Re: LogonUser()
From: Shel Blauman [MSFT] (sheldonb@online.microsoft.com)
Date: 02/21/03
- Previous message: Tim Overbay: "Re: Best Practices for Secure Communications"
- In reply to: Mark K: "Re: LogonUser()"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
From: "Shel Blauman [MSFT]" <sheldonb@online.microsoft.com> Date: Thu, 20 Feb 2003 15:14:27 -0800
That sample will be updated. Here is some later code, give this a try and
see if it helps. I'll include both C# and VB versions.
Shel
****************************************************************************
*************
C#
// This sample demonstrates the use of the WindowsIdentity class to
impersonate a user. // IMPORTANT NOTES:
// This sample can be run only on Windows XP. The default Windows 2000
security policy
// prevents this sample from executing properly, and changing the policy to
allow // proper execution presents a security risk.
// This sample requests the user to enter a password on the console screen.
// Because the console window does not support methods allowing the password
to be masked,
// it will be visible to anyone viewing the screen.
using System;
using System.Runtime.InteropServices;
using System.Security.Principal;
using System.Security.Permissions;
[assembly:SecurityPermissionAttribute(SecurityAction.RequestMinimum,
UnmanagedCode=true)]
[assembly:PermissionSetAttribute(SecurityAction.RequestMinimum, Name =
"FullTrust")] public class ImpersonationDemo {
[DllImport("advapi32.dll", SetLastError=true)]
public static extern bool LogonUser(String lpszUsername, String lpszDomain,
String lpszPassword,
int dwLogonType, int dwLogonProvider, ref IntPtr phToken);
[DllImport("kernel32.dll",
CharSet=System.Runtime.InteropServices.CharSet.Auto)]
private unsafe static extern int FormatMessage(int dwFlags, ref IntPtr
lpSource,
int dwMessageId, int dwLanguageId, ref String lpBuffer, int nSize, IntPtr
*Arguments);
[DllImport("kernel32.dll", CharSet=CharSet.Auto)]
public extern static bool CloseHandle(IntPtr handle);
[DllImport("advapi32.dll", CharSet=CharSet.Auto, SetLastError=true)]
public extern static bool DuplicateToken(IntPtr ExistingTokenHandle,
int SECURITY_IMPERSONATION_LEVEL, ref IntPtr DuplicateTokenHandle);
// GetErrorMessage formats and returns an error message
// corresponding to the input errorCode.
public unsafe static string GetErrorMessage(int errorCode)
{
int FORMAT_MESSAGE_ALLOCATE_BUFFER = 0x00000100;
int FORMAT_MESSAGE_IGNORE_INSERTS = 0x00000200;
int FORMAT_MESSAGE_FROM_SYSTEM = 0x00001000;
int messageSize = 255;
String lpMsgBuf = "";
int dwFlags = FORMAT_MESSAGE_ALLOCATE_BUFFER | FORMAT_MESSAGE_FROM_SYSTEM
| FORMAT_MESSAGE_IGNORE_INSERTS;
IntPtr ptrlpSource = IntPtr.Zero;
IntPtr prtArguments = IntPtr.Zero;
int retVal = FormatMessage(dwFlags, ref ptrlpSource, errorCode, 0, ref
lpMsgBuf, messageSize, &prtArguments);
if (0 == retVal)
{
throw new Exception("Failed to format message for error code " +
errorCode + ". ");
}
return lpMsgBuf;
}
// Test harness.
// If you incorporate this code into a DLL, be sure to demand FullTrust.
[PermissionSetAttribute(SecurityAction.Demand, Name = "FullTrust")]
public static void Main(string[] args)
{
IntPtr tokenHandle = new IntPtr(0);
IntPtr dupeTokenHandle = new IntPtr(0);
try
{
string UserName, MachineName;
// Get the user token for the specified user, machine, and password using
the
// unmanaged LogonUser method.
Console.Write("Enter the name of a machine on which to log on: ");
MachineName = Console.ReadLine();
Console.Write("Enter the login of a user on {0} that you wish to
impersonate: ", MachineName);
UserName = Console.ReadLine();
Console.Write("Enter the password for {0}: ", UserName);
const int LOGON32_PROVIDER_DEFAULT = 0;
//This parameter causes LogonUser to create a primary token.
const int LOGON32_LOGON_INTERACTIVE = 2;
const int SecurityImpersonation = 2;
tokenHandle = IntPtr.Zero;
dupeTokenHandle = IntPtr.Zero;
// Call LogonUser to obtain a handle to an access token.
bool returnValue = LogonUser(UserName, MachineName, Console.ReadLine(),
LOGON32_LOGON_INTERACTIVE, LOGON32_PROVIDER_DEFAULT,
ref tokenHandle);
Console.WriteLine("LogonUser called.");
if (false == returnValue)
{
int ret = Marshal.GetLastWin32Error();
Console.WriteLine("LogonUser failed with error code : {0}", ret);
Console.WriteLine("\nError: [{0}] {1}\n", ret, GetErrorMessage(ret));
return;
}
Console.WriteLine("Did LogonUser Succeed? " + (returnValue? "Yes" :
"No"));
Console.WriteLine("Value of Windows NT token: " + tokenHandle);
// Check the identity.
Console.WriteLine("Before impersonation: "
+ WindowsIdentity.GetCurrent().Name);
bool retVal = DuplicateToken(tokenHandle, SecurityImpersonation, ref
dupeTokenHandle);
if (false == retVal)
{
CloseHandle(tokenHandle);
Console.WriteLine("Exception thrown in trying to duplicate token.");
return;
}
// The token that is passed to the following constructor must
// be a primary token in order to use it for impersonation.
WindowsIdentity newId = new WindowsIdentity(dupeTokenHandle);
WindowsImpersonationContext impersonatedUser = newId.Impersonate();
// Check the identity.
Console.WriteLine("After impersonation: "
+ WindowsIdentity.GetCurrent().Name);
// Stop impersonating the user.
impersonatedUser.Undo();
// Check the identity.
Console.WriteLine("After Undo: " + WindowsIdentity.GetCurrent().Name);
// Free the tokens.
if (tokenHandle != IntPtr.Zero)
CloseHandle(tokenHandle);
if (dupeTokenHandle != IntPtr.Zero)
CloseHandle(dupeTokenHandle);
}
catch(Exception ex)
{
Console.WriteLine("Exception occurred. " + ex.Message);
}
}
}
****************************************************************************
********************
Visual Basic:
' This sample demonstrates the use of the WindowsIdentity class to
impersonate a user. ' IMPORTANT NOTES:
' This sample can be run only on Windows XP. The default Windows 2000
security policy
' prevents this sample from executing properly, and changing the policy to
allow ' proper execution presents a security risk.
' This sample requests the user to enter a password on the console screen. '
Because the console window does not support methods allowing the password to
be masked,
' it will be visible to anyone viewing the screen.
Imports System
Imports System.Runtime.InteropServices
Imports System.Security.Principal
Imports System.Security.Permissions
Imports Microsoft.VisualBasic
<Assembly: SecurityPermissionAttribute(SecurityAction.RequestMinimum,
UnmanagedCode:=True), _
Assembly: PermissionSetAttribute(SecurityAction.RequestMinimum,
Name:="FullTrust")>
Module Module1
Public Class ImpersonationDemo
Private Declare Auto Function LogonUser Lib "advapi32.dll" (ByVal
lpszUsername As [String], _
ByVal lpszDomain As [String], ByVal lpszPassword As [String], _
ByVal dwLogonType As Integer, ByVal dwLogonProvider As Integer,
_
ByRef phToken As IntPtr) As Boolean
<DllImport("kernel32.dll")> _
Public Shared Function FormatMessage(ByVal dwFlags As Integer, ByRef
lpSource As IntPtr, _
ByVal dwMessageId As Integer, ByVal dwLanguageId As Integer,
ByRef lpBuffer As [String], _
ByVal nSize As Integer, ByRef Arguments As IntPtr) As Integer
End Function
Public Declare Auto Function CloseHandle Lib "kernel32.dll" (ByVal
handle As IntPtr) As Boolean
Public Declare Auto Function DuplicateToken Lib "advapi32.dll"
(ByVal ExistingTokenHandle As IntPtr, _
ByVal SECURITY_IMPERSONATION_LEVEL As Integer, _
ByRef DuplicateTokenHandle As IntPtr) As Boolean
'GetErrorMessage formats and returns an error message
'corresponding to the input errorCode.
Public Shared Function GetErrorMessage(ByVal errorCode As Integer)
As String
Dim FORMAT_MESSAGE_ALLOCATE_BUFFER As Integer = &H100
Dim FORMAT_MESSAGE_IGNORE_INSERTS As Integer = &H200
Dim FORMAT_MESSAGE_FROM_SYSTEM As Integer = &H1000
Dim messageSize As Integer = 255
Dim lpMsgBuf As String
Dim dwFlags As Integer = FORMAT_MESSAGE_ALLOCATE_BUFFER Or
FORMAT_MESSAGE_FROM_SYSTEM Or FORMAT_MESSAGE_IGNORE_INSERTS
Dim ptrlpSource As IntPtr = IntPtr.Zero
Dim prtArguments As IntPtr = IntPtr.Zero
Dim retVal As Integer = FormatMessage(dwFlags, ptrlpSource,
errorCode, 0, lpMsgBuf, _
messageSize, prtArguments)
If 0 = retVal Then
Throw New Exception("Failed to format message for error code
" + errorCode.ToString() + ". ")
End If
Return lpMsgBuf
End Function 'GetErrorMessage
' Test harness.
' If you incorporate this code into a DLL, be sure to demand
FullTrust.
<PermissionSetAttribute(SecurityAction.Demand, Name:="FullTrust")> _
Public Overloads Shared Sub Main(ByVal args() As String)
Dim tokenHandle As New IntPtr(0)
Dim dupeTokenHandle As New IntPtr(0)
Try
Dim UserName, MachineName As String
' Get the user token for the specified user, machine, and
password using the
' unmanaged LogonUser method.
Console.Write("Enter the name of a machine on which to log
on: ")
MachineName = Console.ReadLine()
Console.Write("Enter the login of a user on {0} that you
wish to impersonate: ", MachineName)
UserName = Console.ReadLine()
Console.Write("Enter the password for {0}: ", UserName)
Const LOGON32_PROVIDER_DEFAULT As Integer = 0
'This parameter causes LogonUser to create a primary token.
Const LOGON32_LOGON_INTERACTIVE As Integer = 2
Const SecurityImpersonation As Integer = 2
tokenHandle = IntPtr.Zero
dupeTokenHandle = IntPtr.Zero
' Call LogonUser to obtain a handle to an access token.
Dim returnValue As Boolean = LogonUser(UserName,
MachineName, Console.ReadLine(), LOGON32_LOGON_INTERACTIVE,
LOGON32_PROVIDER_DEFAULT, tokenHandle)
Console.WriteLine("LogonUser called.")
If False = returnValue Then
Dim ret As Integer = Marshal.GetLastWin32Error()
Console.WriteLine("LogonUser failed with error code :
{0}", ret)
Console.WriteLine(ControlChars.Cr + "Error: [{0}] {1}" +
ControlChars.Cr, ret, GetErrorMessage(ret))
Return
End If
Dim success As String
If returnValue Then success = "Yes" Else success = "No"
Console.WriteLine(("Did LogonUser succeed? " + success))
Console.WriteLine(("Value of Windows NT token: " +
tokenHandle.ToString()))
' Check the identity.
Console.WriteLine(("Before impersonation: " +
WindowsIdentity.GetCurrent().Name))
Dim retVal As Boolean = DuplicateToken(tokenHandle,
SecurityImpersonation, dupeTokenHandle)
If False = retVal Then
CloseHandle(tokenHandle)
Console.WriteLine("Exception thrown in trying to
duplicate token.")
Return
End If
' TThe token that is passed to the following constructor
must
' be a primary token in order to use it for impersonation.
Dim newId As New WindowsIdentity(dupeTokenHandle)
Dim impersonatedUser As WindowsImpersonationContext =
newId.Impersonate()
' Check the identity.
Console.WriteLine(("After impersonation: " +
WindowsIdentity.GetCurrent().Name))
' Stop impersonating the user.
impersonatedUser.Undo()
' Check the identity.
Console.WriteLine(("After Undo: " +
WindowsIdentity.GetCurrent().Name))
' Free the tokens.
If Not System.IntPtr.op_Equality(tokenHandle, IntPtr.Zero)
Then
CloseHandle(tokenHandle)
End If
If Not System.IntPtr.op_Equality(dupeTokenHandle,
IntPtr.Zero) Then
CloseHandle(dupeTokenHandle)
End If
Catch ex As Exception
Console.WriteLine(("Exception occurred. " + ex.Message))
End Try
End Sub 'Main
End Class 'Class1
End Module
-- This posting is provided "AS IS" with no warranties, and confers no rights. Use of included script samples are subject to the terms specified at http://www.microsoft.com/info/cpyright.htm "Mark K" <d5xf91o02@sneakemail.com> wrote in message news:e9XEGnS2CHA.688@TK2MSFTNGP09.phx.gbl... > I tried this but the application seems to abend at the call to GetLastError, > even when GetLastError doesn't need to be called because "LogonUser" > succeeded. > > Any ideas? > > "Xiao Xie [MSFT]" <xiaoxie@online.microsoft.com> wrote in message > news:jjC0lbxtCHA.2580@cpmsftngxa09... > > Hi Joel, > > > > You still need to call LogonUser() API to get the token in .NET. However, > > the ImpersonateLoggedOnUser() and RevertToSelf() APIs have encapsulations. > > Have a look at the following link: > > > > > http://msdn.microsoft.com/library/default.asp?url=/library/en-us/cpref/html/ > > frlrfSystemSecurityPrincipalWindowsIdentityClassImpersonateTopic.asp > > > > Hope this helps. > > > > Sincerely, > > Xiao Xie > > Microsoft Developer Support > > > > This posting is provided "AS IS" with no warranties, and confers no > rights. > > > >
- Previous message: Tim Overbay: "Re: Best Practices for Secure Communications"
- In reply to: Mark K: "Re: LogonUser()"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
Relevant Pages
|
