ASP.NET MVC Form based Auth using AD works locally but fails on server(iis7)

Question

I implemented a form based authentication that uses AD in an ASP MVC 3 application following the directions I found here ASP.NET MVC - Authenticate users against Active Directory, but require username and password to be inputted

I works fine when I run using the ASP.NET Development Server, but fails to go beyond the login page after I enter my credentials and gives the following error:

Configuration Error

Description: An error occurred during the processing of a configuration file required to service this request. Please review the specific error details below and modify your configuration file appropriately.

Parser Error Message: An operations error occurred.

Source Error:

Line 37:     <membership defaultProvider="MY_ADMembershipProvider">
Line 38:       <providers>
Line 39:         <add name="MY_ADMembershipProvider" type="System.Web.Security.ActiveDirectoryMembershipProvider" connectionStringName="ADConnectionString" attributeMapUsername="sAMAccountName" />
Line 40:       </providers>
Line 41:     </membership>

Any help would be much appreciated, thanks in advance.

UPDATE: So far after a couple of debugs I think error might be coming from System.Web.Security.ActiveDirectoryMembershipProvider in the Web.xml config, I added System.Web (in which that class is found) as a reference and also to make a local copy but still, zip... :(

Answer 1

Make sure you have passed a valid username and password of an account that has sufficient privileges to query your AD:

<add 
    name="MY_ADMembershipProvider" 
    type="System.Web.Security.ActiveDirectoryMembershipProvider" 
    connectionStringName="ADConnectionString" 
    attributeMapUsername="sAMAccountName" 
    connectionUsername="YOURDOMAIN\SomeAccount"
    connectionPassword="secret"
/>

If you don't want to do that you will have to configure the Application Pool in your IIS to run under an account which has sufficient privileges to query your Active Directory. By default your application runs under a local NetworkService account which has no access to the AD.

Answer 2

I changed the Identity of the Application Pool from "ApplicationPoolIdentity" to "NetworkService" and everything works great now.