We are using DNN v4.9.0 w/ AD Provider 1.0.4. We get the "passord is case sensitive" message when trying to login with the Windows Login. The site log table has an General Exception entry as follows:

<LogProperties><LogProperty><PropertyName>AssemblyVersion</PropertyName><PropertyValue>04.09.00</PropertyValue></LogProperty><LogProperty><PropertyName>PortalID</PropertyName><PropertyValue>0</PropertyValue></LogProperty><LogProperty><PropertyName>PortalName</PropertyName><PropertyValue>FIXINTRANET</PropertyValue></LogProperty><LogProperty><PropertyName>UserID</PropertyName><PropertyValue>-1</PropertyValue></LogProperty><LogProperty><PropertyName>UserName</PropertyName><PropertyValue /></LogProperty><LogProperty><PropertyName>ActiveTabID</PropertyName><PropertyValue>36</PropertyValue></LogProperty><LogProperty><PropertyName>ActiveTabName</PropertyName><PropertyValue>Home</PropertyValue></LogProperty><LogProperty><PropertyName>RawURL</PropertyName><PropertyValue>/Home/tabid/36/ctl/Login/Default.aspx?returnurl=%2fdefault.aspx</PropertyValue></LogProperty><LogProperty><PropertyName>AbsoluteURL</PropertyName><PropertyValue>/Default.aspx</PropertyValue></LogProperty><LogProperty><PropertyName>AbsoluteURLReferrer</PropertyName><PropertyValue>http://new.fixintranet.com/Home/tabid/36/ctl/Login/Default.aspx?returnurl=%2fdefault.aspx</PropertyValue></LogProperty><LogProperty><PropertyName>UserAgent</PropertyName><PropertyValue>Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.0.5) Gecko/2008120122 Firefox/3.0.5</PropertyValue></LogProperty><LogProperty><PropertyName>DefaultDataProvider</PropertyName><PropertyValue>DotNetNuke.Data.SqlDataProvider, DotNetNuke.SqlDataProvider</PropertyValue></LogProperty><LogProperty><PropertyName>ExceptionGUID</PropertyName><PropertyValue>3df3b74d-3fbd-40a6-896d-507ea4c1486e</PropertyValue></LogProperty><LogProperty><PropertyName>InnerException</PropertyName><PropertyValue>Object reference not set to an instance of an object.</PropertyValue></LogProperty><LogProperty><PropertyName>FileName</PropertyName><PropertyValue /></LogProperty><LogProperty><PropertyName>FileLineNumber</PropertyName><PropertyValue>0</PropertyValue></LogProperty><LogProperty><PropertyName>FileColumnNumber</PropertyName><PropertyValue>0</PropertyValue></LogProperty><LogProperty><PropertyName>Method</PropertyName><PropertyValue>DotNetNuke.Authentication.ActiveDirectory.ADSI.ADSIProvider.GetUser</PropertyValue></LogProperty><LogProperty><PropertyName>StackTrace</PropertyName><PropertyValue /></LogProperty><LogProperty><PropertyName>Message</PropertyName><PropertyValue>System.NullReferenceException: Object reference not set to an instance of an object.     at DotNetNuke.Authentication.ActiveDirectory.ADSI.ADSIProvider.GetUser(String LoggedOnUserName, String LoggedOnPassword)</PropertyValue></LogProperty><LogProperty><PropertyName>Source</PropertyName><PropertyValue /></LogProperty></LogProperties>

The environment has 2 domains. A root domain and the child domain with the user/group objects in the child domain as well as the web server. We have tried different accounts in the AD Provider configuration and only child domain accounts can access (I believe due to trust reasons).

Accessing Global Catalog:
OK
Checking Root Domain:
OK
Accessing LDAP:
OK
Find all domains in network:
2 Domain(s):
***.loc (***)
root.loc (ROOT)

We have set the DesktopModules\AuthenticationServices\ActiveDirectory\windowssignup.aspx file in IIS as per the documentation. We also have commented out the Authentication line from the httphandlers in the web.config. However, when we try to login with the Windows Signin, we get the error message as above. If I uncomment the Authentication line in the web.config, we get the standard browser popup window to login with. However, we do not want to use this. This is an extranet site and want to use the DNN Windows Signin form.

I have also tried the Impersonate setup in the web.config, but this does not resolve this issue.

Don't know if this would help anyone, but we ran into an authentication issue that took a while to figure out the cause.  From my research on web, the cause of authentication issues varies.



Our issue had to do with the Domain Controller bound to the web server hosting our DNN Website.  We have a forest of DCs some hosted in house and others hosted at a colocation.  The web server hosting the DNN site is hosted in house.



So, our issue had to do with the round robin effect of the web server acquiring a DC hosted in house (AD Provider worked) and a DC in colocation (AD Provider Failed).



For some reason I have yet to figure out, when the web server is bound to a remote DC controller, the DNN Active Directory provider cannot read properties of the DC when searched using GC ("GC://rootDSE").  It is able to see the GC on remote site, but cannot retreive the result set.  LDAP is available and authentication happends.



The curios part is that if you reconfigured the DNN instance and IIS to force the IIS logon dialog, it is able to authenticate. That indicates to mee that NTLM and LDAP are accessible to IIS to authenticate.



I am working with our System Administrator to figure out why the remote DC is able to authenticate, but it is not able to read properties from.  At a glance, we looked at permission differences between in house DCs and the colo DCs, but they are all the same.



For now, our temporary solution is to force the AD DNN Provider to look at specific domain site for DCs to authenticate against.  We had to modify the AD DNN Provider by adding a new property to provide the site name, and we added a simple routine to retreive a DC server name within the specified site.  In this routine, we added a check to the bound DC server to see if it is in the specified site, if it is, then we let the provider use that server.  If no site name is provided, the provider will behaive as it normally would.  That is, it will use whatever DC is bound to the web server.



Again, the above experience is shared to show that it may not necessarely be an issue directly with the DNN Prrovider but it can be impacted by the Domain configuration.  The part I am trying to understand is why doesn't work using remote DCs.



Hope this helps anyone!