ActiveDirectoryMembershipProvider "The specified domain or server could not be contacted" AFTER changing to Comcast

Question

My company recently changed from a dedicated T-1 to a broadband business Comcast connection. Immediately after, this problem began.

Our development machines are local, but our Active Directory server (used for testing and staging the product before deployments) is a public cloud instance located at Rackspace. The dev machines are NOT connected to the domain.

We use the ActiveDirectoryMembershipProvider, and form based authentication - as well as LDAP queries within the application itself once authentication is complete.

We've been using this configuration for several months - no problems.

After changing to Comcast - everything seems to work correctly, except this. When we try to run the application locally, we get the above error.

Server Error in '/Web.NEPA' Application.
--------------------------------------------------------------------------------

Configuration Error Description: An error occurred during the processing of a configuration file required to service this request. Please review the specific error details below and modify your configuration file appropriately.

Parser Error Message: The specified domain or server could not be contacted.

Source Error:

Line 4: Line 5: Line 7: connectionStringName="LdapService" Line 8: attributeMapUsername="SAMAccountName"

Source File: C:\dev\EMSolution\branches\3.4.0.0\Web.NEPA\App_Config\Testing\3.4.0.0\NEPAARNG\System.Web.Membership.config Line: 6

-------------------------------------------------------------------------------- Version Information: Microsoft .NET Framework Version:2.0.50727.4952; ASP.NET Version:2.0.50727.4955

I have made sure this wasn't a firewall issue on the Rackspace side (by completely turning it off and attempting a connection). I have also created a test program to run an LDAP query against our AD instance - which works perfectly.

--- here's some of the items referenced:

<membership defaultProvider="AspNetActiveDirectoryMembershipProvider">  
   <providers>  
      <add name="AspNetActiveDirectoryMembershipProvider"
     type="System.Web.Security.ActiveDirectoryMembershipProvider, System.Web, Version=2.0.0.0, Culture=neutral,PublicKeyToken=b03f5f7f11d50a3a"         
     connectionStringName="LdapService"
     attributeMapUsername="SAMAccountName"
     connectionUsername="DEV1\emsutil"
     connectionPassword="*****"
     connectionProtection="None"
     requiresQuestionAndAnswer="false"
     minRequiredPasswordLength="4"
     minRequiredNonalphanumericCharacters="0"
     enableSearchMethods="true"/>  
  </providers>  
</membership>  

<connectionStrings>
    <add name="LdapService" connectionString="LDAP://cloud1.dev1/DC=dev1" />
</connectionStrings>

--- Test program that works correctly:

using System;
using System.DirectoryServices;

namespace ldaptest
{
internal class Program
{
    private static void Main(string[] args)
    {
        DirectoryEntry de = new DirectoryEntry();
        de.Path = "LDAP://cloud1.dev1/DC=dev1";
        de.Username = "emsutil@dev1";
        de.Password = "*****";

        DirectorySearcher srch = new DirectorySearcher(de);
        srch.Filter = "(objectClass=user)";

        using (SearchResultCollection results = srch.FindAll())
        {
            foreach (SearchResult res in results)
            {
                Console.WriteLine("\t{0}", res.Path);
            }
        }

        Console.ReadKey();
    }
}
}

Answer 1

I've seen similar problems before, and I think that Comcast might be the source of your problem.

Comcast has a "feature" called Domain Helper that intercepts requests to invalid domain names and instead serves up a page that suggests alternatives, shows some ads, etc. (Basically, it breaks DNS in order to make a few dollars on advertising.)

Your request is likely getting interference from the Domain Helper service. While it would normally get no response from the internet and fall back to local network to find the server, it will instead get a "valid" response from Domain Helper. Of course, the response is not at all what your code is expecting, thus an exception is thrown.

There are various methods to turn Domain Helper off, but your best bet might be to call them. You can also try looking at http://dns-opt-out.comcast.net/ and http://dns.comcast.net/ for further debugging resources.