Impersonation Level problem using .NET calls

[the_mitten]

Interesting. Yes, please update with the result on a different system.

Just to be clear, is it important that you connect to the server with a secure remoting channel? 

Does your account have any user account controls? Or any network security settings? 

Regards,

[ferencr]

Hi Michael,

I don't think it's important for me in particular for the remoting channel to be secure, but it is something that I have no control of. The need for a secure remoting channel is built into Zemax Opticstudio or the Zemax API. That is something only Zemax could change. The Zemax engineer said they had never run into this issue with other programming languages, and he did not seem willing to entertain the possibility of such a change to eliminate the need for a secure remoting channel.

I tried connecting on my home computer as well. I get the same exact error.

Work computer: Windows 10 Home, LabVIEW 2015 SP1 32-bit (also tried LabVIEW 2016 64-bit), no domain

Home computer: Windows 7 Home Premium 64-bit, LabVIEW 2014 SP1 32-bit, no domain

I did not change any DCOM settings on my home computer, because the default was already at connect / identify.

At your recommendation I tried to turn off user account control temporarily, but it did not help. On both the home and work computers I am administrator with no other account with higher priveleges (no IT). They both use only Windows Firewall, which I have tried turning off already, also no difference.

[SamuRei]

Ferenc,

I am looking through this thread and have a quick clarification of my own. I was confused by this part of a previous post:

As I mentioned earlier, even if all DLL calls in a), b), and c) are identical:

a) C# application --> Zemax: no error

b) LabVIEW application --> Zemax: Cannot open anonymous level security token

c) LabVIEW application --> C# DLL --> Zemax: Cannot open anonymous level security token

---

Could you clarify how exactly you are calling into Zemax? Are you calling into is as an assembly or source code that you are calling from either application?

Cheers,

[ferencr]

Hi Sam,

Here is some detail to clarify what is happening.

Zemax has 3 DLLs that are used to interface with it: ZOSAPI.dll, ZOSAPI_Interfaces.dll and ZOSAPI_NetHelper.dll . After a connection is established, Zemax is controlled with function calls through an instance of an IZOSAPI_Application class. ZOSAPI stands for Zemax Opticalstudio API.

First an instance of ZOSAPI_Initializer class is initialized, which reports true for "Initializer Initizialize success".

Then an instance of the ZOSAPI_Connection class is initialized successfully.

The function call ZOSAPI_Connection.CreateNewApplication() launches a new instance of the Zemax Opticstudio application in a new thread, then it attempts to establish a connection to this application.

The application launches, but in case b) and c) it fails to create a connection to it, and this results in the "Cannot open an anonymous level security token" error. In case a), a working IZOSAPI_Application class reference is returned and Zemax can be controlled through it. Between cases a) and c) the C# source code that relates to ZOSAPI is identical.

Thanks for looking at this,

Happy New Years!

Ferenc

[yea_likethecity]

Hi Ferencr,

Building on what you mentioned earlier, we think it might be a good step to try and reinstall whichever product was installed last. There might be some dependency between the installations that would benefit from a reinstallation. 

[ferencr]

Here is some additional evidence supporting my theory that LabVIEW is unable to connect using a secure DCOM connection, only an insecure one:

From: DCOM Settings for the Local Computer for Accessing Synchronization Objects Remotely

You must also disable DCOM authentication for the client application if it is not the TestStand Sequence Editor (SeqEdit.exe) or one of the TestStand User Interfaces named testexec.exe. For client applications built with LabVIEW, disable DCOM authentication for the application by adding the following line to the INI file associated with the application, as in yourclient.ini where yourclient.exe is the name of your application:

ole.AuthnLevel=1

For all other client applications, disable DCOM authentication for the application by adding the following registry entry, where yourclient.exe is the name of your application:

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\yourclient.exe]"AppID" ="{C31FD07F-DEAC-4962-9BBF-092F0F3BFF3C}"

Unfortunately adding the registry key for OpticStudio.exe did not help. The reason may be that it is explicitly stated in the Zemax API that a secure connection is required.

[yea_likethecity]

Hi ferencr,

Could you post the LabVIEW code or a screenshot where you are calling the Zemax API? I would like to get deeper into this issue and I understand the many troubleshooting steps we've tried so far, but I'd like to see specifically how the Zemax API is being calling in LabVIEW.

[ferencr]

Hi Austin,

Attached you will find screenshots and source code for all of the following configurations:

A) C# Application connecting to Zemax   -   success

B) LabVIEW Application connecting to Zemax   -   error

C) LabVIEW Application connecting to Zemax through an interface DLL   -   error

A) and C) source code where they connect to Zemax are identical, yet A) succeeds and C) fails.

Let me know if there is anything else that could help diagnose.

Thank you,

Ferenc

[Steffen.Frey]

Could you link the vi you are using to Initialize the .net connection to ZOS-API and a simple example, like reading the serial number of Opticstudio?

[ferencr]

Hi Steffen,

Are you trying to use LabVIEW with ZOS-API? I have determined that they are incompatible.

Zemax requires security using the protocol for the IpcServerChannel and IpcClientChannel.

LabVIEW does not support security with the IpcServerChannel and IpcClientChannel.

There is no way for you to get them working without violating OpticStudio EULA.