FIX: MTS Impersonation Returns Incorrect Caller When Using RDS

MORE INFORMATION

Steps to Reproduce Behavior

1. Open Visual Basic and select the project type to be an ActiveX DLL. Set a reference to Microsoft Transaction Server Type Library (mtxas.dll). Note: MTS and the Microsoft Transaction Server Type Library will work only on Windows versions NT 4.0 and earlier. For Windows 2000 and later, see COM+ (Component Services).
   
   
2. Create a class in the project with the following code:

      Public Function WhoAmI() As String
   
      On Error GoTo handler
      WhoAmI = GetObjectContext.Security.GetDirectCallerName
      Exit Function
   
        handler:
         WhoAmI = "Error"
   
      End Function
   					

3. From the Project menu, select Properties. In the Project Properties dialog box, change the project name to WhoCalled.
4. Change the class name to clsWho.
5. Compile and Save this component.
6. Place the component into an MTS package on your server computer.
   1. To add the component to Microsoft Transaction Server (MTS), open the MTS Management Console.
   2. Expand the Microsoft Transaction Server and then the My Computer directories.
   3. Select Packages Installed, then right-click and select New and Package.
   4. Click Create an Empty Package.
   5. Enter MTSRDS for the package name and click Next.
   6. Click Finish on the following page, accepting the page defaults. You now have a MTS package named MTSRDS.
   7. To add the component to the MTSRDS Package, expand the MTSRDS package and select Components. Right-click and select New and Component.
   8. Click Install New Component, and then select Add File. Locate the Whocalled.dll, select it, and click Open and then Finish.
7. Add the Visual Basic Business Object to the RDS ADCLaunch Key. Add Whocalled.clsWho to the following Registry key:

   HKEY_LOCAL_MACHINE\SYSTEM \CurrentControlSet\Services\W3SVC\Parameters\ADCLaunch

8. Create a Standard EXE client application in Visual Basic using the following code: (Place one command button and one label control on a form.)

        Dim myobj As Object
   
         Private Sub Command1_Click()
   
           label1.Caption = myobj.WhoAmI
   
         End Sub
   
         Private Sub Form_Load()
   
           Set ds = CreateObject("RDS.DataSpace")
           Set myobj = ds.CreateObject("WhoCalled.clsWho", _
                "http://IISServerName")
         End Sub
   					

   NOTE: Change the IISServerName to your IIS Server name.
   
   
9. Go to your server computer. In Internet Information Server (IIS) right-click your default Web Site, and choose properties.
10. Select the Directory Security tab and click Edit. Make sure that Windows NT Challenge/Response is the only thing selected. Click OK until you are back to IIS.
11. Run the client as User A. Clicking on the Command button will return the User ID.
12. Have User B run the same client application. RESULTS: User A gets their own ID back from the Server as expected. User B incorrectly gets User A's ID.