Re: Where is the user impersonation token stored?
From: Dominick Baier [DevelopMentor] (dbaier_at_pleasepleasenospamdevelop.com)
Date: 10/10/05
- Next message: Mfenetre: ".Net client and SSL mutual authentication : 403 Forbidden, client certificate not sent"
- Previous message: Gery D. Dorazio: "Where is the user impersonation token stored?"
- In reply to: Gery D. Dorazio: "Where is the user impersonation token stored?"
- Next in thread: Gery D. Dorazio: "Re: Where is the user impersonation token stored?"
- Reply: Gery D. Dorazio: "Re: Where is the user impersonation token stored?"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
Date: Mon, 10 Oct 2005 01:29:46 -0700
Hello Gery,
1) The outcome os IIS authentication is stored in a blob called ISAP Extension
Control Block - the ASPNET_ISAPI extension passes the token to ASP.NET (via
WorkerRequest). This token is availabe in ASP.NET 2.0 using the Request.LogonUserIdentity
2) There is some caching involved in IIS - but ASP.NET grabs the impersonation
token on each request from IIS to populate Context.User.
HTH
---------------------------------------
Dominick Baier - DevelopMentor
http://www.leastprivilege.com
> When a user visits a web site and is authenticated through the popup
> dialog box (Windows authentication) he enters his username and
> password. Evidently this creates the users impersonation token that is
> used on subsequent requests to secured web pages. On subsequent
> requests the WindowsAuthenticationModule is what authenticates on each
> request. The code that does this looks like this:
>
> WindowsIdentity wi = new
> WindowsIdentity(ctx.WorkerRequest.GetUserToken(),
> text2, WindowsAccountType.Normal, true);
> Context.User = new WindowsPrincipal(wi);
> The questions are:
> 1. Where did the initial Windows authentication put the user
> impersonation
> token?
> 2. Where is the user impersonation token stored as the user makes web
> page
> requests(or is it generated on each request and if so how?)?
> Thanks,
> Gery
> EnQue Corporation
> www.EnQue.com
> www.ImagingHardware.com
- Next message: Mfenetre: ".Net client and SSL mutual authentication : 403 Forbidden, client certificate not sent"
- Previous message: Gery D. Dorazio: "Where is the user impersonation token stored?"
- In reply to: Gery D. Dorazio: "Where is the user impersonation token stored?"
- Next in thread: Gery D. Dorazio: "Re: Where is the user impersonation token stored?"
- Reply: Gery D. Dorazio: "Re: Where is the user impersonation token stored?"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
Relevant Pages
|
