Re: Impersonation through HttpModule

From: Joe Kaplan \(MVP - ADSI\) (joseph.e.kaplan_at_removethis.accenture.com)
Date: 05/26/05 

Date: Thu, 26 May 2005 09:42:43 -0500

Programmatic impersonation on IIS5 is painful because normal accounts can't
call the LogonUser API on Win2K. This restriction is removed in XP and 2K3.

On IIS6, I would recommend you do this without using impersonation,
especially programmatic. It is much easier to set up a single AppPool for
each application that runs under the specified domain account (and disable
impersonation in web.config). The other option would be to use explicit
impersonation in web.config, supplying a username and password there.

On IIS 5 this is harder. There are no AppPools, so there is no good way to
have a process account for each app as there is only one process. You can't
use programmatic impersonation (or explicit impersonation of a specific user
via web.config) with the default settings because you won't have rights to
call LogonUser.

The first thing you will need to do is figure out how you will get the
necessary permissions to call LogonUser in the first place. One way might
be to give the ASPNET account the "Act as part of the operating system"
privilege in local security policy, but that also seriously compromises the
security of the web server (although possible not as much as simplying
running it as SYSTEM).

Joe K.
"otto" <otto@discussions.microsoft.com> wrote in message
news:074DE94A-0BB6-4C3F-85DC-240DEC6D7CA8@microsoft.com...
> Hi, Dominick:
>
> both of them. What´s the difference? I have few experience with IIS 6.0
>
>
>
> "Dominick Baier [DevelopMentor]" wrote:
>
>> Hello otto,
>>
>> on which platform (IIS5 or 6)
>>
>> ---------------------------------------
>> Dominick Baier - DevelopMentor
>> http://www.leastprivilege.com
>>
>> > Hi, all:
>> > I have a question about security in ASP.NET applications. We´ve to
>> > develop
>> > several applications. All of them with Windows integrated security in
>> > IIS.
>> > Each application must run under one domain account (each application
>> > has its
>> > own account), so we´ve to use impersonation. How can I do this with
>> > HttpModule´s?
>> > Thanks a lot.
>> >
>>
>>
>>
>>

Relevant Pages

  • Re: SetPassword access denied
    ... safely invoke SetPassword etc..... ... impersonation or using the process token without impersonation) is NOT ... account that is used for performing remote activities in the directory. ... Co-author of "The .NET Developer's Guide to Directory Services ...
    (microsoft.public.windows.server.active_directory)
  • Re: VS.NET 2005 and the "allowDefinition=MachineToApplication" error
    ... Your description of impersonation is great. ... If you want to use the default configured account, eliminate that entry, or configure it as: ... The easiest way to assign correct permissions to all required directories is to run: ... I re-started IIS and tried to access my ASPX page again -- same ...
    (microsoft.public.dotnet.framework.aspnet)
  • [Full-disclosure] Maybe nothing so shady; depends on the motive.
    ... There may be no impersonation going on. ... attempted use of a disabled account would produce messages about "account foo login fail" ... SecureWorks was still reading email addressed to David Maynor. ...
    (Full-Disclosure)
  • Re: SetPassword access denied
    ... That said, I think one thing worth pointing out is that in both cases here, your code is supplying credentials to the DirectoryEntry constructor. ... the identity of the current thread (established either via impersonation or using the process token without impersonation) is NOT the account that is used for performing remote activities in the directory. ... Co-author of "The .NET Developer's Guide to Directory Services Programming" ...
    (microsoft.public.windows.server.active_directory)
  • Re: Impersonation
    ... impersonation, unless you actually need to be userX for some file operation, ... I also wonder why folks always talk about using a seperate account DB. ... I know the diference between IIS and WSE authentication mecanism. ... >>> where I need to check password in UsernameTokenManager for that I need ...
    (microsoft.public.dotnet.framework.webservices.enhancements)