Re: Problem with Protocol Transition

I did a little digging and discovered that this error occurs because an
internal call to the Windows API LsaGetLogonSessionData returns the HRESULT
0xC0000022, which translates to this Windows error message:

# for hex 0xc0000022 / decimal -1073741790 :
STATUS_ACCESS_DENIED ntstatus.h
# {Access Denied}
# A process has requested access to an object, but has not
# been granted those access rights.

I don't know why that would be the case for an S4U logon token though. Are
you impersonating the token when that happens? It might be some weird
artifact of S4U. Also, is the S4U token generated with Impersonate or
Identity level?

Joe K.
--
Joe Kaplan-MS MVP Directory Services Programming
Co-author of "The .NET Developer's Guide to Directory Services Programming"
http://www.directoryprogramming.net
--
"Iain Mcleod" <IainMcleod@xxxxxxxxxxxxxxxxxxxxxxxxx> wrote in message
news:A29AA6A0-C8F0-4584-8A02-A63FDA0801D6@xxxxxxxxxxxxxxxx
Hi

I'm using protocol transition to create user accounts in an ASP.NET
context.
The login seems to be working ok, but I'm getting a nasty security
exception
"Attempted to perform an unauthorized operation" (see stacktrace).
I get the same error message in the debugger when I quick watch
httpcontext.current.user.identity, AuthenticationType property (it's a
WindowsIdentity with name=CONTOSO\Administrator and IsAuthenticated=True).


(In the code example, request is a HttpWorkerRequest object and
GetUserName() function returns a username of the form "user@xxxxxxxxxx")

The wierd thing is that there only seems to be a problem with an identity
constructed using protocol transition (i.e. the following):

Dim user as WindowsIdentity = New
WindowsIdentity(GetUserName(request.GetServerVariable("LOGON_USER")))

If I construct the user using NTLM it works perfectly:
Dim user as WindowsIdentity = New WindowsIdentity(request.GetUserToken(),
request.GetServerVariable("AUTH_TYPE"), WindowsAccountType.Normal, True)

Here is the exception I get:

----------------------------------------------------------
Attempted to perform an unauthorized operation.
at System.Security.Principal.WindowsIdentity.get_AuthenticationType()
at
System.Web.HttpRequest.CalcDynamicServerVariable(DynamicServerVariable
var)
at System.Web.HttpServerVarsCollectionEntry.GetValue(HttpRequest
request)
at System.Web.HttpServerVarsCollection.GetServerVar(Object e)
at System.Web.HttpServerVarsCollection.Get(Int32 index)
at System.Web.HttpServerVarsCollection.GetValues(Int32 index)
at
System.Collections.Specialized.NameValueCollection.Add(NameValueCollection
c)
at System.Web.HttpRequest.FillInParamsCollection()
at System.Web.HttpRequest.GetParams()
at System.Web.HttpRequest.get_Params()
----------------------------------------------------------------

Any ideas anyone?

Thanks
Iain Mcleod



.

Relevant Pages

  • Re: Problem with Protocol Transition
    ... I'm just setting httpcontext.current.user to be a new WindowsIdentity object. ... Can't seem to see any params relating to Impersonate ... request is a HttpWorkerRequest object and ... Dim user as WindowsIdentity = New WindowsIdentity, ...
    (microsoft.public.dotnet.framework.aspnet.security)
  • Re: WindowsIdentity role caching in ASP.NET
    ... Make a request that authenticates as a user who is NOT a member of the ... IsInRole returns false and an appropriate error is thrown. ... Logon session, and that Logon sessions for a particular user seem to persist ... >> Sorry, I obiously meant WindowsPrincipal, not WindowsIdentity. ...
    (microsoft.public.dotnet.security)
  • Re: WindowsIdentity role caching in ASP.NET
    ... I wasn't suggesting that every new request was getting a new token, ... that they were getting a new .NET WindowsIdentity and WindowsPrincipal to ... Close the browser and open a new browser instance, ... > Logon session, and that Logon sessions for a particular user seem to ...
    (microsoft.public.dotnet.security)
  • Re: get WindowsIdentity with forms authentication
    ... Logon using API call to get a token, create a new WindowsIdentity Object and ... Then i use global.asax to change the identity for every request ... > to the User property of HttpContext it get's assigned for the current ...
    (microsoft.public.dotnet.framework.aspnet.security)
  • Re: WindowsAuthentication from code
    ... Logon using API call to get a token, create a new WindowsIdentity Object and ... > involving chalenge/response or basic authentication. ... > IsAuthenticated becomes true) but lasts only for the current request. ...
    (microsoft.public.dotnet.framework.aspnet.security)