Impersonation and UNC network resources

From: Colin Nicholls (colin_at_spacefold.com)
Date: 03/08/05 

Date: Tue, 8 Mar 2005 12:43:00 -0800

Hi guys -

I've been getting knotted up with this for a few days now. Originally I was
in an ASP.NET context (using VFP8 OleDB to access tables located on a
network fileshare from inside of ASP.NET) but after much simplification and
reduction, I've reduced my question to a simple .NET console application.
The two tests I'm using in the console applications are: a) dirInfo on a
network folder (as per the example) and b) an VFP8 OleDB connection.

Excuse me for asking this question here in the aspnet.security when it could
be a more generic problem, but there have been some great minds answering
here...

Anyway. I based my code on this excellent sample:
http://www.netomatix.com/ImpersonateUser.aspx. It's using LogonUser() to
impersonate a known DOMAIN\user with appropriate permissions.

(I know the user credentials are fine, if for no other reason than because
if I set up ASP.NET to impersonate the user, I have no problems, providing I
don't cause ASP.NET to recompile the ASPX files. If I update the aspx files,
I get an exception on the compiler permissions. I guess the impersonated
user doesn't have appropriate rights.)

I've stepped through the code and observed two things:

On my laptop - a Windows XP Pro machine not part of the domain - the
LogonUser() succeeds, but the directory code:

    System.IO.DirectoryInfo dirInfo = new
System.IO.DirectoryInfo(@"\\SERVERNAME\sharename\folder");
    Console.WriteLine( dirInfo.Exists );
    string strFolderToCreate = @"\\SERVERNAME\sharename\folder" + "\\" +
"boogle";
    System.IO.Directory.CreateDirectory(strFolderToCreate);

I get:

    False
    Error: Could not find a part of the path "\\SERVERNAME\sharename".

The Vfp OleDb code generates a "invalid path or filename" exception which I
recognise from my regular VFP apps when directories aren't visible.

Interestingly, when I run the console app on a different machine, Windows
2000 SP3 which *is* on the DOMAIN, the LogonUser() fails with error 1314 -
"A required privilege is not held by the client".

I understand that on Wind2k I would have to allow this user account to "act
as part of the operating system" - which I did, but it didn't seem to make
any difference. Do I need to reboot???

But apart from that - why would LogonUser() say it succeeded, but my code is
still prevented from accessing the resources it needs?

Question 2 is, I guess, is if this is insolveable, and instead of using
custom impersonation code in my aspx.cs files, I *have* to use the
web.config <impersonate true, user, DOMAIN> etc, then why does the recompile
fail?

If I'm being an idiot, please let me know.

Thanks in advance,
- Colin

Relevant Pages

  • Re: Remote call to COM impersonating another user
    ... When I call LogonUser, it fails, I think because the domain I need to log ... the local domain it works fine - I become the other user when I impersonate ... This can be done by calling "CoInitializeSecurity" using PInvoke, ... IntPtr asAuthSvc, ...
    (microsoft.public.dotnet.languages.csharp)
  • Re: Impersonate User
    ... > Private Function GetUserDetailsas String ... > Dim arrName() as String ... application or a stand-alone application) am I likely to want to impersonate ... hosting the aspx files get a "Enter Network Password" dialog box when they ...
    (microsoft.public.dotnet.security)
  • Re: Remote call to COM impersonating another user
    ... When I call LogonUser, it fails, I think because the domain I need to log ... that sends this information to the server and tells it to do this? ... type when calling LogonUser, before calling Impersonate. ...
    (microsoft.public.dotnet.languages.csharp)
  • Re: LogonUser fails across different domains
    ... You shouldn't be able to log on as a user from an untrusted domain (except ... And you shouldn't need to do an impersonate to access files on a ... > LogonUser() fails if the user is in a domain ... > different from that with which the executing process is running as. ...
    (microsoft.public.platformsdk.security)
  • Re: Running sysinternals PSPASSWD.exe from local system account
    ... skip over eveything except the local computer? ... Call LogonUser and impersonate, ... Its stdout and stderr can be captured: ...
    (microsoft.public.win2000.security)