Groups | Blog | Home
all groups > dotnet security > september 2004 >

dotnet security : Impersonation and SQL Connections



Clint
9/28/2004 7:41:04 AM
Hello all -

I'm having a problem concerning Impersonation while connecting to SQL
Server. I'm not sure if I'm posting this to the right newsgroups, so let me
know if it belongs elsewhere, and please excuse the cross-post.

I'm writing a Windows Forms application that makes direct calls to a SQL 2k
database. This application requires a user to log in, and confirms their
login and password with whatever they have in Active Directory. I had planned
for the program to use the credentials of the user logged into the
application (NOT Windows) when connecting to the SQL Server, but it seems
I've encountered a slight pitfall.

I've been reading that in this scenario, using simple Identity
Impersonation, the SQL Server will attempt to connect as "NT
AUTHORITY\ANONYMOUS LOGON" because of a limit to the impersonation context.

I'm having trouble believing that this is true. I can impersonate users in
ASP.NET just fine, and connect to databases using those credentials, but am
unable to do the same through a desktop application? It doesn't make all that
much sense, but then again, I'm somewhat of an amateur in this regard.

So, that said, can anyone provide any examples or help to get this working?
I'm happy to provide code samples, I just wasn't sure if it'd be necessary.

Thanks!
Shorty
9/28/2004 11:23:06 AM
Here is an excellent example of impersonation at MSDN:

http://msdn.microsoft.com/library/default.asp?url=/library/en-us/cpref/html/frlrfSystemSecurityPrincipalWindowsIdentityClassImpersonateTopic.asp

Shorty

[quoted text, click to view]
Clint
9/28/2004 11:35:06 AM
I knew I was missing something small and stupid. I wasn't using
LOGON32_LOGON_INTERACTIVE (2), I was using (3) ... whichever that value
stands for. Changed my API call to use 2, and everything works great.

Thanks!!


[quoted text, click to view]
AddThis Social Bookmark Button