AZMan: InitializeClientContextFromName failing with "Value does not fall within the expected range."

Question

The following code, fails at the InitializeClientContextFromName, with "Value does not fall within the expected range." It works on another developer's machine.

any clues I should follow up? I'm not really familiar with AzMan at all...

    private List<string> SyncAzManRoles(ActiveDirectoryMembershipProvider provider)
    {
        List<string> userAzManRoles = new List<string>();

        AzAuthorizationStoreClass store = new AzAuthorizationStoreClass();
        if (store == null)
        {
            AuthTrace("Azman store is not available");
            throw new InvalidOperationException("The azman store is not available");
        }
        store.Initialize(0, ConfigurationManager.ConnectionStrings
                    ["LocalPolicyStore"].ConnectionString, null);

        IAzApplication3 app = store.OpenApplication(Security.ApplicationName, null) as IAzApplication3;
        if (app == null)
        {
            AuthTrace("Azman application is not available");
            throw new InvalidOperationException("The azman application is not available");
        }

        IAzClientContext3 clientContext = null;
        try
        {
            clientContext = app.InitializeClientContextFromName(_username,
                provider.Name, null) as IAzClientContext3;

Answer 1

I solved this by using the InitializeClientContextFromToken method instead of InitializeClientContextFromName.

In my case, it was being used inside an ASP.NET Web application

ulong token = 0;

var principal = User as WindowsPrincipal;
if ( principal != null )
{
    var identity = (WindowsIdentity) principal.Identity;

    ViewBag.Identity = identity.Name;
    token = (ulong) identity.Token.ToInt64();
}

// Server 2008 or Vista required to use IAzClientContext3
// Using token 0 uses app pool identity
var _clientContext = (IAzClientContext3) _azManApp.InitializeClientContextFromToken( token );

If you pass zero in as the token value, for web apps that results in using the App pool identity. Otherwise if the user is logged in with a WindowsIdentity, then the value of the Token property works too.

For a desktop application, you can probably just use a zero token to use the current user's identity.