Re: refreshing windowsidentity for user group changes

Are you saying that you use the WindowsIdentity constructor that just takes
the UPN (single string)? In that case, you are using the Windows "protocol
transition" (Kerberos S4U) to create the token.

My understanding is that the local security authority caches the S4U token
to provide better performance. If there was a way to change this caching
behavior, it would likely be via a registry setting. You might do some
searches along those lines.

The .NET stuff here is really just a thin wrapper around the LsaLogonUser
Windows API call and doesn't control this behavior at all.

Joe K.

--
Joe Kaplan-MS MVP Directory Services Programming
Co-author of "The .NET Developer's Guide to Directory Services Programming"
http://www.directoryprogramming.net
--
"zee" <zee@xxxxxxxxxxxxxxxxx> wrote in message
news:15B59E1A-6BF4-4030-AD90-7AAC4C56D09D@xxxxxxxxxxxxxxxx
I have a custom application that creates the windowsidentity from user UPNs
and uses it to perform authorization. if a user is removed from an AD
group
while the application is running, the application disposes the
windowsidentity and creates a new one but the windowsidentity.Groups still
contains the user group that the user was removed from. Are the
token/groups
for a user cached? If so, how can we get rid of it so as to reflect the
change immediately?


.

Relevant Pages

  • Re: ASP.NET 2.0 WindowsTokenRoleProvider Local Groups Broken
    ... Joe Kaplan-MS MVP Directory Services Programming ... Co-author of "The .NET Developer's Guide to Directory Services Programming" ... There is no Group property on the WindowsIdentity object in .NET 2.0, ...
    (microsoft.public.dotnet.framework.aspnet.security)
  • Re: searching what groups a user belong from AD but errorThe Kerberos subsystem encountered an error
    ... tokenGroups to simulate what the protocol transition logon is doing. ... Joe Kaplan-MS MVP Directory Services Programming ... Co-author of "The .NET Developer's Guide to Directory Services Programming" ... WindowsIdentity id = HttpContext.Current.User.Identity; ...
    (microsoft.public.dotnet.framework.aspnet.security)
  • Re: Impersonating when creating a process from inside a SQL Server Assembly
    ... Joe Kaplan-MS MVP Directory Services Programming ... Co-author of "The .NET Developer's Guide to Directory Services Programming" ... the current WindowsIdentity is still WINDOWS SERVICE. ... I'm trying to impersonate a different user when ...
    (microsoft.public.dotnet.security)
  • Re: How to get user company
    ... I believe you mean User Group or User Role. ... You can get a WindowsIdentity from the user running the code with ... WindowsIdentity wi = WindowsIdentity.GetCurrent; ... public static stringGetWindowsIdentityRoles(WindowsIdentity identity) ...
    (microsoft.public.dotnet.languages.csharp)
  • Re: Impersonating when creating a process from inside a SQL Server Assembly
    ... Co-author of "The .NET Developer's Guide to Directory Services Programming" ... I found this article and if you substitute SQL Server for IIS/ASP.NET it ... I can't get this to work either; the DuplicateTokenEx always fails ... the current WindowsIdentity is still WINDOWS SERVICE. ...
    (microsoft.public.dotnet.security)