ASP.NET intranet solution using EntireX .NET wrapper and Ent

[Brandt_Lassen]

Originally posted by Rolf Bahlke:

quote:

---

Token is used to allow reconnection of an interrupted session (eg for use in conjunction with UOWs and persistence) - I’ve not heard of it being used in the security mechanism.

---

The usage of Token together with security is usually mandatory in a multi-threaded middle-tier environment like IIS. Typically IIS keeps multiple instances of .NET (or COM) objects and processes them in multiple threads. If a session initiated by a web client is processed in one IIS thread there is a certain chance that a following call which belongs to the same session will be processed by IIS in a different thread. However, the Broker identifies a user by userid + physical/internal userid where the threadid is part of the physical userid. Once a thread change takes place Broker creates a new logical user and the security token is not valid any longer (because it belongs to another logical user). This is the reason why Token has to be used in such a scenario.
You might need multiple clients firing requests simultaneously to see this effect.

Kind regards,
Rolf

Dear Rolf

Your fine explanation of token usage in an IIS environment is similar to that of our SAG consultant. I haven?t tried testing with multiple clients firing requests simultaneously without setting the token to the session id, but I?m sure you are right.

Instead I have run my test (once again) where I change the value of the token (initially set to the session id) during a session, expecting an error. And this time I do an error:

0080003 Acces Denied Password not authorized

Perhaps this is even the same error as if a thread change had taken place without assigning the token parameter?

I have no idea why I didn?t get this error in my first test run, but I?m sure I?m the one to blame, so what can I say: About token and security token, you were right, I was wrong.

Best regards,

Michael Brandt Lassen