LogonUser using LOGON32_LOGON_NEW_CREDENTIALS works with a remote untrusted domain machine

Question

Thus, there is no trust between the two machines - they are in different domains.

I successfully connected to the remote computer using the LogonUser API using the login type, LOGON32_LOGON_NEW_CREDENTIALS. I can get the contents of the directory using the UNC share and create a file stream to “download” the file. So far so good.

The only problem is that it seems that LogonUser fails if there is no session already open. Let me clarify this.

I found that the ASP.NET MVC page did not work today, namely the page that retrieves the list of files from this remote machine using LogonUser. I look at the log and I see in stacktrace, System.IO .__ Error.WinIOError over a call to Directory.GetFiles. Then I deleted to the web server and tried to open the remote folder in Explorer using the same username / password that is used on the website. He passed, and I saw the files. I opened a command prompt, typed net use, and I see that there is an open connection to the remote machine. Then I returned to the page and the page works again.

So, at the moment I'm not quite sure if LogonUser is working as expected or not. If a call requires the network connection to be opened first in other ways, this is certainly not satisfactory.

Does anyone know what might happen or suggest a workaround?

Answer 1

I'm not sure I understand why you are using LogonUser . This function will help you if you want to do some work on the machine local with other user credentials, but it helps not to establish a remote connection to another computer.

If you want to receive some information from a remote computer, independent of the existing trust between the computer, you must use the WNet or Net (Network Management) functions to establish a new connection to the remote computer. Therefore, you should use WNetAddConnection2 (see http://msdn.microsoft.com/en-us/library/aa385413%28VS.85%29.aspx ) or NetUseAdd ( http://msdn.microsoft.com/en-us /library/aa370645%28VS.85%29.aspx ). This function will make remote login on the destination computer and establish a new session (exactly what net use \\computer\share /u:domain\user password do). You cannot map a new connection to a local drive. To do this, you must fill in lpLocalName NULL in the NETRESOURCE structure. For lpUsername and lpPassword you must specify any values ​​that the destination computer understands. You can also use ipc$ as a general-purpose name, and then just establish a session on the computer and nothing more. After that, you can use any other functions to access the remote share, directory or files. To close a session, you must use WNetCancelConnection2 or NetUseDel .

Answer 2

This is how you logonuser on a remote computer. Make sure you use LOGON32_LOGON_NEW_CREDENTIALS, LOGON32_PROVIDER_WINNT50. Then personify the token. This way you cannot do many remote things without WNetAddConnection2. WNetAddConnection2 is not very good, because the connection can be destroyed by many things. LogonUser will also make the appropriate connection, if required, with a few api calls.

 PXERR impersonate_user(LPCWSTR lpszUserName, LPCWSTR lpszDomain, LPCWSTR lpszPassword) { HANDLE token; if(!LogonUserW(lpszUserName, lpszDomain, lpszPassword, LOGON32_LOGON_NEW_CREDENTIALS, LOGON32_PROVIDER_WINNT50, &token)) { return PXERR_IMPERSONATION_FAILURE; } if(!ImpersonateLoggedOnUser(token)) { CloseHandle(token); RevertToSelf(); return PXERR_IMPERSONATION_FAILURE; } CloseHandle(token); return PXERR_SUCCESS; }