Re: Impersonation and accessing Windows file share

My understanding is that this is correct. However, in this case she was
calling LogonUser explicitly to use a service account to access the file
share. From what I can tell by the docs, you can't use LOGON_NETWORK for
that type of logon as it doesn't cache credentials.

I'm not actually sure what happens when you do Kerberos auth with IWA,
except that I assume that IIS calls AcceptSecurityContext instead of
LogonUser and something different happens under the hood. I really don't
know what the mechanics of those differences are.

In any event, it seems to have worked... :)

Joe K.

"Dominick Baier [DevelopMentor]" <dbaier@xxxxxxxxxxxxxxxxxxxxxxxxxxxxx>
wrote in message news:4580be631992128c82307beee8adb@xxxxxxxxxxxxxxxxxxxxx
correct me if i am wrong - but when delegation is configured, NETWORK
logons do have network credentials ??!

---------------------------------------
Dominick Baier - DevelopMentor
http://www.leastprivilege.com

I think I see your problem. You are using LOGON32_LOGON_NETWORK, but
if you read the docs for LogonUser in MSDN carefully, you'll see that
this type of logon doesn't have network credentials. You probably
should switch to LOGON32_LOGON_NETWORK_CLEARTEXT.

Joe K.



.

Relevant Pages

  • Re: LogOnUser with Smart Card Credentials
    ... from the Windows logon dialog and serves our application only). ... call LogonUser with the credentials provided in the dialog. ... The card needs to be present to verify the PIN and also to obtain a token. ...
    (microsoft.public.platformsdk.security)
  • Re: LogOnUser with Smart Card Credentials
    ... from the Windows logon dialog and serves our application only). ... call LogonUser with the credentials provided in the dialog. ... The card needs to be present to verify the PIN and also to obtain a token. ...
    (microsoft.public.platformsdk.security)
  • Re: Remote system access
    ... >> That Service at some point does a LogonUser and ImpersonateLoggedOnUser ... >> to log on as a service, if the SERVICE logon type is selected. ... It is some box in the network, ... >> permissions or rights for the DsGetDcName to successfully be executed by ...
    (microsoft.public.win32.programmer.networks)
  • Re: Impersonation and accessing Windows file share
    ... logon doesn't have network credentials. ... However, on the file server, the event log shows that the user is ... Private Declare Auto Function LogonUser Lib "advapi32.dll" (ByVal ... Dim handle As IntPtr = New IntPtr ...
    (microsoft.public.dotnet.framework.aspnet.security)
  • Re: VB NetAPI User Account Validation
    ... LogonUser does a local logon for a user. ... > (ByVal lpszUsername As String, ByVal lpszDomain As String, ByVal ... > rtn = NetUserChangePassword(StrConv(Domain, vbUnicode), StrConv(UserName, ...
    (microsoft.public.vb.winapi)