UserPrincipal.FindByIdentity throws InvalidCastException

[fubar-coder]

Error message

UserPrincipal.Current throws the following exception:

An unhandled exception has occurred while executing the request.
System.InvalidCastException: Unable to cast object of type 'System.DirectoryServices.AccountManagement.GroupPrincipal' to type 'System.DirectoryServices.AccountManagement.UserPrincipal'.
   at System.DirectoryServices.AccountManagement.UserPrincipal.FindByIdentity(PrincipalContext context, IdentityType identityType, String identityValue)
   at System.DirectoryServices.AccountManagement.UserPrincipal.get_Current()

Test scenario

• Create an ASP.NET Core (3.0 preview 7) application
• Create an API controller
• Implement a GET method
• Publish to IIS
• Try to access API via browser (tested with IE preview and FF 68.0.1)
• Enter domain credentials into the login dialog box

Creating a simple console application is not sufficient!

Environment

dotnet --info

.NET Core SDK (gemäß "global.json"):
 Version:   2.1.302
 Commit:    9048955601

Laufzeitumgebung:
 OS Name:     Windows
 OS Version:  6.3.9600
 OS Platform: Windows
 RID:         win81-x64
 Base Path:   C:\Program Files\dotnet\sdk\2.1.302\

Host (useful for support):
  Version: 3.0.0-preview7-27912-14
  Commit:  4da6ee6450

.NET Core SDKs installed:
  2.1.302 [C:\Program Files\dotnet\sdk]

.NET Core runtimes installed:
  Microsoft.AspNetCore.All 2.1.1 [C:\Program Files\dotnet\shared\Microsoft.AspNetCore.All]
  Microsoft.AspNetCore.All 2.1.2 [C:\Program Files\dotnet\shared\Microsoft.AspNetCore.All]
  Microsoft.AspNetCore.All 2.1.5 [C:\Program Files\dotnet\shared\Microsoft.AspNetCore.All]
  Microsoft.AspNetCore.All 2.2.0 [C:\Program Files\dotnet\shared\Microsoft.AspNetCore.All]
  Microsoft.AspNetCore.All 2.2.6 [C:\Program Files\dotnet\shared\Microsoft.AspNetCore.All]
  Microsoft.AspNetCore.App 2.1.1 [C:\Program Files\dotnet\shared\Microsoft.AspNetCore.App]
  Microsoft.AspNetCore.App 2.1.2 [C:\Program Files\dotnet\shared\Microsoft.AspNetCore.App]
  Microsoft.AspNetCore.App 2.1.5 [C:\Program Files\dotnet\shared\Microsoft.AspNetCore.App]
  Microsoft.AspNetCore.App 2.2.0 [C:\Program Files\dotnet\shared\Microsoft.AspNetCore.App]
  Microsoft.AspNetCore.App 2.2.6 [C:\Program Files\dotnet\shared\Microsoft.AspNetCore.App]
  Microsoft.AspNetCore.App 3.0.0-preview7.19365.7 [C:\Program Files\dotnet\shared\Microsoft.AspNetCore.App]
  Microsoft.NETCore.App 2.1.1 [C:\Program Files\dotnet\shared\Microsoft.NETCore.App]
  Microsoft.NETCore.App 2.1.2 [C:\Program Files\dotnet\shared\Microsoft.NETCore.App]
  Microsoft.NETCore.App 2.1.5 [C:\Program Files\dotnet\shared\Microsoft.NETCore.App]
  Microsoft.NETCore.App 2.2.0 [C:\Program Files\dotnet\shared\Microsoft.NETCore.App]
  Microsoft.NETCore.App 2.2.6 [C:\Program Files\dotnet\shared\Microsoft.NETCore.App]
  Microsoft.NETCore.App 3.0.0-preview7-27912-14 [C:\Program Files\dotnet\shared\Microsoft.NETCore.App]

Computer

• Windows Server 2012 R2
• In Domain

IIS

• Enabled authentication mechanisms: Anonymous, Windows

web.config

<?xml version="1.0" encoding="utf-8"?>
<configuration>
  <location path="." inheritInChildApplications="false">
    <system.webServer>
      <handlers>
        <add name="aspNetCore" path="*" verb="*" modules="AspNetCoreModuleV2" resourceType="Unspecified" />
      </handlers>
      <aspNetCore processPath="dotnet" arguments=".\test.dll" stdoutLogEnabled="true" stdoutLogFile=".\logs\stdout" hostingModel="inprocess" />
    </system.webServer>
  </location>
</configuration>

[MarcoRossignoli]

I can repro, some more stack

System.InvalidCastException: Unable to cast object of type 'System.DirectoryServices.AccountManagement.GroupPrincipal' to type 'System.DirectoryServices.AccountManagement.UserPrincipal'.
   at System.DirectoryServices.AccountManagement.UserPrincipal.FindByIdentity(PrincipalContext context, IdentityType identityType, String identityValue)
   at System.DirectoryServices.AccountManagement.UserPrincipal.get_Current()
   at tmp.Controllers.WeatherForecastController.Get() in ...\Controllers\WeatherForecastController.cs:line 30
   at lambda_method(Closure , Object , Object[] )
   at Microsoft.Extensions.Internal.ObjectMethodExecutor.Execute(Object target, Object[] parameters)
   at Microsoft.AspNetCore.Mvc.Infrastructure.ActionMethodExecutor.SyncObjectResultExecutor.Execute(IActionResultTypeMapper mapper, ObjectMethodExecutor executor, Object controller, Object[] arguments)
   at Microsoft.AspNetCore.Mvc.Infrastructure.ControllerActionInvoker.InvokeActionMethodAsync()
   at Microsoft.AspNetCore.Mvc.Infrastructure.ControllerActionInvoker.Next(State& next, Scope& scope, Object& state, Boolean& isCompleted)
   at Microsoft.AspNetCore.Mvc.Infrastructure.ControllerActionInvoker.InvokeNextActionFilterAsync()
--- End of stack trace from previous location where exception was thrown ---
   at Microsoft.AspNetCore.Mvc.Infrastructure.ControllerActionInvoker.Rethrow(ActionExecutedContextSealed context)
   at Microsoft.AspNetCore.Mvc.Infrastructure.ControllerActionInvoker.Next(State& next, Scope& scope, Object& state, Boolean& isCompleted)
   at Microsoft.AspNetCore.Mvc.Infrastructure.ControllerActionInvoker.InvokeInnerFilterAsync()
--- End of stack trace from previous location where exception was thrown ---
   at Microsoft.AspNetCore.Mvc.Infrastructure.ResourceInvoker.<InvokeFilterPipelineAsync>g__Awaited|19_0(ResourceInvoker invoker, Task lastTask, State next, Scope scope, Object state, Boolean isCompleted)
   at Microsoft.AspNetCore.Mvc.Infrastructure.ResourceInvoker.<InvokeAsync>g__Awaited|17_0(ResourceInvoker invoker, Task task, IDisposable scope)
   at Microsoft.AspNetCore.Routing.EndpointMiddleware.<Invoke>g__AwaitRequestTask|6_0(Endpoint endpoint, Task requestTask, ILogger logger)
   at Microsoft.AspNetCore.Authorization.AuthorizationMiddleware.Invoke(HttpContext context)
   at Microsoft.AspNetCore.Server.IIS.Core.IISHttpContextOfT`1.ProcessRequestAsync()

My config is IIS on Win10 in a domain
I'll go on with investigation...

[MarcoRossignoli]

@fubar-coder do you want to have the thread user or the logged-in user?
Because UserPrincipal.Current per guide returns the current user under which the thread is running. in your/my case is app pool identity that in IIS is a virtual account https://docs.microsoft.com/en-us/iis/manage/configuring-security/application-pool-identities
It's true that in case the app pool user is not a domain user that api fails.
Btw if you use User.Identity.Name you'll get authenticated user(domain user after popup login) this is my auth iis setup:

App pool identity a "domain user"(no default ApplicationPoolIdentity)
Some more info on stackoverflow https://stackoverflow.com/questions/11014406/unable-to-cast-object-of-type-in-system-directoryservices-accountmanagement-grou
Maybe api should return null o better exception if current thread is not a "user" but a special scenario
Hope help

[fubar-coder]

Thank you for the information. A better error message would be helpful, I guess.

[orinem]

#38411 is similar and may well have the same cause, but occurs on a plain Windows 10 machine that is logged in with an Azure AD user. ASP.NET and IIS are not involved and a simple console application is sufficient to reproduce the bug.

[ericstj]

@tquerec this doesn't appear to be a regression as the code hasn't been touched here. Is it by design that UserPrincipal would throw in these cases?

Has anyone tested similar behavior in a desktop app?

/cc @joperezr

[ericstj]

#38411 mentions it fails on .NETFramework too. Perhaps something about how user is represented is not handled well by UserPrincipal.

[orinem]

No, there's no regression. It's a case the code doesn't contemplate.

As I tracked down in #38411, for the AzureAD user, it fails to recognize the SID as a user SID.

I didn't track it as far as the invalid cast, but since it thinks the SID isn't a user SID, it's not too surprising it ends up with a GroupPrincipal and that the subsequent cast to a UserPricipal fails.