Beginning of the process and impersonation

Question

I have a problem running processes in a transformed context in ASP.NET 2.0.

I am starting a new process in my web service code. IIS 5.1, .NET 2.0

[WebMethod] public string HelloWorld() { string path = @"C:\KB\GetWindowUser.exe"; ProcessStartInfo startInfo = new ProcessStartInfo(); startInfo.WorkingDirectory = Path.GetDirectoryName(path); startInfo.FileName = path; startInfo.UseShellExecute = false; startInfo.CreateNoWindow = true; startInfo.ErrorDialog = false; startInfo.RedirectStandardOutput = true; startInfo.RedirectStandardError = true; Process docCreateProcess = Process.Start(startInfo); string errors = docCreateProcess.StandardError.ReadToEnd(); string output = docCreateProcess.StandardOutput.ReadToEnd(); } 

"C: \ KB \ GetWindowUser.exe" is a console application containing the following code:

 static void Main(string[] args) { Console.WriteLine("Windows: " + WindowsIdentity.GetCurrent().Name); } 

When I call a web service without impersonation, everything works fine.

When I turn on impersonation, the following error is written to the "errors" variable in the web service code:

Unhandled exception: System.Security.SecurityException: access denied. \ r \ n \ r \ n in System.Security.Principal.WindowsIdentity.GetCurrentInternal (TokenAccessLevels wishAccess, Boolean threadOnly) \ r \ n in System.Security. Principal.WindowsIdentity.GetCurrent () \ r \ n in ObfuscatedMdc.Program.Main (String [] args) \ r \ nConfiguring a failed assembly: \ r \ nMyComputer

The outstanding user is the local administrator and has access to the executable C: \ KB \ GetWindowUser.exe.

When I specify the user of the window explicitly in the properties of the ProcesStartInfo Domain, User and Password, I received the following message: http://img201.imageshack.us/img201/5870/pstartah8.jpg

Is it possible to start a process with different credentials than ASPNET from asp.net (IIS 5.1)?

Answer 1

You must put the privileged code in the GAC (or run with full trust).

The code in the GAC must approve XXXPermission, where XXX is what you request, whether it is impersonation, access to the hard drive, or what you have.

You must return the afterword immediately.

You must make sure that the API in your DLL that you put in the GAC does not have the potential for abuse. For example, if you are writing a website that allows users to back up the server using a command line application, your API should publish a method like "BackUp ()" rather than "LaunchAribitraryProcess (string)"

The web.config file must also be configured to impersonate, or you will run into NTFS resolution issues as well as CAS.

Here is the full explanation .

Answer 2

You can also try wrapping your code inside

 using (Impersonator person = new Impersonator("domainName", "userName", "password") { // do something requiring special permissions } 

as stated at http://www.devnewsgroups.net/group/microsoft.public.dotnet.framework.windowsforms/topic62740.aspx

Answer 3

What exactly are you trying to do? I cannot understand what is the point of your code when creating another executable file. It looks pretty weird. It might be more useful to indicate a problem with business tasks that you are trying to solve in the first place.

Answer 4

It looks like you are trying to force the IIS service to impersonate a user with higher privileges than the service itself (in this case, the administrator). Windows blocks this as a security hole, because at this point you basically ask someone to take your system. There may be a way around this limitation, but don’t do it - it’s for your own good.

Instead, IIS will impersonate a user with limited rights who has exactly the rights that you need. For example. create a user account that owns only the folders that you want your web service to write, or some other combination of rights. If you impersonate a limited user, you will not see this error code, but you can still call the benign executable that you have.