This is a collection of questions and answers about Microsoft® Content Management Server (MCMS) gathered from the MCMS newsgroup. This content is provided "AS IS" with no warranties, and confers no rights. If you have feedback about one of these topics or would like to add information, please post your comments to the MCMS newsgroup.

 

Thank you,

Stefan Goßner Escalation Engineer

Steve Cawood Program Manager

MCMS 2002 - Security and Rights FAQ - Table of Contents

AESecurityService
Cookies
Error message: "Logon failed due to invalid or expired authentication token."

Topic: AESecurityService

I know MCMS is running as an ISAPI filter in IIS. What is 'AESecurityService' for?

Answer

The AESecurity service is used by MCMS to perform authentication requests when resolving NTDS or AD groups. Also, it is used to request user information for login. It is a required service.

The AESecurityService service is not dependent on Microsoft Internet Information Server (IIS) (it uses RPC). Even if you have the IISAdmin service stopped, the AESecurity service will still be running and you can still access MCMS resources. This is true as long as they are being accessed through the CmsAppContext (instead of CmsHttpContext).

[Back to Top]

Topic: Cookies

Does MCMS automatically produce any kind of cookies?

Answer

The only cookies that MCMS generates are authentication cookies. These are generated if you are using forms based authentication. For ASP sites (which use Windows authentication) there is also a cookie generated to keep track of whether the browser has previously provided the user's Windows credentials.

There are no channel specific cookies. If you have a pure guest site, then no (MCMS) cookies will be generated at all.

[Back to Top]

Topic: Error message: "Logon failed due to invalid or expired authentication token."

Error message: "Logon failed due to invalid or expired authentication token."

I followed the steps in "Enabling Forms-Based Authentication" of the Site Development help file. I have configured my MCMS site for anonymous access in both Microsoft Internet Information Server (IIS) and the SCA.

I used the IUSR_<machinename> user and have placed it in a "subscriber" rights group. I have modified the web.config to include "Forms" authentication. Anonymous access is working and logging in works. However, when the cookie expires, I receive this error. If I delete my cookies, I can log back in and everything works fine. Any suggestions?

Answer

When the session expires, you will automatically get the Login page. Because the session has expired, there is no current CmsHttpContext. Trying to access the current context within the login page will generate the expired or invalid authentication token exception.

Don't try to access the current context anywhere on the login page. If you must, put it in a try catch block and handle the error when it occurs.

[Back to Top]

The information contained in this document represents the current view of Microsoft Corporation on the issues discussed as of the date of publication. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information presented after the date of publication.

This White Paper is for informational purposes only. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS DOCUMENT.

Complying with all applicable copyright laws is the responsibility of the user. Without limiting the rights under copyright, no part of this document may be reproduced, stored in or introduced into a retrieval system, or transmitted in any form or by any means (electronic, mechanical, photocopying, recording, or otherwise), or for any purpose, without the express written permission of Microsoft Corporation.

Microsoft may have patents, patent applications, trademarks, copyrights, or other intellectual property rights covering subject matter in this document. Except as expressly provided in any written license agreement from Microsoft, the furnishing of this document does not give you any license to these patents, trademarks, copyrights, or other intellectual property.

© 2004 Microsoft Corporation. All rights reserved.

Microsoft, ActiveX, Visual Studio, Windows, and Windows Server are either registered trademarks or trademarks of Microsoft Corporation in the United States and/or other countries.

The names of actual companies and products mentioned herein may be the trademarks of their respective owners.