Re: LogonUser from ASP.NET

sgelfmann_at_yahoo.com
Date: 01/26/05 

Date: 26 Jan 2005 13:01:44 -0800

There's an article that you might find helpful:
http://www.devx.com/SummitDays/Article/6666/0/page/1

If fact it mentions this on page 2:
"Since the worker process normally runs as ASPNET (with very few
privileges), this attempt to elevate privileges will fail. ".

laimis wrote:
> COM+ application is running under the priviledged account so that the
> LogonUser could be invoked.
>
> I do call impersonate with the token received.
>
> I was just wondering if the impersonization was done on one thread
that COM+
> is running under and the ASP.NET request handling thread was not
affected by
> the impersonization since i call impersonate in the COM+ component.
>
> I tried returning the Identity object that was created using the
token
> obtained from the LogonUser and then calling Impersonate from ASP.NET
app.
> However I would get error message saying that impersonation not
allowed and
> that web config should be modified or security setting for the
application
> chagned. What should I change in the config file to allow ASP.NET app
to
> call Impersonate?
>
> Laimis
>
> "Joe Kaplan (MVP - ADSI)" <joseph.e.kaplan@removethis.accenture.com>
wrote
> in message news:esa6u7yAFHA.3376@TK2MSFTNGP12.phx.gbl...
> > Also, after you call LogonUser, do you take the resulting token and
> > impersonate it?
> >
> > Joe K.
> >
> > "Paul Clement" <UseAdddressAtEndofMessage@swspectrum.com> wrote in
message
> > news:05cdv0tr1hbhft9b56vh8eqp5j2d8c7aoe@4ax.com...
> > > On Tue, 25 Jan 2005 10:37:39 -0600, "laimis"
<simulai@NOSPAMiit.edu>
> > > wrote:
> > >
> > > ¤ Hello everybody,
> > > ¤
> > > ¤ this is rather complicated, but intriguing problem that I have
been
> > > having.
> > > ¤ What I want to do is: after user connects to my asp.net
application, I
> > > want
> > > ¤ to elevate the thread's user from ASPNET to let's say
administrator so
> > > that
> > > ¤ priviledged operation could be performed. I don't want to
change
> account
> > > ¤ under which ASP.NET runs. My idea is to impersonate in COM+
app that
> > > runs
> > > ¤ under priviledged account.
> > > ¤
> > > ¤ Currently here is how I have it implemented.
> > > ¤
> > > ¤ 1. HttpModule intercepts the request for the application.
> > > ¤ 2. Module calls COM+ app that runs with priviledged account
> > > ¤ 3. COM+ app calls LogonUser to obtain security handle which
later is
> > > used in
> > > ¤ creating windows identity and impersonaiting the identity,
thus
> > > receiving
> > > ¤ context.
> > > ¤ 4. Context is returned to the module
> > > ¤ 5. Module uses it to assign to the current context of the
executing
> > > thread
> > > ¤
> > > ¤ All of the steps work just fine. I call LogonUser, I can see
in the
> > > security
> > > ¤ log the succesful audit event. However, the context assigned
doesn't
> > > make a
> > > ¤ difference to the running thread and the thread's user still
returns
> > > ASPNET.
> > > ¤
> > > ¤ Does anyone see a problem with my method?
> > > ¤
> > >
> > > Not sure if I understand your configuration completely. Is the
> privileged
> > > operation being performed
> > > by the COM+ application? From your description is appears that
the COM+
> > > application is already
> > > running under a privileged account.
> > >
> > >
> > > Paul ~~~ pclement@ameritech.net
> > > Microsoft MVP (Visual Basic)
> >
> >

Relevant Pages

  • Re: ASP.NET Forms Authentication & LogonUser API
    ... Did you impersonate the token you received as a result of the call to ... current thread's security context execute as the returned token. ... I am using both of above in my ASP.Net app. ... To use the LogonUser API i have to add the ASPNET account to the Local ...
    (microsoft.public.dotnet.security)
  • Re: Logon broker
    ... be wise to have the current thread impersonate and adjust the privileges in ... Ok, if you have been granted the required privileges, then you ... his/her security context, thus, the API ImpersonateLoggedOnUser() ... would allow the calling thread to impersonate the user, ...
    (microsoft.public.win32.programmer.kernel)
  • Re: opening files on file shares with different username/passwords
    ... you can impersonate that user and try and open the file. ... LogonUser(), ImpersonateLoggedOnUser. ... > users using the app access to the share just my app. ...
    (microsoft.public.win32.programmer.networks)
  • Re: Role-based security / Impersonation with ASP.NET Question
    ... You really don't need to impersonate or elevate the priviliges of the ASPNET ... Authenticate Against the Active Directory by Using Forms ... Impersonation is less important in ASP.NET, if you use role based security ... > insufficient privileges to call LogonUser. ...
    (microsoft.public.dotnet.framework.aspnet.security)
  • Re: Logon broker
    ... There is no need to impersonate. ... You dont need to enable the privileges yourself (if you enable userenv ... need to enable them before using the API calls, simply because, ... for the calling thread to execute the process accordingly. ...
    (microsoft.public.win32.programmer.kernel)