How to start a process from a WCF service with IIS support?

Question

I would like to start the process from the intranet client on the WCF service side. In my case, the client asks the server to create a new process on the server in accordance with the credentials provided. WCF service is hosted on IIS 7.5 and I am starting the process using this code

var processInfo = new ProcessStartInfo("C:\\Windows\\System32\\notepad.exe") { UserName = "some user", Password = MakeSecureString("some password"), UseShellExecute = false, LoadUserProfile = true }; Process process = Process.Start(processInfo); 

This code works if I host the WCF service as a standalone console application under the administrator’s control, and I see that notepad runs under a different user. It does not work in IIS without exception, but the process ends immediately

 process.HasExited = true; process.ExitCode = -1073741502; 

In an IIS application, WCF runs as a user with administrator privileges and has full trust defined in web.config. I cannot use a self-service application because it does not support easy continuous delivery (for example, WebDeploy with IIS web farms).

Q: How to start a server-side process from a WCF service hosted in IIS?

EDIT:
I came across this post with similar problems and I tried all the methods there, including all the possible options for Process.Start and P / Invoke with CreateProcessWithLogonW and CreateProcessAsUser. I also tried to provide additional permissions to users. Non of this will work with error messages identical to those sent by the guy.

Answer 1

Oleksii, the fact is that if you host the WCF service in a console application, a Windows session is performed for this user (user login and Windows Explorer), and notepad is opened and displayed for this user, so you see this in the user interface.

when you host your WCF service in IIS as a server, IIS requires and does not allow user interaction and also works if no user is logged in; in this context, there is no user interface for hosting your notebook or other applications with the interface turned on, you can perform the development process or other batch tasks, but do not visualize the Windows user interface application because Windows Explorer is not loaded for you, and there is no place to visualize process user interface.

Answer 2

this is what i use to call GnuPGP for encryption. How does your setup compare?

 private int ExecuteCommand(string arguments, string passPhrase, int timeout) { Process processObject; ProcessStartInfo pInfo = new ProcessStartInfo(_executablePath, arguments); pInfo.CreateNoWindow = true; pInfo.UseShellExecute = false; pInfo.RedirectStandardInput = true; pInfo.RedirectStandardOutput = true; pInfo.RedirectStandardError = true; processObject = Process.Start(pInfo); if (!string.IsNullOrEmpty(passPhrase)) { processObject.StandardInput.WriteLine(passPhrase); processObject.StandardInput.Flush(); } string result = processObject.StandardOutput.ReadToEnd(); string error = processObject.StandardError.ReadToEnd(); if (!processObject.WaitForExit(timeout)) { throw new TimeoutException("GnuPG operation timeout. Waited " + timeout + " milliseconds "); } int exitcode = processObject.ExitCode; Error = error; Output = result; return exitcode; } 

Answer 3

There is an apppool parameter here to make sure it loads the user profile.

 loadUserProfile Optional Boolean attribute. Specifies whether IIS loads the user profile for the application pool identity. Setting this value to false causes IIS to revert to IIS 6.0 behavior. IIS 6.0 does not load the user profile for an application pool identity. The default value is false. 

This, along with the fact that the domain user is a person with sufficient permission, can work? I know that, at a minimum, the user will need a user profile.

However, this is a bit of a weird architecture. It seems that the best arch will have an ongoing process, such as the Windows service the site is linked to, but I'm not sure what your limitations are.

Hope this helps.