IIS7 hosted API Classic ASP connection shows "InvalidSecurity An error occurred when verifying security for the message"

Question

On II7 we host a WCF/asp.net based API. In order to allow users of a classic asp application to connect to the API we had to publish a version we refer to as "transport". This Transport version is written in asp.net too, it points to the same assembly , its just the security layer is different to allow classic asp to authenticate. Transport level security is used as opposed to message based security.

When using a browser to load the service reference i can loading the svcutil.exe ... WDSL page.

When using my test asp page to call a web method from this reference i get the following returned:

Finished calling Web Service. Status = Internal Server Error ResponseText = a:InvalidSecurityAn error occurred when verifying security for the message.

This suggests that the authentication is failing. When testing using asp.net or the application WCF storm to contact the normal API everything works well.

The API was recently migrated , it would appear something has not been setup correctly but i am at a loss to explain what.

I can browse to the svcutil.exe ... WDSL service reference, when selecting it via the browser i get the expect XML response.

The USER NAME and password utilised work when using the non-classic asp publicaiton of the API using the message based secuirty.

Would it be possible to post some troubleshooting tip that may help diagnoise the issue please specifically regarding transport level security fault finding and setup ?

Thank you Scott

Answer 1

REF _http://theether.net/kb/100127

load cmd prompt CD to C:\Windows\System32\inetsrv enter: appcmd list config -section:system.webServer/asp the following path is displayed: c:\inetpub\conf\temp\ASP compiled templates check path exists (it does) Check if the NETWORK SERVICE has permissions to access "ASP compiled templates" If not from appcmd execute

icacls "c:\inetpub\conf\temp\ASP Compiled Templates" /grant "NETWORK SERVICE:(OI)(CI)(M)"

should read "sucessfully processed 1 files"

restarted app pool.

THE "InvalidSecurityAn error occurred when verifying security for the message" problem still persists but the "COULD NOT CREATE A DISK CACHE SUB-DIRECORY .... " error from the eventlog is no longer occurring.

Sorry another update. The network service permission change DID NOT resolve the issue , changeing to the DEFAULT APP POOL solved the problem.

Got a lead at last. Examined:

ServiceSecurityAudit set in service behaviour. _http://intrepiddeveloper.wordpress.com/2008/08/07/security-event-logging-auditing/# IIS logs (simply shows the non-specific error 500.) Fault tracing enabled( also shows error 500). Custom errors were off Friendly IE messages were off Asp client side and server side debugging on ProcessMon running , no errors. Web.config httpErrors errorMode="Detailed" /> + ServiceSecurityAudit found me an "Object reference not set to an instance of an object" so sounds like our app has a bug.

Follow up (06/10/11):

Service Security Audit documented here:

http://intrepiddeveloper.wordpress.com/2008/08/07/security-event-logging-auditing/

Was the key for us to resolve this issue. Uncovered the Object Reference Error which indicated out Business Objects and Data Access dlls were out of alignment. Using CLASSIC ASP to contact the WCF.NET API using TRANSPORT AUTHENTICATION there was abolutely no indication of this error until Service Security Audit was enavled on the behaviour.config file in the WCF deployment.

• RESOLVED *