Re: Framework v1.1 & LogonUser workaround

From: Bill Belliveau (anonymous_at_discussions.microsoft.com)
Date: 01/27/04 

Date: Tue, 27 Jan 2004 08:46:06 -0800

Joe, thanks for the info it does help, mostly to let me know I'm on the right track.
I am curious though, which WindowsIdentity constructor takes a username/password? I didn’t see any constructors or examples. Even though we are targeting 2003, that would seem like a better method rather than calling unmanaged code (even though the same thing happens behind the curtain).

Bill
     
     ----- Joe Kaplan (MVP - ADSI) wrote: -----
     
     In many ways, this is an OS issue. Win2K generally only lets the SYSTEM
     account call LogonUser, as that is the only account by default with the
     SE_TCB_NAME privilege (act as part of the OS), and that is a good thing. In
     WinXP and 2003, LogonUser no longer requires SE_TCB_NAME, so many more
     accounts may call it.
     
     Framework 1.1 helps with this situation in that there is a nice overload on
     the WindowsIdentity constructor that creates a new WindowsIdentity from
     username/password, but it still doesn't defeat OS security rules.
     
     The best thing you could do from a security perspective is move to 2K3
     server so that you can call LogonUser without any real issues. On 2000, you
     must run as SYSTEM (or given another account SE_TCB_NAME, essentially making
     it SYSTEM if it wants to be) to do what you want. ASP.NET and IIS let you
     do this, but it is better to avoid it.
     
     The other thing to do would be to move away from Forms auth. so that you can
     let IIS do the authentication for you, but that doesn't sound like what you
     want.
     
     I'm not sure if I helped, but hopefully this was useful.
     
     Joe K.

Relevant Pages

  • RE: Sysprepd image, event 10020
    ... > "Joe" wrote: ... and included IIS. ... > The problem seems to be the IWAM account. ... account has also been added by the sysprep process. ...
    (microsoft.public.windowsxp.setup_deployment)
  • RE: Sysprepd image, event 10020
    ... >> "Joe" wrote: ... and included IIS. ... >> The problem seems to be the IWAM account. ... account has also been added by the sysprep process. ...
    (microsoft.public.windowsxp.setup_deployment)
  • Re: Unlock acct permissions
    ... Joe is one of the best in the world. ... How do I get DSACLS to run on a specific account? ... The permissions in the security do not seem>>> to ... The correct permissions are on the security group, ...
    (microsoft.public.win2000.active_directory)
  • Re: Unlock acct permissions
    ... It may actually be the best of the bunch but it is very old now so it is mostly about those GOOD FUNDAMENTALS that one needs and which Joe referenced. ... >>>Overall you appear to be a very "green" admin and you should buy one or more>>>books and learn this stuff before you do too much more. ... >>>Joe Richards Microsoft MVP Windows Server Directory Services ... How do I get DSACLS to run on a specific account? ...
    (microsoft.public.win2000.active_directory)
  • Re: Service running as Local system account Unable to map drive on
    ... Hi Joe and Phillip ... account has full permissions on both the share and the file system itself. ... Security Eventlog: ...
    (microsoft.public.security)