Re: Keep impersonated user during session. Please help.

From: Egbert Nierop \(MVP for IIS\) (egbert_nierop@nospam.com)
Date: 02/20/03 

From: "Egbert Nierop \(MVP for IIS\)" <egbert_nierop@nospam.com>
Date: Thu, 20 Feb 2003 16:44:13 +0100

"Thomaz72" <thomas@resolut.se> wrote in message
news:cb260.0302200711.12a3835f@posting.google.com...
> I'm trying to solve a common problem (seen lots of questions here on
> it here but no solution). The problem is how to keep the impersonated
> user during the rest of the ASP session. I'll explain.

Basicly you should use as a call to LogonUser... with LOGON32_LOGON_NETWORK
as parameter ...
The password and the user should be stored somewere (safely) in the session
so that at each request, the logon can be reprocessed.
Indeed, this is not too efficient but LOGON32_LOGON_NETWORK does quite a
lot caching already. IIS itselves, would cache logon requests (when you use
basic-clear text login)...
If you like to do it more efficiently, you should cache the logon
credential. Be assured that such cache *cannot* work across a web farm... 

--
ASP Session replacement for webfarms
http://www.nieropwebconsult.nl/asp_session_manager.htm
> If u from an ASP page calls a dll who changes the impersonated user
> the current worker thread of ISS uses this security context. Works
> perfect. But the next request from the same browser creates a new
> worker thread with the cached security token from IIS and the security
> context of the last request is gone.
>
> Or is this imposible (would be a very beautiful security solution) so
> i'll have to use a ISAPI for the task :-(
>
> Tried to explain this litle problem as god as i could.
>
> //Thomas J of sweden

Relevant Pages

  • lame server messages in named.log
    ... Mar 30 05:42:30.526 security: info: client 202.52.250.176#1052: ... query (cache) denied ...
    (RedHat)
  • lame server messages in named.log
    ... Mar 30 05:42:30.526 security: info: client 202.52.250.176#1052: ... query (cache) denied ...
    (RedHat)
  • [PATCH 16/19] CacheFiles: Deal with LSM when accessing the cache
    ... Make the Cachefiles module deal with LSM/SELinux security when accessing the ... SECURITY MODEL AND SELINUX ... security context that is not appropriate for accessing the cache - either ... struct kstatfs stats; ...
    (Linux-Kernel)
  • [PATCH 00/45] Permit filesystem local caching [ver #35]
    ... These patches add local caching for network filesystems such as NFS. ... FS-Cache asks the cache backend, in this case CacheFiles to honour the ... FS-Cache attempts to provide a caching facility to a network filesystem such ... A patch to allow the security label of a key to be retrieved. ...
    (Linux-Kernel)
  • Re: Logon Error - Event ID 533
    ... The suggestion regarding security logs should not apply if the overwrite option has been selected and you have the default maximum of 512 kb. ... How to Set Log Size and Overwrite Options ... The user cannot logon and no Profile folder is made, ... screen whether with a domain account or a local account from the ...
    (microsoft.public.windowsxp.help_and_support)