Either the required impersonation level has not been provided, or the impersonation level specified is not valid.

Question

I am having problems with WCF service and impersonation, I redid this to a simple method below. Currently, the WCF service is hosted exe on its own. Exclusion message: "Either the required impersonation level was not provided, or the provided impersonation level is invalid." Checking when the error was selected, the Identiment ImpersonationLevel is configured for delegation, as indicated on my client, and its authentication through Kerberos.

I am a little puzzled, as it seems to me that the requirements of ImpersonationLevel and Authenticaiton are met. I think the problem is probably related to the domain settings that I installed and I think that they are installed correctly. Therefore, I have two questions:

• If the operation below will be successful? (or is it wrong?)
• What settings need to be configured in the Win2k8 domain to make it work? I work with two mailboxes that are members of the same Win2k8 domain (its new domain and pretty vanilla for the purpose of impersonation testing).

Enter the code as follows:

[OperationBehavior(Impersonation = ImpersonationOption.Required)] public string Test() { WindowsIdentity identity = ServiceSecurityContext.Current.WindowsIdentity; using (identity.Impersonate()) { ProcessStartInfo pi = new ProcessStartInfo(@"c:\temp\test.bat"); pi.UseShellExecute = false; pi.RedirectStandardOutput = true; Process p = Process.Start(pi); // exception thrown here! p.WaitForExit(); string o = p.StandardOutput.ReadToEnd(); return o; } } 

Exception Details:

 Win32Exception occurred: Either a required impersonation level was not provided, or the provided impersonation level is invalid at System.Diagnostics.Process.CreatePipeWithSecurityAttributes(SafeFileHandle& hReadPipe, SafeFileHandle& hWritePipe, SECURITY_ATTRIBUTES lpPipeAttributes, Int32 nSize) at System.Diagnostics.Process.CreatePipe(SafeFileHandle& parentHandle, SafeFileHandle& childHandle, Boolean parentInputs) at System.Diagnostics.Process.StartWithCreateProcess(ProcessStartInfo startInfo) at System.Diagnostics.Process.Start() at System.Diagnostics.Process.Start(ProcessStartInfo startInfo) at MonetEnterprise.Service.SecurityService.Test() 

Test.bat file contents

echo% username%

Answer 1

• The disadvantage is that while you use the .NET Process class, it will always start with the identity of the parent process. To run it under a different identifier, it looks like you need to use win32 api CreateProcessAsUser (which does not work for me yet).

• I needed to run it with a higher level (for example, Visual Studio as an administrator).