Keep impersonated user during session. Please help.

From: Thomaz72 (thomas@resolut.se)
Date: 02/20/03 

From: thomas@resolut.se (Thomaz72)
Date: 20 Feb 2003 07:11:56 -0800

I'm trying to solve a common problem (seen lots of questions here on
it here but no solution). The problem is how to keep the impersonated
user during the rest of the ASP session. I'll explain.

If u from an ASP page calls a dll who changes the impersonated user
the current worker thread of ISS uses this security context. Works
perfect. But the next request from the same browser creates a new
worker thread with the cached security token from IIS and the security
context of the last request is gone.

Or is this imposible (would be a very beautiful security solution) so
i'll have to use a ISAPI for the task :-(

Tried to explain this litle problem as god as i could.

//Thomas J of sweden

Relevant Pages

  • Re: uh? security problem?
    ... Then you will have "Sharing And Security" in the ... context menu for files, folders, etc. in Windows Explorer. ... > granting access rights to the resource to the ASP.NET request identity. ... > eventArgument) +5 ...
    (microsoft.public.dotnet.framework.aspnet)
  • Re: uh? security problem?
    ... It appears that your IIS user account does not have access to that file. ... Try sharing the file and setting the security levels to allow everyone full ... > granting access rights to the resource to the ASP.NET request identity. ... > eventArgument) +5 ...
    (microsoft.public.dotnet.framework.aspnet)
  • Re: [PATCH 00/16] Permit filesystem local caching [try #3]
    ... running in the security context of either the aforementioned ... The cache driver acts on behalf of someone else. ... the cache driver doesn't have a security context per se. ... context as which the VFS routines act, but rather gets them from the ...
    (Linux-Kernel)
  • [UNIX] Invision Power Board SQL Injection Vulnerability (sources/calendar.php)
    ... Get your security news from a reliable source. ... An SQL injection vulnerability in IPB's calendar support, ... We execute the following request: ... As it is a request of type SELECT, we can use for example the clause ...
    (Securiteam)
  • Re: [PATCH 00/16] Permit filesystem local caching [try #3]
    ... running in the security context of either the aforementioned random ... The cache driver acts on behalf of someone else. ... one security context, but the cache itself has to have a different context so ... permitted to act as a context appropriate to accessing the cache, ...
    (Linux-Kernel)