryEntry(), filter, this._propertiesToLoad.ToArray(), scope))

                {

                    data = this.CreateDirectoryDataFromSearchResult(searcher.FindOne());

                    if (data == null)

                    {

                        return null;

                    }

                }

                this.StoreInCache(cacheKey, data);

            }

            return data;

        }

  

        public override DirectoryData GetEntry(string distinguishedName)

        {

            string cacheKey = "EPiServer:DirectoryServiceEntry:" + distinguishedName;

            DirectoryData data = (DirectoryData)HttpRuntime.Cache[cacheKey];

            if (data == null)

            {

                using (DirectoryEntry entry = this.CreateDirectoryEntry(distinguishedName))

                {

                    data = this.CreateDirectoryDataFromDirectoryEntry(entry, distinguishedName);

                }

                if (data != null)

                {

                    this.StoreInCache(cacheKey, data);

                }

            }

            return data;

        }

  

        private void GetParametersFromConfig(NameValueCollection config)

        {

            string str;

            string str2;

            string str3;

            if (!this.TryGetDestructive(config, "connectionStringName", out str))

            {

                throw new ProviderException("Required attribute connectionStringName not supplied.");

            }

            ConnectionStringSettings settings = WebConfigurationManager.ConnectionStrings[str];

            if (settings == null)

            {

                throw new ProviderException(string.Format("Connection string {0} not found.", str));

            }

            this._connectionString = settings.ConnectionString;

            if (string.IsNullOrEmpty(this._connectionString))

            {

                throw new ProviderException(string.Format("Connection string {0} is empty.", str));

            }

            if (!this.TryGetDestructive(config, "connectionUsername", out this._username))

            {

                throw new ProviderException("Required attribute connectionUsername not supplied.");

            }

            if (!this.TryGetDestructive(config, "connectionPassword", out this._password))

            {

                throw new ProviderException("Required attribute connectionPassword not supplied.");

            }

            this._connectionProtection = AuthenticationTypes.Secure;

            if (this.TryGetDestructive(config, "connectionProtection", out str2))

            {

                try

                {

                    this._connectionProtection = (AuthenticationTypes)Enum.Parse(typeof(AuthenticationTypes), str2, true);

                }

                catch (ArgumentException)

                {

                    throw new ProviderException(string.Format("Attribute connectionProtection has illegal value {0}, supported values are {1}.", str2, string.Join(", ", Enum.GetNames(typeof(AuthenticationTypes)))));

                }

            }

            if (this.TryGetDestructive(config, "cacheTimeout", out str3))

            {

                if (!TimeSpan.TryParse(str3, out this._cacheTimeout))

                {

                    throw new ProviderException(string.Format("Attribute cacheTimeout has illegal value {0}, should be formatted as \"hours:minutes:seconds\"", str3));

                }

            }

            else

            {

                this._cacheTimeout = new TimeSpan(0, 10, 0);

            }

        }

  

        private void Initialize()

        {

            this._propertiesToLoad = new List<string>(5);

            this._propertiesToLoad.Add("distinguishedName");

            this._propertiesToLoad.Add("objectClass");

            int index = this._connectionString.IndexOf("://");

            if (index < 0)

            {

                throw new ProviderException(string.Format("Protocol specification missing from connection string {0}", this._connectionString));

            }

            int num2 = this._connectionString.IndexOf("/", (int)(index + 3));

            if (num2 < 0)

            {

                this._baseConnectionString = this._connectionString + "/";

            }

            else if ((num2 + 1) < this._connectionString.Length)

            {

                this._baseConnectionString = this._connectionString.Remove(num2 + 1);

            }

            else

            {

                this._baseConnectionString = this._connectionString;

            }

            using (DirectoryEntry entry = this.CreateDirectoryEntry())

            {

                base.RootDistinguishedName = entry.Properties["distinguishedName"][0].ToString();

            }

        }

  

        public override void Initialize(NameValueCollection config)

        {

            this.GetParametersFromConfig(config);

            this.Initialize();

        }

  

        protected string SchemaClassName(Dictionary<string, string[]> properties)

        {

            string str = string.Empty;

            string[] strArray = properties["objectClass"];

            if (strArray != null)

            {

                str = strArray[strArray.Length - 1];

            }

            return str;

        }

  

        protected void StoreInCache(string cacheKey, object data)

        {

            if (HttpRuntime.Cache["EPiServer:DirectoryServiceRoot"] == null)

            {

                HttpRuntime.Cache.Insert("EPiServer:DirectoryServiceRoot", new object());

            }

            HttpRuntime.Cache.Insert(cacheKey, data, new CacheDependency(null, new string[] { "EPiServer:DirectoryServiceRoot" }), DateTime.Now.Add(this._cacheTimeout), Cache.NoSlidingExpiration);

        }

  

        protected bool TryGetDestructive(NameValueCollection config, string name, out string value)

        {

            value = config[name];

            if (value != null)

            {

                config.Remove(name);

            }

            if (string.IsNullOrEmpty(value))

            {

                value = null;

                return false;

            }

            return true;

        }

  

        // Properties

        public AuthenticationTypes ConnectionProtection

        {

            get

            {

                return this._connectionProtection;

            }

            protected set

            {

                this._connectionProtection = value;

            }

        }

  

        public string ConnectionString

        {

            get

            {

                return this._connectionString;

            }

            protected set

            {

                this._connectionString = value;

            }

        }

  

        public string Password

        {

            get

            {

                return this._password;

            }

            protected set

            {

                this._password = value;

            }

        }

  

        public string Username

        {

            get

            {

                return this._username;

            }

            protected set

            {

                this._username = value;

            }

        }

    }

  

}

Keeping track of the EPiServer Community user limit

Mon, 11 Jan 2010 12:24:41 GMT

The license model for EPiServer Community has a restriction on the maximum number of users that can register for a community based website. If the number of registered community users exceeds the license user limit a license error will be thrown.

As a website’s community grows additional license upgrades can be made to suit the number of community users. Depending on the initial budget and estimated need for “user licenses” there is a tiered price ladder that permits the Community to grow.

0 - 10 000 members
up to 30 000 members
up to 60 000 members
up to 100 000 members
up to 200 000 members
up to 500 000 members
up to 700 000 members
up to 1 000 000 members
up to 1 500 000 members
up to 2 000 000 members
up to 3 000 000 members
up to 5 000 000 members

Other options may apply. Always check with your EPiServer Solution Partner for a price list.

So how does one know when to upgrade, and on time as well?

A quick way to find out how many users there are is to tap into the database and query the EPiServer Community table, tblEPiServerCommonUser. This simple query returns the number of active users:

SELECT COUNT(*) 
FROM [dbo].[tblEPiServerCommonUser] 
WHERE [blnRemoved] = 1

A more convenient way in the long run though, would be to create a Scheduled Job in EPiServer that automatically sends an e-mail to the customer (or EPiServer partner) with the current number of community users.

Basically it’s only one line of code to find the current number of users:

EPiServer.Community.CommunitySystem.CurrentContext.DefaultSecurity.UserCount

Putting it all together, the Scheduled Job Plugin could look something like this (error handling omitted and strings hard coded for the sake of brevity).

  1: using System.Globalization;
  2: using System.Net.Mail;
  3: using EPiServer.PlugIn;
  4: 
  5: namespace MySite.Common.ScheduledJobs
  6: {
  7:     [ScheduledPlugIn(DisplayName = "EPiServer Community user counter")]
  8:     public class CommunityUserLicenseCounter
  9:     {
 10:         const string EMAIL_SUBJECT = "{0} - Current number of EPiServer Community users";
 11:         const string EMAIL_BODY = "Current number of EPiServer Community users: {0} for site: {1}.";
 12: 
 13:         public static string Execute()
 14:         {
 15:             string body = string.Format(EMAIL_BODY, CurrentUserCount, SiteUrl);
 16:             SendEmailMessage(body);
 17:             return body;
 18:         }
 19: 
 20:         private static string CurrentUserCount
 21:         {
 22:             get
 23:             {
 24:                 int userCount = EPiServer.Community.CommunitySystem.CurrentContext.DefaultSecurity.UserCount;
 25:                 return userCount.ToString("N0", CultureInfo.CreateSpecificCulture("sv-SE"));
 26:             }
 27:         }
 28: 
 29:         private static string SiteUrl
 30:         {
 31:             get { return EPiServer.Configuration.Settings.Instance.SiteUrl.AbsoluteUri; }
 32:         }
 33: 
 34:         private static string SiteDisplayName
 35:         {
 36:             get { return EPiServer.Configuration.Settings.Instance.SiteDisplayName; }
 37:         }
 38: 
 39:         private static void SendEmailMessage(string body)
 40:         {
 41:             string to = "info@mysite.com";
 42:             string from = "info@mysite.com";
 43:             string subject = string.Format(EMAIL_SUBJECT, SiteDisplayName);
 44:             MailMessage message = new MailMessage(from, to, subject, body);
 45:             SmtpClient client = new SmtpClient();
 46:             client.UseDefaultCredentials = true;
 47:             client.Send(message);
 48:         }   
 49:     }
 50: }
 51:

The result after running the scheduled job looks like this:

Some final touch up

I nice addition would be to extract the UserLimit from the license file and only notify the website owner when a certain threshold has been reached, e.g. when the current number of users passes 90% of the UserLimit. I’ve yet to find a way of extracting the MaxUsers in the EPiServer.Community.License namespace. Maybe someone can contribute with a solution?

The user limit setting can be found in the EPiServerRelateLicense.config file in the <UserLimit /> section.

More information on how to create a custom scheduled job can be found on Ted’s blog.