Re: Impersonation in non domain member server

Hi,

first of all you are not forced to use auto impersonation (in config) - you can always manually impersonate before you are doing the resource access...

or

undo impersonation temporarily when talking to resources that are not "compatible" with impersonation

sounds reasonable?


-----
Dominick Baier (http://www.leastprivilege.com)

Developing More Secure Microsoft ASP.NET 2.0 Applications (http://www.microsoft.com/mspress/books/9989.asp)

Hi Henning,

Thanks for your kind reply. I need to impersonate the user in order
for it to be able to access some resources on behalf the impersonated
account. I think using DirectoryServices is not a suitable case here
(unless we implement our own rights management system, or am I wrong?)

Best regards

"Henning Krause [MVP - Exchange]" wrote:

Hello,

when you are using System.DirectoryServices.DirectoryEntry, you can
pass along custom credentials in the constructor. No need for
impersonation.

Best regards,
Henning Krause
"Johann Granados" <JohannGranados@xxxxxxxxxxxxxxxxxxxxxxxxx> wrote in
message news:D2195796-4F63-457F-8E84-9EC94335183B@xxxxxxxxxxxxxxxx

Hi everybody,

I'm developing an ASP.NET application which calls business
components in a
remote server located at the DMZ (this is, a non domain member
server).
The
problem I'm facing is that because the server is not a domain
member, it
is
not able to access the active directory in order to authenticate the
impersonated user. Does anybody know another approach to do
impersonation
in
a non domain member server?
Thank in advance for your help!!!

Johann Granados
Costa Rica, Central America


.

Relevant Pages

  • Re: Total Confusion! - ACLs and Windows authentication with no impersonation
    ... permissions are checked, and not in IIS. ... account - regardless of the impersonation settings. ... You have aspx pages..and you have the resources this page wants to get at. ... When anonymous authentication is disabled, yes the page itself MUST have ...
    (microsoft.public.dotnet.framework.aspnet.security)
  • Re: Total Confusion! - ACLs and Windows authentication with no impersonation
    ... After they have access to the page, if impersonation is disabled, this is when the aspnet user takes over the process, and access to other resourses is granted based on that, not the original user. ... > Client Requested Resources. ... It uses the original caller's access token and ACL ...
    (microsoft.public.dotnet.framework.aspnet.security)
  • Re: Multiple Users with impersonation using one account
    ... you don't need impersonation to check for user identity - Context.User.Identity.Name is populated with the clients name ... some applications use resources such as the file system for ... or for opening files on other network ...
    (microsoft.public.dotnet.framework.aspnet.security)
  • Re: Service Account replaced by IUSR ??
    ... I can't think of a reason why the IUSR account would get used here then. ... Co-author of "The .NET Developer's Guide to Directory Services Programming" ... "By using impersonation, ASP.NET applications can execute code or access ... created when you enable impersonation allow you to access local resources ...
    (microsoft.public.dotnet.framework.aspnet.security)
  • Re: Going from anonymous security to Windows Security in an ASP.NET application
    ... as I said in my previous post - there is no context on the client... ... Your page.context exists purely on the server. ... we need to have our own login page instead of the standard Windows logon ... impersonation, which takes place on the server has no effect on page ...
    (microsoft.public.dotnet.framework.aspnet.security)