Re: Multiple Users with impersonation using one account

Hi,

you don't need impersonation to check for user identity - Context.User.Identity.Name is populated with the clients name

is there any other need for impersonation??

you can revert back to process identity by calling WindowsIdentity.Impersonate(IntPtr.Zero) or use LogonUser to get a token for a different user that you can impersonate. But this also requires the password.

Windows Server 2003 also offers Protocol Transition which allows you to get a token without knowledge of the password.

But you should sort out first if impersonation is a requirement.

---------------------------------------
Dominick Baier - DevelopMentor
http://www.leastprivilege.com

Hi All,

I have several intranet applications that use impersonate=true and
anonymous turned off to allow me to check for certain network users to
use the application.  Works great.

However, some applications use resources such as the file system for
writing temporary files, or for opening files on other network
servers.
I don't want to maintain all of the security for each user on each
resource.  Is there a way to specify "when opening this file, don't
use
the credentials of who is logged in, use mydomain\joeuser instead?

Thanks,
Jeff



.

Relevant Pages

  • Re: Total Confusion! - ACLs and Windows authentication with no impersonation
    ... permissions are checked, and not in IIS. ... account - regardless of the impersonation settings. ... You have aspx pages..and you have the resources this page wants to get at. ... When anonymous authentication is disabled, yes the page itself MUST have ...
    (microsoft.public.dotnet.framework.aspnet.security)
  • Re: Total Confusion! - ACLs and Windows authentication with no impersonation
    ... After they have access to the page, if impersonation is disabled, this is when the aspnet user takes over the process, and access to other resourses is granted based on that, not the original user. ... > Client Requested Resources. ... It uses the original caller's access token and ACL ...
    (microsoft.public.dotnet.framework.aspnet.security)
  • Re: Service Account replaced by IUSR ??
    ... I can't think of a reason why the IUSR account would get used here then. ... Co-author of "The .NET Developer's Guide to Directory Services Programming" ... "By using impersonation, ASP.NET applications can execute code or access ... created when you enable impersonation allow you to access local resources ...
    (microsoft.public.dotnet.framework.aspnet.security)
  • Re: Impersonation in non domain member server
    ... first of all you are not forced to use auto impersonation - you can always manually impersonate before you are doing the resource access... ... undo impersonation temporarily when talking to resources that are not "compatible" with impersonation ... remote server located at the DMZ (this is, a non domain member ...
    (microsoft.public.dotnet.security)