| Groups | Blog | Home |
asp.net security : Impersonate on specific directory
I need to enable Impersonation in order to access a network share from an ASP.NET application. Unfortunately when I do this it enables it for the entire application which causes other issues, how would I do this for a particular folder? Thanks in advance for your time. Nick.
Hi Nick,
From your description, you want to access some shared folder in the ASP.NET application, however, due to the security protection, you need to do impersonate, and currently encounter some problems with the impersonate, correct? Regarding on this issue, I'd like to confirm the following things: ** Are you in a domain environment, for both the ASP.NET server machine and the remote share folder's machine ** How did you do the impersonate currrently. Are you impersonate the ASP.NET client user account( through windows authentication) or use a fixed account in web.config to do the impersonate? Based on my experince, if the ASP.NET application need to access another remote machine's protected resource(such as file share), impersontating client user(who access the ASP.NET application) will not work due to double hop limitation. You need to do impersonate with a clear text username/password so as to establish a security token that can forward across from ASP.NET server to remote share folder machine. For the question that you want to only impersonate the context when accessing a particular file share, I think you can consider do impersonate programmatically. You can make impersonate call only in method where you want to access remote share and undo it after finished. #How To: Use Impersonation and Delegation in ASP.NET 2.0 http://msdn.microsoft.com/en-us/library/ms998351.aspx Sincerely, Steven Cheng Microsoft MSDN Online Support Lead Delighting our customers is our #1 priority. We welcome your comments and suggestions about how we can improve the support we provide to you. Please feel free to let my manager know what you think of the level of service provided. You can send feedback directly to my manager at: msdnmg@microsoft.com. ================================================== Get notification to my posts through email? Please refer to http://msdn.microsoft.com/subscriptions/managednewsgroups/default.aspx#notif ications. Note: The MSDN Managed Newsgroup support offering is for non-urgent issues where an initial response from the community or a Microsoft Support Engineer within 1 business day is acceptable. Please note that each follow up response may take approximately 2 business days as the support professional working with you may need further investigation to reach the most efficient resolution. The offering is not appropriate for situations that require urgent, real-time or phone-based interactions or complex project analysis and dump analysis issues. Issues of this nature are best handled working with a dedicated Microsoft Support Engineer by contacting Microsoft Customer Support Services (CSS) at http://msdn.microsoft.com/subscriptions/support/default.aspx. ================================================== This posting is provided "AS IS" with no warranties, and confers no rights. -------------------- [quoted text, click to view] >From: "Nick" <a@a.com>
>Subject: Impersonate on specific directory >Date: Mon, 19 May 2008 15:09:42 +0100 >Hi there, > > I need to enable Impersonation in order to access a network share from >an ASP.NET application. Unfortunately when I do this it enables it for the >entire application which causes other issues, how would I do this for a >particular folder? > > Thanks in advance for your time. > >Nick. > > >
Hi Nick,
Does the suggestion in my last reply help you some? If you have anything unclear or need any other help, welcome to post here. Sincerely, Steven Cheng Microsoft MSDN Online Support Lead Delighting our customers is our #1 priority. We welcome your comments and suggestions about how we can improve the support we provide to you. Please feel free to let my manager know what you think of the level of service provided. You can send feedback directly to my manager at: msdnmg@microsoft.com. ================================================== Get notification to my posts through email? Please refer to http://msdn.microsoft.com/subscriptions/managednewsgroups/default.aspx#notif ications. ================================================== This posting is provided "AS IS" with no warranties, and confers no rights. --------------------t [quoted text, click to view] >From: stcheng@online.microsoft.com (Steven Cheng [MSFT])
>Organization: Microsoft >Date: Tue, 20 May 2008 03:59:45 GMT >Subject: RE: Impersonate on specific directory > >Hi Nick, > >From your description, you want to access some shared folder in the ASP.NET >application, however, due to the security protection, you need to do >impersonate, and currently encounter some problems with the impersonate, >correct? > >Regarding on this issue, I'd like to confirm the following things: > >** Are you in a domain environment, for both the ASP.NET server machine and >the remote share folder's machine > >** How did you do the impersonate currrently. Are you impersonate the >ASP.NET client user account( through windows authentication) or use a fixed >account in web.config to do the impersonate? > >Based on my experince, if the ASP.NET application need to access another >remote machine's protected resource(such as file share), impersontating >client user(who access the ASP.NET application) will not work due to double >hop limitation. You need to do impersonate with a clear text >username/password so as to establish a security token that can forward >across from ASP.NET server to remote share folder machine. > >For the question that you want to only impersonate the context when >accessing a particular file share, I think you can consider do impersonate >programmatically. You can make impersonate call only in method where you >want to access remote share and undo it after finished. > >#How To: Use Impersonation and Delegation in ASP.NET 2.0 >http://msdn.microsoft.com/en-us/library/ms998351.aspx > >Sincerely, > >Steven Cheng > >Microsoft MSDN Online Support Lead > > >Delighting our customers is our #1 priority. We welcome your comments and >suggestions about how we can improve the support we provide to you. Please >feel free to let my manager know what you think of the level of service >provided. You can send feedback directly to my manager at: >msdnmg@microsoft.com. > >================================================== >Get notification to my posts through email? Please refer to >http://msdn.microsoft.com/subscriptions/managednewsgroups/default.aspx#noti f >ications. > >Note: The MSDN Managed Newsgroup support offering is for non-urgent issues >where an initial response from the community or a Microsoft Support >Engineer within 1 business day is acceptable. Please note that each follow >up response may take approximately 2 business days as the support >professional working with you may need further investigation to reach the >most efficient resolution. The offering is not appropriate for situations >that require urgent, real-time or phone-based interactions or complex >project analysis and dump analysis issues. Issues of this nature are best >handled working with a dedicated Microsoft Support Engineer by contacting >Microsoft Customer Support Services (CSS) at >http://msdn.microsoft.com/subscriptions/support/default.aspx. >================================================== >This posting is provided "AS IS" with no warranties, and confers no rights. > > > >-------------------- >>From: "Nick" <a@a.com> >>Subject: Impersonate on specific directory >>Date: Mon, 19 May 2008 15:09:42 +0100 > >>Hi there, >> >> I need to enable Impersonation in order to access a network share from >>an ASP.NET application. Unfortunately when I do this it enables it for >the >>entire application which causes other issues, how would I do this for a >>particular folder? >> >> Thanks in advance for your time. >> >>Nick. >> >> >> > >
Hi Steven
Thankyou for your help, I fixed this by creating a class that calls the Win32 LogonUser function on demand, this stops having to enable impersonation for the entire application. Anyone else doing this should consider cashing the indentity as repeat calling of the API can cause resources to expire pretty quick in a live application. Thanks for your time and help. Nick. [quoted text, click to view] "Steven Cheng [MSFT]" <stcheng@online.microsoft.com> wrote in message news:TBj7FR%23uIHA.1788@TK2MSFTNGHUB02.phx.gbl... > Hi Nick, > > Does the suggestion in my last reply help you some? If you have anything > unclear or need any other help, welcome to post here. > > Sincerely, > > Steven Cheng > > Microsoft MSDN Online Support Lead > > > Delighting our customers is our #1 priority. We welcome your comments and > suggestions about how we can improve the support we provide to you. Please > feel free to let my manager know what you think of the level of service > provided. You can send feedback directly to my manager at: > msdnmg@microsoft.com. > > ================================================== > Get notification to my posts through email? Please refer to > http://msdn.microsoft.com/subscriptions/managednewsgroups/default.aspx#notif > ications. > > ================================================== > This posting is provided "AS IS" with no warranties, and confers no > rights. > --------------------t >>From: stcheng@online.microsoft.com (Steven Cheng [MSFT]) >>Organization: Microsoft >>Date: Tue, 20 May 2008 03:59:45 GMT >>Subject: RE: Impersonate on specific directory > >> >>Hi Nick, >> >>From your description, you want to access some shared folder in the > ASP.NET >>application, however, due to the security protection, you need to do >>impersonate, and currently encounter some problems with the impersonate, >>correct? >> >>Regarding on this issue, I'd like to confirm the following things: >> >>** Are you in a domain environment, for both the ASP.NET server machine > and >>the remote share folder's machine >> >>** How did you do the impersonate currrently. Are you impersonate the >>ASP.NET client user account( through windows authentication) or use a > fixed >>account in web.config to do the impersonate? >> >>Based on my experince, if the ASP.NET application need to access another >>remote machine's protected resource(such as file share), impersontating >>client user(who access the ASP.NET application) will not work due to > double >>hop limitation. You need to do impersonate with a clear text >>username/password so as to establish a security token that can forward >>across from ASP.NET server to remote share folder machine. >> >>For the question that you want to only impersonate the context when >>accessing a particular file share, I think you can consider do impersonate >>programmatically. You can make impersonate call only in method where you >>want to access remote share and undo it after finished. >> >>#How To: Use Impersonation and Delegation in ASP.NET 2.0 >>http://msdn.microsoft.com/en-us/library/ms998351.aspx >> >>Sincerely, >> >>Steven Cheng >> >>Microsoft MSDN Online Support Lead >> >> >>Delighting our customers is our #1 priority. We welcome your comments and >>suggestions about how we can improve the support we provide to you. Please >>feel free to let my manager know what you think of the level of service >>provided. You can send feedback directly to my manager at: >>msdnmg@microsoft.com. >> >>================================================== >>Get notification to my posts through email? Please refer to >>http://msdn.microsoft.com/subscriptions/managednewsgroups/default.aspx#noti > f >>ications. >> >>Note: The MSDN Managed Newsgroup support offering is for non-urgent issues >>where an initial response from the community or a Microsoft Support >>Engineer within 1 business day is acceptable. Please note that each follow >>up response may take approximately 2 business days as the support >>professional working with you may need further investigation to reach the >>most efficient resolution. The offering is not appropriate for situations >>that require urgent, real-time or phone-based interactions or complex >>project analysis and dump analysis issues. Issues of this nature are best >>handled working with a dedicated Microsoft Support Engineer by contacting >>Microsoft Customer Support Services (CSS) at >>http://msdn.microsoft.com/subscriptions/support/default.aspx. >>================================================== >>This posting is provided "AS IS" with no warranties, and confers no >>rights. >> >> >> >>-------------------- >>>From: "Nick" <a@a.com> >>>Subject: Impersonate on specific directory >>>Date: Mon, 19 May 2008 15:09:42 +0100 >> >>>Hi there, >>> >>> I need to enable Impersonation in order to access a network share > from >>>an ASP.NET application. Unfortunately when I do this it enables it for >>the >>>entire application which causes other issues, how would I do this for a >>>particular folder? >>> >>> Thanks in advance for your time. >>> >>>Nick. >>> >>> >>> >> >> >
Thanks for your reply Nick,
I'm glad that you've got it resolved. Have a nice day! Sincerely, Steven Cheng Microsoft MSDN Online Support Lead Delighting our customers is our #1 priority. We welcome your comments and suggestions about how we can improve the support we provide to you. Please feel free to let my manager know what you think of the level of service provided. You can send feedback directly to my manager at: msdnmg@microsoft.com. ================================================== Get notification to my posts through email? Please refer to http://msdn.microsoft.com/subscriptions/managednewsgroups/default.aspx#notif ications. This posting is provided "AS IS" with no warranties, and confers no rights. -------------------- [quoted text, click to view] >From: "Nick" <a@a.com> <rxSC43iuIHA.4512@TK2MSFTNGHUB02.phx.gbl> >References: <#RmU$nbuIHA.548@TK2MSFTNGP06.phx.gbl> <TBj7FR#uIHA.1788@TK2MSFTNGHUB02.phx.gbl> [quoted text, click to view] >Subject: Re: Impersonate on specific directory
>Date: Fri, 30 May 2008 12:16:06 +0100 >Hi Steven > > Thankyou for your help, I fixed this by creating a class that calls the >Win32 LogonUser function on demand, this stops having to enable >impersonation for the entire application. Anyone else doing this should >consider cashing the indentity as repeat calling of the API can cause >resources to expire pretty quick in a live application. > > Thanks for your time and help. > >Nick. > >"Steven Cheng [MSFT]" <stcheng@online.microsoft.com> wrote in message >news:TBj7FR%23uIHA.1788@TK2MSFTNGHUB02.phx.gbl... >> Hi Nick, >> >> Does the suggestion in my last reply help you some? If you have anything >> unclear or need any other help, welcome to post here. >> >> Sincerely, >> >> Steven Cheng >> >> Microsoft MSDN Online Support Lead >> >> >> Delighting our customers is our #1 priority. We welcome your comments and >> suggestions about how we can improve the support we provide to you. Please >> feel free to let my manager know what you think of the level of service >> provided. You can send feedback directly to my manager at: >> msdnmg@microsoft.com. >> >>>>> >>>>Hi there, >>>> >>>> I need to enable Impersonation in order to access a network share >> from >>>>an ASP.NET application. Unfortunately when I do this it enables it for >>>the >>>>entire application which causes other issues, how would I do this for a >>>>particular folder? >>>> >>>> Thanks in advance for your time. >>>> >>>>Nick. >>>> >>>> >>>> >>> >>> >> > > >
Don't see what you're looking for? Try a search.
|
July 2003
August 2003
September 2003
October 2003
November 2003
December 2003
January 2004
February 2004
March 2004
April 2004
May 2004
June 2004
July 2004
August 2004
September 2004
October 2004
November 2004
December 2004
January 2005
February 2005
March 2005
April 2005
May 2005
June 2005
July 2005
August 2005
September 2005
October 2005
November 2005
December 2005
January 2006
February 2006
March 2006
April 2006
May 2006
June 2006
July 2006
August 2006
September 2006
October 2006
November 2006
December 2006
January 2007
February 2007
March 2007
April 2007
May 2007
June 2007
July 2007
August 2007
September 2007
October 2007
November 2007
December 2007
January 2008
February 2008
March 2008
April 2008
May 2008
June 2008
| home · blog · groups | Questions? Comments? Contact the dn |