PRB: Credentials Lost Inside Single-Threaded ASP Components

• Active Server Pages
• Microsoft Internet Information Server versions 4.0, 5.0

SYMPTOMS

If a single-threaded Active Server Pages (ASP) component tries to access resources on a remote machine, access may denied to these resources. One example of this scenario would be a Visual Basic 4.0 OLE DLL calling the DIR command on a UNC path. In this scenario, a "Path Not Found" error is returned.

CAUSE

This problem is caused by a limitation in the way Internet Information Server (IIS) uses NT threads to manage single-threaded objects. Because of this limitation, the security credentials are not propagated between threads. As a result, the single-threaded component is operating in the security context of the SYSTEM account. When you try to access resources on other machines, the SYSTEM account is not recognized and access is denied.

RESOLUTION

There are two common workarounds for this problem:

• Components that have their ThreadingModel registry key set to either "Apartment" or "Both" do not have this problem. Therefore the best solution is to create components that use Apartment model threading. Because Visual Basic 4.0 produces only single-threaded objects, you need to create your components with another tool such as Visual Basic 5.0 or Visual C++.



• A final workaround is to add impersonation code to your component so that it inherits the security credentials of another user that has access to the desired resources. This approach has some limitations and is not recommended.

STATUS

This behavior is by design.

REFERENCES

For the latest Knowledge Base articles and other support information on Visual InterDev and Active Server Pages, see the following page on the Microsoft Technical Support site:

http://support.microsoft.com/support/vinterdev/

Additional query words:

Keywords : kberrmsg kbsample kbASP kbCOMt kbThread kbWebServer kbGrpASP kbiis400 kbiis500
Version : winnt:
Platform : winnt
Issue type : kbprb