| Groups | Blog | Home |
asp.net security : LogonUser access denied
I get an access denied error on the LogonUser method of the following code; /// <summary> /// Summary description for CustomWindowsIdentity. /// </summary> public class CustomWindowsIdentity : WindowsIdentity { [DllImport("advapi32.dll", SetLastError=true)] private static extern int LogonUser(String lpszUsername, String lpszDomain, String lpszPassword, int dwLogonType, int dwLogonProvider, out int phToken); [DllImport("kernel32.dll")] private static extern int GetLastError(); public CustomWindowsIdentity( string domain, string username, string password ) : base( CustomWindowsIdentity.LogonUser(domain,username,password) ) { } //-------------------------------------------------------------------------- // Impersonates as the supplied user. // Domain must be in standard NT format: e.g. "DOMAIN" //-------------------------------------------------------------------------- public static WindowsImpersonationContext Impersonate( string domain, string username, string password ) { IntPtr token = LogonUser( domain, username, password ); return WindowsIdentity.Impersonate( token ); } private static IntPtr LogonUser( string domain, string username, string password ) { int token = 0; int loggedOn = LogonUser( username, domain, password, 0x8, 0x0, //WindowsLogonType.NetworkClearText, //WindowsLogonProvider.Default, out token ); if (loggedOn==0 || token==0) { int ret = GetLastError(); //int ret = Marshal.GetLastWin32Error(); //GetLastError(); if (ret!=0) { WindowsIdentity currentUser = WindowsIdentity.GetCurrent(); throw new Win32Exception(ret,"DEBUG: " + currentUser.Name.ToString()); } } IntPtr tokenOut = new IntPtr( token ); return tokenOut; } } Its worth noting we are using a different user account for IIS anonymous authentication so the user that is trying to impersonate is 'DOMAIN\MY_READER'. This same code block works on the production environment so my thinking is that its a permission or setting missing for the specific user on the staging server? Ive even tried having IIS use an administrator account for anonymous access but get the same error? Any help, clues or pointers would be great.
Is this the right forum for this question?
[quoted text, click to view] "Lee" wrote:
> I am having problems trying to impersonate as a user in asp.net. > > I get an access denied error on the LogonUser method of the following code; > > /// <summary> > /// Summary description for CustomWindowsIdentity. > /// </summary> > public class CustomWindowsIdentity : WindowsIdentity > { > [DllImport("advapi32.dll", SetLastError=true)] > private static extern int LogonUser(String lpszUsername, String > lpszDomain, String lpszPassword, > int dwLogonType, int dwLogonProvider, out int phToken); > > [DllImport("kernel32.dll")] > private static extern int GetLastError(); > > public CustomWindowsIdentity( string domain, string username, string > password ) : > base( CustomWindowsIdentity.LogonUser(domain,username,password) ) > { > } > > //-------------------------------------------------------------------------- > // Impersonates as the supplied user. > // Domain must be in standard NT format: e.g. "DOMAIN" > //-------------------------------------------------------------------------- > public static WindowsImpersonationContext Impersonate( string domain, > string username, string password ) > { > IntPtr token = LogonUser( domain, username, password ); > > return WindowsIdentity.Impersonate( token ); > } > > private static IntPtr LogonUser( string domain, string username, string > password ) > { > int token = 0; > > int loggedOn = LogonUser( username, domain, password, > 0x8, 0x0, > //WindowsLogonType.NetworkClearText, > //WindowsLogonProvider.Default, > out token ); > > if (loggedOn==0 || token==0) > { > int ret = GetLastError(); > //int ret = Marshal.GetLastWin32Error(); //GetLastError(); > > if (ret!=0) > { > WindowsIdentity currentUser = WindowsIdentity.GetCurrent(); > > throw new Win32Exception(ret,"DEBUG: " + currentUser.Name.ToString()); > } > } > > IntPtr tokenOut = new IntPtr( token ); > > return tokenOut; > } > } > > Its worth noting we are using a different user account for IIS anonymous > authentication so the user that is trying to impersonate is > 'DOMAIN\MY_READER'. > This same code block works on the production environment so my thinking is > that its a permission or setting missing for the specific user on the staging > server? Ive even tried having IIS use an administrator account for anonymous > access but get the same error? > Any help, clues or pointers would be great. >
This would probably be the appropriate forum for this question, yes.
Can you show the exact exception and stack trace? Joe K. -- Joe Kaplan-MS MVP Directory Services Programming Co-author of "The .NET Developer's Guide to Directory Services Programming" http://www.directoryprogramming.net -- [quoted text, click to view] "Lee" <lee.walton@ngtuk.com> wrote in message news:D24EE523-BDF8-45FC-90CA-12667C63E9C1@microsoft.com... > Is this the right forum for this question? > > "Lee" wrote: > >> I am having problems trying to impersonate as a user in asp.net. >> >> I get an access denied error on the LogonUser method of the following >> code; >> >> /// <summary> >> /// Summary description for CustomWindowsIdentity. >> /// </summary> >> public class CustomWindowsIdentity : WindowsIdentity >> { >> [DllImport("advapi32.dll", SetLastError=true)] >> private static extern int LogonUser(String lpszUsername, String >> lpszDomain, String lpszPassword, >> int dwLogonType, int dwLogonProvider, out int phToken); >> >> [DllImport("kernel32.dll")] >> private static extern int GetLastError(); >> >> public CustomWindowsIdentity( string domain, string username, string >> password ) : >> base( CustomWindowsIdentity.LogonUser(domain,username,password) ) >> { >> } >> >> //-------------------------------------------------------------------------- >> // Impersonates as the supplied user. >> // Domain must be in standard NT format: e.g. "DOMAIN" >> //-------------------------------------------------------------------------- >> public static WindowsImpersonationContext Impersonate( string domain, >> string username, string password ) >> { >> IntPtr token = LogonUser( domain, username, password ); >> >> return WindowsIdentity.Impersonate( token ); >> } >> >> private static IntPtr LogonUser( string domain, string username, string >> password ) >> { >> int token = 0; >> >> int loggedOn = LogonUser( username, domain, password, >> 0x8, 0x0, >> //WindowsLogonType.NetworkClearText, >> //WindowsLogonProvider.Default, >> out token ); >> >> if (loggedOn==0 || token==0) >> { >> int ret = GetLastError(); >> //int ret = Marshal.GetLastWin32Error(); //GetLastError(); >> >> if (ret!=0) >> { >> WindowsIdentity currentUser = WindowsIdentity.GetCurrent(); >> >> throw new Win32Exception(ret,"DEBUG: " + currentUser.Name.ToString()); >> } >> } >> >> IntPtr tokenOut = new IntPtr( token ); >> >> return tokenOut; >> } >> } >> >> Its worth noting we are using a different user account for IIS anonymous >> authentication so the user that is trying to impersonate is >> 'DOMAIN\MY_READER'. >> This same code block works on the production environment so my thinking >> is >> that its a permission or setting missing for the specific user on the >> staging >> server? Ive even tried having IIS use an administrator account for >> anonymous >> access but get the same error? >> Any help, clues or pointers would be great. >> >> many thanks
Hi,
which OS are you using? On W2K you need SYSTEM privileges to call LogonUser... dominick www.leastprivilege.com [quoted text, click to view] > I am having problems trying to impersonate as a user in asp.net. > > I get an access denied error on the LogonUser method of the following > code; > > /// <summary> > /// Summary description for CustomWindowsIdentity. > /// </summary> > public class CustomWindowsIdentity : WindowsIdentity > { > [DllImport("advapi32.dll", SetLastError=true)] > private static extern int LogonUser(String lpszUsername, String > lpszDomain, String lpszPassword, > int dwLogonType, int dwLogonProvider, out int phToken); > [DllImport("kernel32.dll")] > private static extern int GetLastError(); > public CustomWindowsIdentity( string domain, string username, string > password ) : > base( CustomWindowsIdentity.LogonUser(domain,username,password) ) > { > } > > //-------------------------------------------------------------------- > ------ > // Impersonates as the supplied user. > // Domain must be in standard NT format: e.g. "DOMAIN" > > //-------------------------------------------------------------------- > ------ > public static WindowsImpersonationContext Impersonate( string > domain, > string username, string password ) > { > IntPtr token = LogonUser( domain, username, password ); > return WindowsIdentity.Impersonate( token ); > } > private static IntPtr LogonUser( string domain, string username, > string > password ) > { > int token = 0; > int loggedOn = LogonUser( username, domain, password, > 0x8, 0x0, > //WindowsLogonType.NetworkClearText, > //WindowsLogonProvider.Default, > out token ); > if (loggedOn==0 || token==0) > { > int ret = GetLastError(); > //int ret = Marshal.GetLastWin32Error(); //GetLastError(); > if (ret!=0) > { > WindowsIdentity currentUser = WindowsIdentity.GetCurrent(); > throw new Win32Exception(ret,"DEBUG: " + > currentUser.Name.ToString()); > } > } > IntPtr tokenOut = new IntPtr( token ); > > return tokenOut; > } > } > Its worth noting we are using a different user account for IIS > anonymous > authentication so the user that is trying to impersonate is > 'DOMAIN\MY_READER'. > This same code block works on the production environment so my > thinking is > that its a permission or setting missing for the specific user on the > staging > server? Ive even tried having IIS use an administrator account for > anonymous > access but get the same error? > Any help, clues or pointers would be great. > many thanks >
Thanks Joe, the expception and stack trace is as follows.
Exception Details: System.ComponentModel.Win32Exception: Access is denied Stack Trace: [Win32Exception (0x80004005): Access is denied] UW.DirectoryServices.CustomWindowsIdentity.LogonUser(String domain, String username, String password) UW.DirectoryServices.CustomWindowsIdentity.Impersonate(String domain, String username, String password) UW.DirectoryServices.ADSAdmin.Load() UW.DirectoryServices.ADSAdmin.LoadDirectory(String domain, String organizationalunit, String loginUsername, String loginPassword) UW.DirectoryServices.ADSAdmin..ctor(String domain, String organizationalunit, String loginUsername, String loginPassword) Project.Web.Common.Template.ValidateUsers.GetADSAdmin() Project.Web.Common.Template.ValidateUsers.GetADUsers() Project.Web.Common.Template.ValidateUsers.GetDBUsersNotMatched() Project.Web.Common.Template.ValidateUsers.ShowDBUsersNotMatched() Project.Web.Common.Template.ValidateUsers.Page_Load(Object sender, EventArgs e) System.Web.UI.Control.OnLoad(EventArgs e) +67 System.Web.UI.Control.LoadRecursive() +35 System.Web.UI.Control.LoadRecursive() +98 System.Web.UI.Control.LoadRecursive() +98 System.Web.UI.Control.LoadRecursive() +98 System.Web.UI.Page.ProcessRequestMain() +739 [quoted text, click to view] "Joe Kaplan (MVP - ADSI)" wrote:
> This would probably be the appropriate forum for this question, yes. > > Can you show the exact exception and stack trace? > > Joe K. > > -- > Joe Kaplan-MS MVP Directory Services Programming > Co-author of "The .NET Developer's Guide to Directory Services Programming" > http://www.directoryprogramming.net > -- > "Lee" <lee.walton@ngtuk.com> wrote in message > news:D24EE523-BDF8-45FC-90CA-12667C63E9C1@microsoft.com... > > Is this the right forum for this question? > > > > "Lee" wrote: > > > >> I am having problems trying to impersonate as a user in asp.net. > >> > >> I get an access denied error on the LogonUser method of the following > >> code; > >> > >> /// <summary> > >> /// Summary description for CustomWindowsIdentity. > >> /// </summary> > >> public class CustomWindowsIdentity : WindowsIdentity > >> { > >> [DllImport("advapi32.dll", SetLastError=true)] > >> private static extern int LogonUser(String lpszUsername, String > >> lpszDomain, String lpszPassword, > >> int dwLogonType, int dwLogonProvider, out int phToken); > >> > >> [DllImport("kernel32.dll")] > >> private static extern int GetLastError(); > >> > >> public CustomWindowsIdentity( string domain, string username, string > >> password ) : > >> base( CustomWindowsIdentity.LogonUser(domain,username,password) ) > >> { > >> } > >> > >> //-------------------------------------------------------------------------- > >> // Impersonates as the supplied user. > >> // Domain must be in standard NT format: e.g. "DOMAIN" > >> //-------------------------------------------------------------------------- > >> public static WindowsImpersonationContext Impersonate( string domain, > >> string username, string password ) > >> { > >> IntPtr token = LogonUser( domain, username, password ); > >> > >> return WindowsIdentity.Impersonate( token ); > >> } > >> > >> private static IntPtr LogonUser( string domain, string username, string > >> password ) > >> { > >> int token = 0; > >> > >> int loggedOn = LogonUser( username, domain, password, > >> 0x8, 0x0, > >> //WindowsLogonType.NetworkClearText, > >> //WindowsLogonProvider.Default, > >> out token ); > >> > >> if (loggedOn==0 || token==0) > >> { > >> int ret = GetLastError(); > >> //int ret = Marshal.GetLastWin32Error(); //GetLastError(); > >> > >> if (ret!=0) > >> { > >> WindowsIdentity currentUser = WindowsIdentity.GetCurrent(); > >> > >> throw new Win32Exception(ret,"DEBUG: " + currentUser.Name.ToString()); > >> } > >> } > >> > >> IntPtr tokenOut = new IntPtr( token ); > >> > >> return tokenOut; > >> } > >> } > >> > >> Its worth noting we are using a different user account for IIS anonymous > >> authentication so the user that is trying to impersonate is > >> 'DOMAIN\MY_READER'. > >> This same code block works on the production environment so my thinking > >> is > >> that its a permission or setting missing for the specific user on the > >> staging > >> server? Ive even tried having IIS use an administrator account for > >> anonymous > >> access but get the same error? > >> Any help, clues or pointers would be great. > >> > >> many thanks > >
I agree with Dominick's reply, but the thing is that you usually get an
error indicating that a required privilege was not held by the client, not the straight access denied. I've not actually seen that particular problem. I'm not sure what the deal is here. Is the OS Win2K? Joe K. -- Joe Kaplan-MS MVP Directory Services Programming Co-author of "The .NET Developer's Guide to Directory Services Programming" http://www.directoryprogramming.net -- [quoted text, click to view] "Lee" <lee.walton@ngtuk.com> wrote in message news:2BEF81F9-E438-453F-9C37-9C3714B30EA5@microsoft.com... > Thanks Joe, the expception and stack trace is as follows. > > Exception Details: System.ComponentModel.Win32Exception: Access is denied > > Stack Trace: > > [Win32Exception (0x80004005): Access is denied] > UW.DirectoryServices.CustomWindowsIdentity.LogonUser(String domain, > String username, String password) > UW.DirectoryServices.CustomWindowsIdentity.Impersonate(String domain, > String username, String password) > UW.DirectoryServices.ADSAdmin.Load() > UW.DirectoryServices.ADSAdmin.LoadDirectory(String domain, String > organizationalunit, String loginUsername, String loginPassword) > UW.DirectoryServices.ADSAdmin..ctor(String domain, String > organizationalunit, String loginUsername, String loginPassword) > Project.Web.Common.Template.ValidateUsers.GetADSAdmin() > Project.Web.Common.Template.ValidateUsers.GetADUsers() > Project.Web.Common.Template.ValidateUsers.GetDBUsersNotMatched() > Project.Web.Common.Template.ValidateUsers.ShowDBUsersNotMatched() > Project.Web.Common.Template.ValidateUsers.Page_Load(Object sender, > EventArgs e) > System.Web.UI.Control.OnLoad(EventArgs e) +67 > System.Web.UI.Control.LoadRecursive() +35 > System.Web.UI.Control.LoadRecursive() +98 > System.Web.UI.Control.LoadRecursive() +98 > System.Web.UI.Control.LoadRecursive() +98 > System.Web.UI.Page.ProcessRequestMain() +739 > > "Joe Kaplan (MVP - ADSI)" wrote: > >> This would probably be the appropriate forum for this question, yes. >> >> Can you show the exact exception and stack trace? >> >> Joe K. >> >> -- >> Joe Kaplan-MS MVP Directory Services Programming >> Co-author of "The .NET Developer's Guide to Directory Services >> Programming" >> http://www.directoryprogramming.net >> -- >> "Lee" <lee.walton@ngtuk.com> wrote in message >> news:D24EE523-BDF8-45FC-90CA-12667C63E9C1@microsoft.com... >> > Is this the right forum for this question? >> > >> > "Lee" wrote: >> > >> >> I am having problems trying to impersonate as a user in asp.net. >> >> >> >> I get an access denied error on the LogonUser method of the following >> >> code; >> >> >> >> /// <summary> >> >> /// Summary description for CustomWindowsIdentity. >> >> /// </summary> >> >> public class CustomWindowsIdentity : WindowsIdentity >> >> { >> >> [DllImport("advapi32.dll", SetLastError=true)] >> >> private static extern int LogonUser(String lpszUsername, String >> >> lpszDomain, String lpszPassword, >> >> int dwLogonType, int dwLogonProvider, out int phToken); >> >> >> >> [DllImport("kernel32.dll")] >> >> private static extern int GetLastError(); >> >> >> >> public CustomWindowsIdentity( string domain, string username, string >> >> password ) : >> >> base( CustomWindowsIdentity.LogonUser(domain,username,password) ) >> >> { >> >> } >> >> >> >> //-------------------------------------------------------------------------- >> >> // Impersonates as the supplied user. >> >> // Domain must be in standard NT format: e.g. "DOMAIN" >> >> //-------------------------------------------------------------------------- >> >> public static WindowsImpersonationContext Impersonate( string domain, >> >> string username, string password ) >> >> { >> >> IntPtr token = LogonUser( domain, username, password ); >> >> >> >> return WindowsIdentity.Impersonate( token ); >> >> } >> >> >> >> private static IntPtr LogonUser( string domain, string username, >> >> string >> >> password ) >> >> { >> >> int token = 0; >> >> >> >> int loggedOn = LogonUser( username, domain, password, >> >> 0x8, 0x0, >> >> //WindowsLogonType.NetworkClearText, >> >> //WindowsLogonProvider.Default, >> >> out token ); >> >> >> >> if (loggedOn==0 || token==0) >> >> { >> >> int ret = GetLastError(); >> >> //int ret = Marshal.GetLastWin32Error(); //GetLastError(); >> >> >> >> if (ret!=0) >> >> { >> >> WindowsIdentity currentUser = WindowsIdentity.GetCurrent(); >> >> >> >> throw new Win32Exception(ret,"DEBUG: " + currentUser.Name.ToString()); >> >> } >> >> } >> >> >> >> IntPtr tokenOut = new IntPtr( token ); >> >> >> >> return tokenOut; >> >> } >> >> } >> >> >> >> Its worth noting we are using a different user account for IIS >> >> anonymous >> >> authentication so the user that is trying to impersonate is >> >> 'DOMAIN\MY_READER'. >> >> This same code block works on the production environment so my >> >> thinking >> >> is >> >> that its a permission or setting missing for the specific user on the >> >> staging >> >> server? Ive even tried having IIS use an administrator account for >> >> anonymous >> >> access but get the same error? >> >> Any help, clues or pointers would be great. >> >> >> >> many thanks >> >> >>
Thanks for your time guys, yes to confirm the OS is w2k
[quoted text, click to view] "Dominick Baier" wrote:
> Hi, > > which OS are you using? On W2K you need SYSTEM privileges to call LogonUser... > > dominick > www.leastprivilege.com > > > I am having problems trying to impersonate as a user in asp.net. > > > > I get an access denied error on the LogonUser method of the following > > code; > > > > /// <summary> > > /// Summary description for CustomWindowsIdentity. > > /// </summary> > > public class CustomWindowsIdentity : WindowsIdentity > > { > > [DllImport("advapi32.dll", SetLastError=true)] > > private static extern int LogonUser(String lpszUsername, String > > lpszDomain, String lpszPassword, > > int dwLogonType, int dwLogonProvider, out int phToken); > > [DllImport("kernel32.dll")] > > private static extern int GetLastError(); > > public CustomWindowsIdentity( string domain, string username, string > > password ) : > > base( CustomWindowsIdentity.LogonUser(domain,username,password) ) > > { > > } > > > > //-------------------------------------------------------------------- > > ------ > > // Impersonates as the supplied user. > > // Domain must be in standard NT format: e.g. "DOMAIN" > > > > //-------------------------------------------------------------------- > > ------ > > public static WindowsImpersonationContext Impersonate( string > > domain, > > string username, string password ) > > { > > IntPtr token = LogonUser( domain, username, password ); > > return WindowsIdentity.Impersonate( token ); > > } > > private static IntPtr LogonUser( string domain, string username, > > string > > password ) > > { > > int token = 0; > > int loggedOn = LogonUser( username, domain, password, > > 0x8, 0x0, > > //WindowsLogonType.NetworkClearText, > > //WindowsLogonProvider.Default, > > out token ); > > if (loggedOn==0 || token==0) > > { > > int ret = GetLastError(); > > //int ret = Marshal.GetLastWin32Error(); //GetLastError(); > > if (ret!=0) > > { > > WindowsIdentity currentUser = WindowsIdentity.GetCurrent(); > > throw new Win32Exception(ret,"DEBUG: " + > > currentUser.Name.ToString()); > > } > > } > > IntPtr tokenOut = new IntPtr( token ); > > > > return tokenOut; > > } > > } > > Its worth noting we are using a different user account for IIS > > anonymous > > authentication so the user that is trying to impersonate is > > 'DOMAIN\MY_READER'. > > This same code block works on the production environment so my > > thinking is > > that its a permission or setting missing for the specific user on the > > staging > > server? Ive even tried having IIS use an administrator account for > > anonymous > > access but get the same error? > > Any help, clues or pointers would be great. > > many thanks > > > >
I'd expect to see a different error returned than what you are getting
(maybe there is some little coding difference), but the bottom line is that you must either be running as SYSTEM or have the process account have the "act as part of the operating system" OS privilege to call LogonUser on Win2K. Joe K. -- Joe Kaplan-MS MVP Directory Services Programming Co-author of "The .NET Developer's Guide to Directory Services Programming" http://www.directoryprogramming.net -- [quoted text, click to view] "Lee" <lee.walton@ngtuk.com> wrote in message news:4C97245A-6820-4118-A674-31C90CCE52F4@microsoft.com... > Thanks for your time guys, yes to confirm the OS is w2k > > "Dominick Baier" wrote: > >> Hi, >> >> which OS are you using? On W2K you need SYSTEM privileges to call >> LogonUser... >> >> dominick >> www.leastprivilege.com >> >> > I am having problems trying to impersonate as a user in asp.net. >> > >> > I get an access denied error on the LogonUser method of the following >> > code; >> > >> > /// <summary> >> > /// Summary description for CustomWindowsIdentity. >> > /// </summary> >> > public class CustomWindowsIdentity : WindowsIdentity >> > { >> > [DllImport("advapi32.dll", SetLastError=true)] >> > private static extern int LogonUser(String lpszUsername, String >> > lpszDomain, String lpszPassword, >> > int dwLogonType, int dwLogonProvider, out int phToken); >> > [DllImport("kernel32.dll")] >> > private static extern int GetLastError(); >> > public CustomWindowsIdentity( string domain, string username, string >> > password ) : >> > base( CustomWindowsIdentity.LogonUser(domain,username,password) ) >> > { >> > } >> > >> > //-------------------------------------------------------------------- >> > ------ >> > // Impersonates as the supplied user. >> > // Domain must be in standard NT format: e.g. "DOMAIN" >> > >> > //-------------------------------------------------------------------- >> > ------ >> > public static WindowsImpersonationContext Impersonate( string >> > domain, >> > string username, string password ) >> > { >> > IntPtr token = LogonUser( domain, username, password ); >> > return WindowsIdentity.Impersonate( token ); >> > } >> > private static IntPtr LogonUser( string domain, string username, >> > string >> > password ) >> > { >> > int token = 0; >> > int loggedOn = LogonUser( username, domain, password, >> > 0x8, 0x0, >> > //WindowsLogonType.NetworkClearText, >> > //WindowsLogonProvider.Default, >> > out token ); >> > if (loggedOn==0 || token==0) >> > { >> > int ret = GetLastError(); >> > //int ret = Marshal.GetLastWin32Error(); //GetLastError(); >> > if (ret!=0) >> > { >> > WindowsIdentity currentUser = WindowsIdentity.GetCurrent(); >> > throw new Win32Exception(ret,"DEBUG: " + >> > currentUser.Name.ToString()); >> > } >> > } >> > IntPtr tokenOut = new IntPtr( token ); >> > >> > return tokenOut; >> > } >> > } >> > Its worth noting we are using a different user account for IIS >> > anonymous >> > authentication so the user that is trying to impersonate is >> > 'DOMAIN\MY_READER'. >> > This same code block works on the production environment so my >> > thinking is >> > that its a permission or setting missing for the specific user on the >> > staging >> > server? Ive even tried having IIS use an administrator account for >> > anonymous >> > access but get the same error? >> > Any help, clues or pointers would be great. >> > many thanks >> > >> >> >>
Hi Joe,
just checking the code i posted and noticed a slight difference. I modified the code so it would output the user name in the error message throw new Win32Exception(ret,"DEBUG: " + currentUser.Name.ToString()); Ive looked at the Local security policy and the account has "act as part of the operating system" privellege? So when this didnt work i thought id temporarily set 'Everyone' to have this privellege but still got the access denied error. Any suggestions on how to troubleshoot this? [quoted text, click to view] "Joe Kaplan" wrote:
> I'd expect to see a different error returned than what you are getting > (maybe there is some little coding difference), but the bottom line is that > you must either be running as SYSTEM or have the process account have the > "act as part of the operating system" OS privilege to call LogonUser on > Win2K. > > Joe K. > > -- > Joe Kaplan-MS MVP Directory Services Programming > Co-author of "The .NET Developer's Guide to Directory Services Programming" > http://www.directoryprogramming.net > -- > "Lee" <lee.walton@ngtuk.com> wrote in message > news:4C97245A-6820-4118-A674-31C90CCE52F4@microsoft.com... > > Thanks for your time guys, yes to confirm the OS is w2k > > > > "Dominick Baier" wrote: > > > >> Hi, > >> > >> which OS are you using? On W2K you need SYSTEM privileges to call > >> LogonUser... > >> > >> dominick > >> www.leastprivilege.com > >> > >> > I am having problems trying to impersonate as a user in asp.net. > >> > > >> > I get an access denied error on the LogonUser method of the following > >> > code; > >> > > >> > /// <summary> > >> > /// Summary description for CustomWindowsIdentity. > >> > /// </summary> > >> > public class CustomWindowsIdentity : WindowsIdentity > >> > { > >> > [DllImport("advapi32.dll", SetLastError=true)] > >> > private static extern int LogonUser(String lpszUsername, String > >> > lpszDomain, String lpszPassword, > >> > int dwLogonType, int dwLogonProvider, out int phToken); > >> > [DllImport("kernel32.dll")] > >> > private static extern int GetLastError(); > >> > public CustomWindowsIdentity( string domain, string username, string > >> > password ) : > >> > base( CustomWindowsIdentity.LogonUser(domain,username,password) ) > >> > { > >> > } > >> > > >> > //-------------------------------------------------------------------- > >> > ------ > >> > // Impersonates as the supplied user. > >> > // Domain must be in standard NT format: e.g. "DOMAIN" > >> > > >> > //-------------------------------------------------------------------- > >> > ------ > >> > public static WindowsImpersonationContext Impersonate( string > >> > domain, > >> > string username, string password ) > >> > { > >> > IntPtr token = LogonUser( domain, username, password ); > >> > return WindowsIdentity.Impersonate( token ); > >> > } > >> > private static IntPtr LogonUser( string domain, string username, > >> > string > >> > password ) > >> > { > >> > int token = 0; > >> > int loggedOn = LogonUser( username, domain, password, > >> > 0x8, 0x0, > >> > //WindowsLogonType.NetworkClearText, > >> > //WindowsLogonProvider.Default, > >> > out token ); > >> > if (loggedOn==0 || token==0) > >> > { > >> > int ret = GetLastError(); > >> > //int ret = Marshal.GetLastWin32Error(); //GetLastError(); > >> > if (ret!=0) > >> > { > >> > WindowsIdentity currentUser = WindowsIdentity.GetCurrent(); > >> > throw new Win32Exception(ret,"DEBUG: " + > >> > currentUser.Name.ToString()); > >> > } > >> > } > >> > IntPtr tokenOut = new IntPtr( token ); > >> > > >> > return tokenOut; > >> > } > >> > } > >> > Its worth noting we are using a different user account for IIS > >> > anonymous > >> > authentication so the user that is trying to impersonate is > >> > 'DOMAIN\MY_READER'. > >> > This same code block works on the production environment so my > >> > thinking is > >> > that its a permission or setting missing for the specific user on the > >> > staging > >> > server? Ive even tried having IIS use an administrator account for > >> > anonymous > >> > access but get the same error? > >> > Any help, clues or pointers would be great. > >> > many thanks > >> > > >> > >> > >> > >
It sounds like that isn't the problem. That makes some sense, as normally
when that is the problem, GetLastError returns something like "a required privilege is not held by the client". I just checked the docs and it says that under Win2K, the ID must have the SE_CHANGE_NOTIFY_NAME (bypass traverse checking) privilege as well, or you will get the Access Denied, so I'd try that next. DO NOT leave act as part of the operating system set to everyone. It is a very dangerous privilege! There is a reason that not even administrators have it by default. Joe K. -- Joe Kaplan-MS MVP Directory Services Programming Co-author of "The .NET Developer's Guide to Directory Services Programming" http://www.directoryprogramming.net -- [quoted text, click to view] "Lee" <lee.walton@ngtuk.com> wrote in message news:F4789846-EFC7-4953-8150-CEEF72E0C4A9@microsoft.com... > Hi Joe, > just checking the code i posted and noticed a slight difference. I > modified > the code so it would output the user name in the error message > > throw new Win32Exception(ret,"DEBUG: " + currentUser.Name.ToString()); > > Ive looked at the Local security policy and the account has "act as part > of > the operating system" privellege? So when this didnt work i thought id > temporarily set 'Everyone' to have this privellege but still got the > access > denied error. Any suggestions on how to troubleshoot this? > > "Joe Kaplan" wrote: > >> I'd expect to see a different error returned than what you are getting >> (maybe there is some little coding difference), but the bottom line is >> that >> you must either be running as SYSTEM or have the process account have the >> "act as part of the operating system" OS privilege to call LogonUser on >> Win2K. >> >> Joe K. >> >> -- >> Joe Kaplan-MS MVP Directory Services Programming >> Co-author of "The .NET Developer's Guide to Directory Services >> Programming" >> http://www.directoryprogramming.net >> -- >> "Lee" <lee.walton@ngtuk.com> wrote in message >> news:4C97245A-6820-4118-A674-31C90CCE52F4@microsoft.com... >> > Thanks for your time guys, yes to confirm the OS is w2k >> > >> > "Dominick Baier" wrote: >> > >> >> Hi, >> >> >> >> which OS are you using? On W2K you need SYSTEM privileges to call >> >> LogonUser... >> >> >> >> dominick >> >> www.leastprivilege.com >> >> >> >> > I am having problems trying to impersonate as a user in asp.net. >> >> > >> >> > I get an access denied error on the LogonUser method of the >> >> > following >> >> > code; >> >> > >> >> > /// <summary> >> >> > /// Summary description for CustomWindowsIdentity. >> >> > /// </summary> >> >> > public class CustomWindowsIdentity : WindowsIdentity >> >> > { >> >> > [DllImport("advapi32.dll", SetLastError=true)] >> >> > private static extern int LogonUser(String lpszUsername, String >> >> > lpszDomain, String lpszPassword, >> >> > int dwLogonType, int dwLogonProvider, out int phToken); >> >> > [DllImport("kernel32.dll")] >> >> > private static extern int GetLastError(); >> >> > public CustomWindowsIdentity( string domain, string username, string >> >> > password ) : >> >> > base( CustomWindowsIdentity.LogonUser(domain,username,password) ) >> >> > { >> >> > } >> >> > >> >> > //-------------------------------------------------------------------- >> >> > ------ >> >> > // Impersonates as the supplied user. >> >> > // Domain must be in standard NT format: e.g. "DOMAIN" >> >> > >> >> > //-------------------------------------------------------------------- >> >> > ------ >> >> > public static WindowsImpersonationContext Impersonate( string >> >> > domain, >> >> > string username, string password ) >> >> > { >> >> > IntPtr token = LogonUser( domain, username, password ); >> >> > return WindowsIdentity.Impersonate( token ); >> >> > } >> >> > private static IntPtr LogonUser( string domain, string username, >> >> > string >> >> > password ) >> >> > { >> >> > int token = 0; >> >> > int loggedOn = LogonUser( username, domain, password, >> >> > 0x8, 0x0, >> >> > //WindowsLogonType.NetworkClearText, >> >> > //WindowsLogonProvider.Default, >> >> > out token ); >> >> > if (loggedOn==0 || token==0) >> >> > { >> >> > int ret = GetLastError(); >> >> > //int ret = Marshal.GetLastWin32Error(); //GetLastError(); >> >> > if (ret!=0) >> >> > { >> >> > WindowsIdentity currentUser = WindowsIdentity.GetCurrent(); >> >> > throw new Win32Exception(ret,"DEBUG: " + >> >> > currentUser.Name.ToString()); >> >> > } >> >> > } >> >> > IntPtr tokenOut = new IntPtr( token ); >> >> > >> >> > return tokenOut; >> >> > } >> >> > } >> >> > Its worth noting we are using a different user account for IIS >> >> > anonymous >> >> > authentication so the user that is trying to impersonate is >> >> > 'DOMAIN\MY_READER'. >> >> > This same code block works on the production environment so my >> >> > thinking is >> >> > that its a permission or setting missing for the specific user on >> >> > the >> >> > staging >> >> > server? Ive even tried having IIS use an administrator account for >> >> > anonymous >> >> > access but get the same error? >> >> > Any help, clues or pointers would be great. >> >> > many thanks >> >> > >> >> >> >> >> >> >> >> >>
Joe - really appreciate your efforts on this one, i will try the privilege
mentioned next and let you know how it goes. I was investigating the problem today and managed to get it to work by setting impersonate in the web.config to false. Although this seemed to get around the problem im apprehensive about saying the problem is resolved as the web.config on my other server has impersonate set to true?! Oh and no worries i changed the the Everyone setting straight back! Thanks once again, Lee [quoted text, click to view] "Joe Kaplan" wrote:
> It sounds like that isn't the problem. That makes some sense, as normally > when that is the problem, GetLastError returns something like "a required > privilege is not held by the client". > > I just checked the docs and it says that under Win2K, the ID must have the > SE_CHANGE_NOTIFY_NAME (bypass traverse checking) privilege as well, or you > will get the Access Denied, so I'd try that next. > > DO NOT leave act as part of the operating system set to everyone. It is a > very dangerous privilege! There is a reason that not even administrators > have it by default. > > Joe K. > > -- > Joe Kaplan-MS MVP Directory Services Programming > Co-author of "The .NET Developer's Guide to Directory Services Programming" > http://www.directoryprogramming.net > -- > "Lee" <lee.walton@ngtuk.com> wrote in message > news:F4789846-EFC7-4953-8150-CEEF72E0C4A9@microsoft.com... > > Hi Joe, > > just checking the code i posted and noticed a slight difference. I > > modified > > the code so it would output the user name in the error message > > > > throw new Win32Exception(ret,"DEBUG: " + currentUser.Name.ToString()); > > > > Ive looked at the Local security policy and the account has "act as part > > of > > the operating system" privellege? So when this didnt work i thought id > > temporarily set 'Everyone' to have this privellege but still got the > > access > > denied error. Any suggestions on how to troubleshoot this? > > > > "Joe Kaplan" wrote: > > > >> I'd expect to see a different error returned than what you are getting > >> (maybe there is some little coding difference), but the bottom line is > >> that > >> you must either be running as SYSTEM or have the process account have the > >> "act as part of the operating system" OS privilege to call LogonUser on > >> Win2K. > >> > >> Joe K. > >> > >> -- > >> Joe Kaplan-MS MVP Directory Services Programming > >> Co-author of "The .NET Developer's Guide to Directory Services > >> Programming" > >> http://www.directoryprogramming.net > >> -- > >> "Lee" <lee.walton@ngtuk.com> wrote in message > >> news:4C97245A-6820-4118-A674-31C90CCE52F4@microsoft.com... > >> > Thanks for your time guys, yes to confirm the OS is w2k > >> > > >> > "Dominick Baier" wrote: > >> > > >> >> Hi, > >> >> > >> >> which OS are you using? On W2K you need SYSTEM privileges to call > >> >> LogonUser... > >> >> > >> >> dominick > >> >> www.leastprivilege.com > >> >> > >> >> > I am having problems trying to impersonate as a user in asp.net. > >> >> > > >> >> > I get an access denied error on the LogonUser method of the > >> >> > following > >> >> > code; > >> >> > > >> >> > /// <summary> > >> >> > /// Summary description for CustomWindowsIdentity. > >> >> > /// </summary> > >> >> > public class CustomWindowsIdentity : WindowsIdentity > >> >> > { > >> >> > [DllImport("advapi32.dll", SetLastError=true)] > >> >> > private static extern int LogonUser(String lpszUsername, String > >> >> > lpszDomain, String lpszPassword, > >> >> > int dwLogonType, int dwLogonProvider, out int phToken); > >> >> > [DllImport("kernel32.dll")] > >> >> > private static extern int GetLastError(); > >> >> > public CustomWindowsIdentity( string domain, string username, string > >> >> > password ) : > >> >> > base( CustomWindowsIdentity.LogonUser(domain,username,password) ) > >> >> > { > >> >> > } > >> >> > > >> >> > //-------------------------------------------------------------------- > >> >> > ------ > >> >> > // Impersonates as the supplied user. > >> >> > // Domain must be in standard NT format: e.g. "DOMAIN" > >> >> > > >> >> > //-------------------------------------------------------------------- > >> >> > ------ > >> >> > public static WindowsImpersonationContext Impersonate( string > >> >> > domain, > >> >> > string username, string password ) > >> >> > { > >> >> > IntPtr token = LogonUser( domain, username, password ); > >> >> > return WindowsIdentity.Impersonate( token ); > >> >> > } > >> >> > private static IntPtr LogonUser( string domain, string username, > >> >> > string > >> >> > password ) > >> >> > { > >> >> > int token = 0; > >> >> > int loggedOn = LogonUser( username, domain, password, > >> >> > 0x8, 0x0, > >> >> > //WindowsLogonType.NetworkClearText, > >> >> > //WindowsLogonProvider.Default, > >> >> > out token ); > >> >> > if (loggedOn==0 || token==0) > >> >> > { > >> >> > int ret = GetLastError(); > >> >> > //int ret = Marshal.GetLastWin32Error(); //GetLastError(); > >> >> > if (ret!=0) > >> >> > { > >> >> > WindowsIdentity currentUser = WindowsIdentity.GetCurrent(); > >> >> > throw new Win32Exception(ret,"DEBUG: " + > >> >> > currentUser.Name.ToString()); > >> >> > } > >> >> > } > >> >> > IntPtr tokenOut = new IntPtr( token ); > >> >> > > >> >> > return tokenOut; > >> >> > } > >> >> > } > >> >> > Its worth noting we are using a different user account for IIS > >> >> > anonymous > >> >> > authentication so the user that is trying to impersonate is > >> >> > 'DOMAIN\MY_READER'. > >> >> > This same code block works on the production environment so my > >> >> > thinking is > >> >> > that its a permission or setting missing for the specific user on > >> >> > the > >> >> > staging > >> >> > server? Ive even tried having IIS use an administrator account for > >> >> > anonymous > >> >> > access but get the same error? > >> >> > Any help, clues or pointers would be great. > >> >> > many thanks > >> >> > > >> >> > >> >> > >> >> > >> > >> > >> > >
Don't see what you're looking for? Try a search.
|
July 2003
August 2003
September 2003
October 2003
November 2003
December 2003
January 2004
February 2004
March 2004
April 2004
May 2004
June 2004
July 2004
August 2004
September 2004
October 2004
November 2004
December 2004
January 2005
February 2005
March 2005
April 2005
May 2005
June 2005
July 2005
August 2005
September 2005
October 2005
November 2005
December 2005
January 2006
February 2006
March 2006
April 2006
May 2006
June 2006
July 2006
August 2006
September 2006
October 2006
November 2006
December 2006
January 2007
February 2007
March 2007
April 2007
May 2007
June 2007
July 2007
August 2007
September 2007
October 2007
November 2007
December 2007
January 2008
February 2008
March 2008
April 2008
May 2008
June 2008
| home · blog · groups | Questions? Comments? Contact the dn |