passing impersonation token to out-of-proc COM server

From: Tomaz Beltram (tomazb_at_hotmail.com)
Date: 11/28/03 

Date: Fri, 28 Nov 2003 13:51:54 +0100

Please guide me to a different newsgroup if there is a more appropriate
one for my question.

Here is the problem:

1. The client application uses LogonUser and ImpersonateLoggedOnUser to
change identity and calls a out-of-proc COM server (on same host).

2. COM server uses CoImpersonateClient to change identity. Unfortunately
it always uses client's primary access token and not the impersonation
token.

E.g.:
- Process A runs under Alice account.
- Server process S runs as service under local system account.
- A impersonates user Bob and makes a COM call to S.
- In serving the call S impersonates clients identity but it is not Bob,
its Alice!?

This is not what I wanted. On the other hand, when the client
application creates a new process with CreateProcessAsUser and issues a
COM call from there, everything works as expected.

I suspect that the cause of this behavior is in that COM uses different
thread to make the call to the server and that thread doesn't have the
right identity.

Can anyone confirm that? Has anyone an idea on how to pass impersonation
token to the COM server? I want to avoid passing user credentials in
parameters.

thanks Tomaz

Relevant Pages

  • Re: help on caller credentials !! :-(
    ... Then my server component is hosted in a windows service runnning on Vista ... Running my client will generate an InvaluidCredential Exception ... I am able to read client credential from my remote object ... The impersonation level your are talking about in previous post, ...
    (microsoft.public.dotnet.security)
  • Re: IWbemConfigureRefresher->AddEnum & AddObjectByPath return WBEM_E_ACCESS_DENIED
    ... and your process receives calls from external client. ... >From the point of view of the RPC binding handle, a leaked impersonation ... Do you smuggle Interface pointers from apartment to apartment? ... both the COM server process (that is getting the ...
    (microsoft.public.win32.programmer.wmi)
  • RE: Impersonation with IPCChannel
    ... The Client uses WCF TCP Binding to the server. ... I am trying out impersonation with IPCChannel but for some reason it always ... throws an Access Denied Exception when I tried to connect to the port. ...
    (microsoft.public.dotnet.framework.remoting)
  • Re: CoImpersonateClient() always succeed
    ... DCOM security is mostly short-circuited when the client ... and the server are running on the same machine. ... > I'm trying to turnoff impersonation using CoInitializeSecurity. ... The client which provides the callback calls ...
    (microsoft.public.vc.atl)
  • Re: What doesnt lend itself to OO?
    ... >> proxy and instructs the server to constuct the real object. ... rather than client code. ... If 'clock' is instantiated in the server, ... > for the server interface at the OOA level. ...
    (comp.object)