Re: impersonation in a sub thread

From: charlie (charlie_at_nunya.com)
Date: 11/08/03 

Date: Fri, 07 Nov 2003 23:59:20 GMT

Christian,

I am quite aware of your pain with this issue. This is a problem for which
I was unable to find a solution while working within the context of the web
server (the ASPNET process).

If you want to solve this issue quickly and with the desired effect, I would
point you in the same direction some others on this group pointed me - COM+.
A COM+ server runs outside the ASPNET context and can assume any identity
you would like it to assume. It is very robust and has good security
associated with it. I was able to solve in one day a problem I had been
battling for more than a week by just taking my code out of the services
application and creating a COM+ application.

Charlie
"Christian" <anonymous@discussions.microsoft.com> wrote in message
news:04b701c3a259$b40b89f0$a501280a@phx.gbl...
> When you create a new thread it inherits the original
> security context of the parent process.
> E.g. when a webapplication that is set to impersonate
> some domain account creates a new thread, the new thread
> runs as the original user (e.g. localmachine\ASPNET) not
> the user the application is impersonating.
>
> Does anyone know how to create a thread and make it
> impersonate the same user as the parent process is
> impersonating?
>
> I tried making the child thread explicitely impersonate
> the domain user, but it was not able/allowed to.
>
> Basically I am doing
>
> WindowsIdentity _winID;
> public static void StartThread()
> {
> // runs as domain user set to impersonate in web.config
> // or IIS control
> _winID = WindowsIdentity.GetCurrent();
> Thread _thread = new Thread(_threadStart);
>
> _thread.Start();
> }
>
> private static void DoWork()
> {
> //runs as localbox\ASPNET
>
> // fails with "Unable to impersonate user"
> _winID.Impersonate();
>
> // more code supposed to run as impersonated user
> }
>
>
> It succeeds when I set asp to run as SYSTEM. (in set
> <processModel userName="SYSTEM"> in machine.config)
>
> http://support.microsoft.com/default.aspx?scid=kb;en-
> us;Q306158
>
> indicates that the process would need the "act as part of
> the OS" privilege.
> After giving that privilege to ASPNET, it still
> impersonation still fails.
>
> Anybody know how I can get the subthread to execute as the
> same (impersonated) user as the web app? Additional
> privileges required for ASPNET? is there a way to start
> the subthread off with the right user?
>
> Thanks
> Christian
>

Relevant Pages

  • impersonation in a sub thread
    ... security context of the parent process. ... E.g. when a webapplication that is set to impersonate ... After giving that privilege to ASPNET, ... Anybody know how I can get the subthread to execute as the ...
    (microsoft.public.dotnet.framework.aspnet.security)
  • ASP and LogonUser
    ... because LocalSystem has that privilege. ... RevertToSelf doesn't work because by default, the IWAM account doesn't ... since even out-of-process apps impersonate the IUSR ... IWAM privilege get the impersonation token for IUSR? ...
    (microsoft.public.inetserver.iis.security)
  • Re: Impersonate
    ... > Looking in the UAF at SYSTEM rights and stuff I see that 'impersonate' is ... You can defend against it by demanding that VMS Development make ... VMS Developers renamed the old DETACH privilege to IMPERSONATE. ...
    (comp.os.vms)
  • RE: CreateProcessWithLogon and managed Processes
    ... the Process class will try to call the OpenProcess ... To open a handle to another another process and obtain full access rights, ... you must enable the SeDebugPrivilege privilege. ... "Unable to Impersonate User" Error Message When You Use ...
    (microsoft.public.dotnet.general)
  • Re: Impersonate user (seteuid/setegid)
    ... These functions, under Linux, allow a high ... impersonate the user, then you switch back to the original context and then ... i.e. have the SE_TCBNAME privilege which is often displayed with the ... an alternative is to use the Security Services Provider ...
    (microsoft.public.vc.language)