Velocity Reviews - Computer Hardware Reviews

Velocity Reviews > Newsgroups > Programming > ASP .Net > ASP .Net Security > LogonUser access denied

Reply
Thread Tools

LogonUser access denied

 
 
Lee
Guest
Posts: n/a
 
      08-16-2006
I am having problems trying to impersonate as a user in asp.net.

I get an access denied error on the LogonUser method of the following code;

/// <summary>
/// Summary description for CustomWindowsIdentity.
/// </summary>
public class CustomWindowsIdentity : WindowsIdentity
{
[DllImport("advapi32.dll", SetLastError=true)]
private static extern int LogonUser(String lpszUsername, String
lpszDomain, String lpszPassword,
int dwLogonType, int dwLogonProvider, out int phToken);

[DllImport("kernel32.dll")]
private static extern int GetLastError();

public CustomWindowsIdentity( string domain, string username, string
password ) :
base( CustomWindowsIdentity.LogonUser(domain,username,pa ssword) )
{
}

//--------------------------------------------------------------------------
// Impersonates as the supplied user.
// Domain must be in standard NT format: e.g. "DOMAIN"
//--------------------------------------------------------------------------
public static WindowsImpersonationContext Impersonate( string domain,
string username, string password )
{
IntPtr token = LogonUser( domain, username, password );

return WindowsIdentity.Impersonate( token );
}

private static IntPtr LogonUser( string domain, string username, string
password )
{
int token = 0;

int loggedOn = LogonUser( username, domain, password,
0x8, 0x0,
//WindowsLogonType.NetworkClearText,
//WindowsLogonProvider.Default,
out token );

if (loggedOn==0 || token==0)
{
int ret = GetLastError();
//int ret = Marshal.GetLastWin32Error(); //GetLastError();

if (ret!=0)
{
WindowsIdentity currentUser = WindowsIdentity.GetCurrent();

throw new Win32Exception(ret,"DEBUG: " + currentUser.Name.ToString());
}
}

IntPtr tokenOut = new IntPtr( token );

return tokenOut;
}
}

Its worth noting we are using a different user account for IIS anonymous
authentication so the user that is trying to impersonate is
'DOMAIN\MY_READER'.
This same code block works on the production environment so my thinking is
that its a permission or setting missing for the specific user on the staging
server? Ive even tried having IIS use an administrator account for anonymous
access but get the same error?
Any help, clues or pointers would be great.

many thanks
 
Reply With Quote
 
 
 
 
Joe Kaplan \(MVP - ADSI\)
Guest
Posts: n/a
 
      08-18-2006
This would probably be the appropriate forum for this question, yes.

Can you show the exact exception and stack trace?

Joe K.

--
Joe Kaplan-MS MVP Directory Services Programming
Co-author of "The .NET Developer's Guide to Directory Services Programming"
http://www.directoryprogramming.net
--
"Lee" <(E-Mail Removed)> wrote in message
news(E-Mail Removed)...
> Is this the right forum for this question?
>
> "Lee" wrote:
>
>> I am having problems trying to impersonate as a user in asp.net.
>>
>> I get an access denied error on the LogonUser method of the following
>> code;
>>
>> /// <summary>
>> /// Summary description for CustomWindowsIdentity.
>> /// </summary>
>> public class CustomWindowsIdentity : WindowsIdentity
>> {
>> [DllImport("advapi32.dll", SetLastError=true)]
>> private static extern int LogonUser(String lpszUsername, String
>> lpszDomain, String lpszPassword,
>> int dwLogonType, int dwLogonProvider, out int phToken);
>>
>> [DllImport("kernel32.dll")]
>> private static extern int GetLastError();
>>
>> public CustomWindowsIdentity( string domain, string username, string
>> password ) :
>> base( CustomWindowsIdentity.LogonUser(domain,username,pa ssword) )
>> {
>> }
>>
>> //--------------------------------------------------------------------------
>> // Impersonates as the supplied user.
>> // Domain must be in standard NT format: e.g. "DOMAIN"
>> //--------------------------------------------------------------------------
>> public static WindowsImpersonationContext Impersonate( string domain,
>> string username, string password )
>> {
>> IntPtr token = LogonUser( domain, username, password );
>>
>> return WindowsIdentity.Impersonate( token );
>> }
>>
>> private static IntPtr LogonUser( string domain, string username, string
>> password )
>> {
>> int token = 0;
>>
>> int loggedOn = LogonUser( username, domain, password,
>> 0x8, 0x0,
>> //WindowsLogonType.NetworkClearText,
>> //WindowsLogonProvider.Default,
>> out token );
>>
>> if (loggedOn==0 || token==0)
>> {
>> int ret = GetLastError();
>> //int ret = Marshal.GetLastWin32Error(); //GetLastError();
>>
>> if (ret!=0)
>> {
>> WindowsIdentity currentUser = WindowsIdentity.GetCurrent();
>>
>> throw new Win32Exception(ret,"DEBUG: " + currentUser.Name.ToString());
>> }
>> }
>>
>> IntPtr tokenOut = new IntPtr( token );
>>
>> return tokenOut;
>> }
>> }
>>
>> Its worth noting we are using a different user account for IIS anonymous
>> authentication so the user that is trying to impersonate is
>> 'DOMAIN\MY_READER'.
>> This same code block works on the production environment so my thinking
>> is
>> that its a permission or setting missing for the specific user on the
>> staging
>> server? Ive even tried having IIS use an administrator account for
>> anonymous
>> access but get the same error?
>> Any help, clues or pointers would be great.
>>
>> many thanks



 
Reply With Quote
 
 
 
 
Dominick Baier
Guest
Posts: n/a
 
      08-19-2006
Hi,

which OS are you using? On W2K you need SYSTEM privileges to call LogonUser...

dominick
www.leastprivilege.com

> I am having problems trying to impersonate as a user in asp.net.
>
> I get an access denied error on the LogonUser method of the following
> code;
>
> /// <summary>
> /// Summary description for CustomWindowsIdentity.
> /// </summary>
> public class CustomWindowsIdentity : WindowsIdentity
> {
> [DllImport("advapi32.dll", SetLastError=true)]
> private static extern int LogonUser(String lpszUsername, String
> lpszDomain, String lpszPassword,
> int dwLogonType, int dwLogonProvider, out int phToken);
> [DllImport("kernel32.dll")]
> private static extern int GetLastError();
> public CustomWindowsIdentity( string domain, string username, string
> password ) :
> base( CustomWindowsIdentity.LogonUser(domain,username,pa ssword) )
> {
> }
>
> //--------------------------------------------------------------------
> ------
> // Impersonates as the supplied user.
> // Domain must be in standard NT format: e.g. "DOMAIN"
>
> //--------------------------------------------------------------------
> ------
> public static WindowsImpersonationContext Impersonate( string
> domain,
> string username, string password )
> {
> IntPtr token = LogonUser( domain, username, password );
> return WindowsIdentity.Impersonate( token );
> }
> private static IntPtr LogonUser( string domain, string username,
> string
> password )
> {
> int token = 0;
> int loggedOn = LogonUser( username, domain, password,
> 0x8, 0x0,
> //WindowsLogonType.NetworkClearText,
> //WindowsLogonProvider.Default,
> out token );
> if (loggedOn==0 || token==0)
> {
> int ret = GetLastError();
> //int ret = Marshal.GetLastWin32Error(); //GetLastError();
> if (ret!=0)
> {
> WindowsIdentity currentUser = WindowsIdentity.GetCurrent();
> throw new Win32Exception(ret,"DEBUG: " +
> currentUser.Name.ToString());
> }
> }
> IntPtr tokenOut = new IntPtr( token );
>
> return tokenOut;
> }
> }
> Its worth noting we are using a different user account for IIS
> anonymous
> authentication so the user that is trying to impersonate is
> 'DOMAIN\MY_READER'.
> This same code block works on the production environment so my
> thinking is
> that its a permission or setting missing for the specific user on the
> staging
> server? Ive even tried having IIS use an administrator account for
> anonymous
> access but get the same error?
> Any help, clues or pointers would be great.
> many thanks
>



 
Reply With Quote
 
Lee
Guest
Posts: n/a
 
      08-22-2006
Thanks Joe, the expception and stack trace is as follows.

Exception Details: System.ComponentModel.Win32Exception: Access is denied

Stack Trace:

[Win32Exception (0x80004005): Access is denied]
UW.DirectoryServices.CustomWindowsIdentity.LogonUs er(String domain,
String username, String password)
UW.DirectoryServices.CustomWindowsIdentity.Imperso nate(String domain,
String username, String password)
UW.DirectoryServices.ADSAdmin.Load()
UW.DirectoryServices.ADSAdmin.LoadDirectory(String domain, String
organizationalunit, String loginUsername, String loginPassword)
UW.DirectoryServices.ADSAdmin..ctor(String domain, String
organizationalunit, String loginUsername, String loginPassword)
Project.Web.Common.Template.ValidateUsers.GetADSAd min()
Project.Web.Common.Template.ValidateUsers.GetADUse rs()
Project.Web.Common.Template.ValidateUsers.GetDBUse rsNotMatched()
Project.Web.Common.Template.ValidateUsers.ShowDBUs ersNotMatched()
Project.Web.Common.Template.ValidateUsers.Page_Loa d(Object sender,
EventArgs e)
System.Web.UI.Control.OnLoad(EventArgs e) +67
System.Web.UI.Control.LoadRecursive() +35
System.Web.UI.Control.LoadRecursive() +98
System.Web.UI.Control.LoadRecursive() +98
System.Web.UI.Control.LoadRecursive() +98
System.Web.UI.Page.ProcessRequestMain() +739

"Joe Kaplan (MVP - ADSI)" wrote:

> This would probably be the appropriate forum for this question, yes.
>
> Can you show the exact exception and stack trace?
>
> Joe K.
>
> --
> Joe Kaplan-MS MVP Directory Services Programming
> Co-author of "The .NET Developer's Guide to Directory Services Programming"
> http://www.directoryprogramming.net
> --
> "Lee" <(E-Mail Removed)> wrote in message
> news(E-Mail Removed)...
> > Is this the right forum for this question?
> >
> > "Lee" wrote:
> >
> >> I am having problems trying to impersonate as a user in asp.net.
> >>
> >> I get an access denied error on the LogonUser method of the following
> >> code;
> >>
> >> /// <summary>
> >> /// Summary description for CustomWindowsIdentity.
> >> /// </summary>
> >> public class CustomWindowsIdentity : WindowsIdentity
> >> {
> >> [DllImport("advapi32.dll", SetLastError=true)]
> >> private static extern int LogonUser(String lpszUsername, String
> >> lpszDomain, String lpszPassword,
> >> int dwLogonType, int dwLogonProvider, out int phToken);
> >>
> >> [DllImport("kernel32.dll")]
> >> private static extern int GetLastError();
> >>
> >> public CustomWindowsIdentity( string domain, string username, string
> >> password ) :
> >> base( CustomWindowsIdentity.LogonUser(domain,username,pa ssword) )
> >> {
> >> }
> >>
> >> //--------------------------------------------------------------------------
> >> // Impersonates as the supplied user.
> >> // Domain must be in standard NT format: e.g. "DOMAIN"
> >> //--------------------------------------------------------------------------
> >> public static WindowsImpersonationContext Impersonate( string domain,
> >> string username, string password )
> >> {
> >> IntPtr token = LogonUser( domain, username, password );
> >>
> >> return WindowsIdentity.Impersonate( token );
> >> }
> >>
> >> private static IntPtr LogonUser( string domain, string username, string
> >> password )
> >> {
> >> int token = 0;
> >>
> >> int loggedOn = LogonUser( username, domain, password,
> >> 0x8, 0x0,
> >> //WindowsLogonType.NetworkClearText,
> >> //WindowsLogonProvider.Default,
> >> out token );
> >>
> >> if (loggedOn==0 || token==0)
> >> {
> >> int ret = GetLastError();
> >> //int ret = Marshal.GetLastWin32Error(); //GetLastError();
> >>
> >> if (ret!=0)
> >> {
> >> WindowsIdentity currentUser = WindowsIdentity.GetCurrent();
> >>
> >> throw new Win32Exception(ret,"DEBUG: " + currentUser.Name.ToString());
> >> }
> >> }
> >>
> >> IntPtr tokenOut = new IntPtr( token );
> >>
> >> return tokenOut;
> >> }
> >> }
> >>
> >> Its worth noting we are using a different user account for IIS anonymous
> >> authentication so the user that is trying to impersonate is
> >> 'DOMAIN\MY_READER'.
> >> This same code block works on the production environment so my thinking
> >> is
> >> that its a permission or setting missing for the specific user on the
> >> staging
> >> server? Ive even tried having IIS use an administrator account for
> >> anonymous
> >> access but get the same error?
> >> Any help, clues or pointers would be great.
> >>
> >> many thanks

>
>
>

 
Reply With Quote
 
Joe Kaplan
Guest
Posts: n/a
 
      08-23-2006
I agree with Dominick's reply, but the thing is that you usually get an
error indicating that a required privilege was not held by the client, not
the straight access denied. I've not actually seen that particular problem.

I'm not sure what the deal is here.

Is the OS Win2K?

Joe K.

--
Joe Kaplan-MS MVP Directory Services Programming
Co-author of "The .NET Developer's Guide to Directory Services Programming"
http://www.directoryprogramming.net
--
"Lee" <(E-Mail Removed)> wrote in message
news:(E-Mail Removed)...
> Thanks Joe, the expception and stack trace is as follows.
>
> Exception Details: System.ComponentModel.Win32Exception: Access is denied
>
> Stack Trace:
>
> [Win32Exception (0x80004005): Access is denied]
> UW.DirectoryServices.CustomWindowsIdentity.LogonUs er(String domain,
> String username, String password)
> UW.DirectoryServices.CustomWindowsIdentity.Imperso nate(String domain,
> String username, String password)
> UW.DirectoryServices.ADSAdmin.Load()
> UW.DirectoryServices.ADSAdmin.LoadDirectory(String domain, String
> organizationalunit, String loginUsername, String loginPassword)
> UW.DirectoryServices.ADSAdmin..ctor(String domain, String
> organizationalunit, String loginUsername, String loginPassword)
> Project.Web.Common.Template.ValidateUsers.GetADSAd min()
> Project.Web.Common.Template.ValidateUsers.GetADUse rs()
> Project.Web.Common.Template.ValidateUsers.GetDBUse rsNotMatched()
> Project.Web.Common.Template.ValidateUsers.ShowDBUs ersNotMatched()
> Project.Web.Common.Template.ValidateUsers.Page_Loa d(Object sender,
> EventArgs e)
> System.Web.UI.Control.OnLoad(EventArgs e) +67
> System.Web.UI.Control.LoadRecursive() +35
> System.Web.UI.Control.LoadRecursive() +98
> System.Web.UI.Control.LoadRecursive() +98
> System.Web.UI.Control.LoadRecursive() +98
> System.Web.UI.Page.ProcessRequestMain() +739
>
> "Joe Kaplan (MVP - ADSI)" wrote:
>
>> This would probably be the appropriate forum for this question, yes.
>>
>> Can you show the exact exception and stack trace?
>>
>> Joe K.
>>
>> --
>> Joe Kaplan-MS MVP Directory Services Programming
>> Co-author of "The .NET Developer's Guide to Directory Services
>> Programming"
>> http://www.directoryprogramming.net
>> --
>> "Lee" <(E-Mail Removed)> wrote in message
>> news(E-Mail Removed)...
>> > Is this the right forum for this question?
>> >
>> > "Lee" wrote:
>> >
>> >> I am having problems trying to impersonate as a user in asp.net.
>> >>
>> >> I get an access denied error on the LogonUser method of the following
>> >> code;
>> >>
>> >> /// <summary>
>> >> /// Summary description for CustomWindowsIdentity.
>> >> /// </summary>
>> >> public class CustomWindowsIdentity : WindowsIdentity
>> >> {
>> >> [DllImport("advapi32.dll", SetLastError=true)]
>> >> private static extern int LogonUser(String lpszUsername, String
>> >> lpszDomain, String lpszPassword,
>> >> int dwLogonType, int dwLogonProvider, out int phToken);
>> >>
>> >> [DllImport("kernel32.dll")]
>> >> private static extern int GetLastError();
>> >>
>> >> public CustomWindowsIdentity( string domain, string username, string
>> >> password ) :
>> >> base( CustomWindowsIdentity.LogonUser(domain,username,pa ssword) )
>> >> {
>> >> }
>> >>
>> >> //--------------------------------------------------------------------------
>> >> // Impersonates as the supplied user.
>> >> // Domain must be in standard NT format: e.g. "DOMAIN"
>> >> //--------------------------------------------------------------------------
>> >> public static WindowsImpersonationContext Impersonate( string domain,
>> >> string username, string password )
>> >> {
>> >> IntPtr token = LogonUser( domain, username, password );
>> >>
>> >> return WindowsIdentity.Impersonate( token );
>> >> }
>> >>
>> >> private static IntPtr LogonUser( string domain, string username,
>> >> string
>> >> password )
>> >> {
>> >> int token = 0;
>> >>
>> >> int loggedOn = LogonUser( username, domain, password,
>> >> 0x8, 0x0,
>> >> //WindowsLogonType.NetworkClearText,
>> >> //WindowsLogonProvider.Default,
>> >> out token );
>> >>
>> >> if (loggedOn==0 || token==0)
>> >> {
>> >> int ret = GetLastError();
>> >> //int ret = Marshal.GetLastWin32Error(); //GetLastError();
>> >>
>> >> if (ret!=0)
>> >> {
>> >> WindowsIdentity currentUser = WindowsIdentity.GetCurrent();
>> >>
>> >> throw new Win32Exception(ret,"DEBUG: " + currentUser.Name.ToString());
>> >> }
>> >> }
>> >>
>> >> IntPtr tokenOut = new IntPtr( token );
>> >>
>> >> return tokenOut;
>> >> }
>> >> }
>> >>
>> >> Its worth noting we are using a different user account for IIS
>> >> anonymous
>> >> authentication so the user that is trying to impersonate is
>> >> 'DOMAIN\MY_READER'.
>> >> This same code block works on the production environment so my
>> >> thinking
>> >> is
>> >> that its a permission or setting missing for the specific user on the
>> >> staging
>> >> server? Ive even tried having IIS use an administrator account for
>> >> anonymous
>> >> access but get the same error?
>> >> Any help, clues or pointers would be great.
>> >>
>> >> many thanks

>>
>>
>>



 
Reply With Quote
 
Lee
Guest
Posts: n/a
 
      08-23-2006
Thanks for your time guys, yes to confirm the OS is w2k

"Dominick Baier" wrote:

> Hi,
>
> which OS are you using? On W2K you need SYSTEM privileges to call LogonUser...
>
> dominick
> www.leastprivilege.com
>
> > I am having problems trying to impersonate as a user in asp.net.
> >
> > I get an access denied error on the LogonUser method of the following
> > code;
> >
> > /// <summary>
> > /// Summary description for CustomWindowsIdentity.
> > /// </summary>
> > public class CustomWindowsIdentity : WindowsIdentity
> > {
> > [DllImport("advapi32.dll", SetLastError=true)]
> > private static extern int LogonUser(String lpszUsername, String
> > lpszDomain, String lpszPassword,
> > int dwLogonType, int dwLogonProvider, out int phToken);
> > [DllImport("kernel32.dll")]
> > private static extern int GetLastError();
> > public CustomWindowsIdentity( string domain, string username, string
> > password ) :
> > base( CustomWindowsIdentity.LogonUser(domain,username,pa ssword) )
> > {
> > }
> >
> > //--------------------------------------------------------------------
> > ------
> > // Impersonates as the supplied user.
> > // Domain must be in standard NT format: e.g. "DOMAIN"
> >
> > //--------------------------------------------------------------------
> > ------
> > public static WindowsImpersonationContext Impersonate( string
> > domain,
> > string username, string password )
> > {
> > IntPtr token = LogonUser( domain, username, password );
> > return WindowsIdentity.Impersonate( token );
> > }
> > private static IntPtr LogonUser( string domain, string username,
> > string
> > password )
> > {
> > int token = 0;
> > int loggedOn = LogonUser( username, domain, password,
> > 0x8, 0x0,
> > //WindowsLogonType.NetworkClearText,
> > //WindowsLogonProvider.Default,
> > out token );
> > if (loggedOn==0 || token==0)
> > {
> > int ret = GetLastError();
> > //int ret = Marshal.GetLastWin32Error(); //GetLastError();
> > if (ret!=0)
> > {
> > WindowsIdentity currentUser = WindowsIdentity.GetCurrent();
> > throw new Win32Exception(ret,"DEBUG: " +
> > currentUser.Name.ToString());
> > }
> > }
> > IntPtr tokenOut = new IntPtr( token );
> >
> > return tokenOut;
> > }
> > }
> > Its worth noting we are using a different user account for IIS
> > anonymous
> > authentication so the user that is trying to impersonate is
> > 'DOMAIN\MY_READER'.
> > This same code block works on the production environment so my
> > thinking is
> > that its a permission or setting missing for the specific user on the
> > staging
> > server? Ive even tried having IIS use an administrator account for
> > anonymous
> > access but get the same error?
> > Any help, clues or pointers would be great.
> > many thanks
> >

>
>
>

 
Reply With Quote
 
Joe Kaplan
Guest
Posts: n/a
 
      08-23-2006
I'd expect to see a different error returned than what you are getting
(maybe there is some little coding difference), but the bottom line is that
you must either be running as SYSTEM or have the process account have the
"act as part of the operating system" OS privilege to call LogonUser on
Win2K.

Joe K.

--
Joe Kaplan-MS MVP Directory Services Programming
Co-author of "The .NET Developer's Guide to Directory Services Programming"
http://www.directoryprogramming.net
--
"Lee" <(E-Mail Removed)> wrote in message
news:(E-Mail Removed)...
> Thanks for your time guys, yes to confirm the OS is w2k
>
> "Dominick Baier" wrote:
>
>> Hi,
>>
>> which OS are you using? On W2K you need SYSTEM privileges to call
>> LogonUser...
>>
>> dominick
>> www.leastprivilege.com
>>
>> > I am having problems trying to impersonate as a user in asp.net.
>> >
>> > I get an access denied error on the LogonUser method of the following
>> > code;
>> >
>> > /// <summary>
>> > /// Summary description for CustomWindowsIdentity.
>> > /// </summary>
>> > public class CustomWindowsIdentity : WindowsIdentity
>> > {
>> > [DllImport("advapi32.dll", SetLastError=true)]
>> > private static extern int LogonUser(String lpszUsername, String
>> > lpszDomain, String lpszPassword,
>> > int dwLogonType, int dwLogonProvider, out int phToken);
>> > [DllImport("kernel32.dll")]
>> > private static extern int GetLastError();
>> > public CustomWindowsIdentity( string domain, string username, string
>> > password ) :
>> > base( CustomWindowsIdentity.LogonUser(domain,username,pa ssword) )
>> > {
>> > }
>> >
>> > //--------------------------------------------------------------------
>> > ------
>> > // Impersonates as the supplied user.
>> > // Domain must be in standard NT format: e.g. "DOMAIN"
>> >
>> > //--------------------------------------------------------------------
>> > ------
>> > public static WindowsImpersonationContext Impersonate( string
>> > domain,
>> > string username, string password )
>> > {
>> > IntPtr token = LogonUser( domain, username, password );
>> > return WindowsIdentity.Impersonate( token );
>> > }
>> > private static IntPtr LogonUser( string domain, string username,
>> > string
>> > password )
>> > {
>> > int token = 0;
>> > int loggedOn = LogonUser( username, domain, password,
>> > 0x8, 0x0,
>> > //WindowsLogonType.NetworkClearText,
>> > //WindowsLogonProvider.Default,
>> > out token );
>> > if (loggedOn==0 || token==0)
>> > {
>> > int ret = GetLastError();
>> > //int ret = Marshal.GetLastWin32Error(); //GetLastError();
>> > if (ret!=0)
>> > {
>> > WindowsIdentity currentUser = WindowsIdentity.GetCurrent();
>> > throw new Win32Exception(ret,"DEBUG: " +
>> > currentUser.Name.ToString());
>> > }
>> > }
>> > IntPtr tokenOut = new IntPtr( token );
>> >
>> > return tokenOut;
>> > }
>> > }
>> > Its worth noting we are using a different user account for IIS
>> > anonymous
>> > authentication so the user that is trying to impersonate is
>> > 'DOMAIN\MY_READER'.
>> > This same code block works on the production environment so my
>> > thinking is
>> > that its a permission or setting missing for the specific user on the
>> > staging
>> > server? Ive even tried having IIS use an administrator account for
>> > anonymous
>> > access but get the same error?
>> > Any help, clues or pointers would be great.
>> > many thanks
>> >

>>
>>
>>



 
Reply With Quote
 
Lee
Guest
Posts: n/a
 
      08-28-2006
Hi Joe,
just checking the code i posted and noticed a slight difference. I modified
the code so it would output the user name in the error message

throw new Win32Exception(ret,"DEBUG: " + currentUser.Name.ToString());

Ive looked at the Local security policy and the account has "act as part of
the operating system" privellege? So when this didnt work i thought id
temporarily set 'Everyone' to have this privellege but still got the access
denied error. Any suggestions on how to troubleshoot this?

"Joe Kaplan" wrote:

> I'd expect to see a different error returned than what you are getting
> (maybe there is some little coding difference), but the bottom line is that
> you must either be running as SYSTEM or have the process account have the
> "act as part of the operating system" OS privilege to call LogonUser on
> Win2K.
>
> Joe K.
>
> --
> Joe Kaplan-MS MVP Directory Services Programming
> Co-author of "The .NET Developer's Guide to Directory Services Programming"
> http://www.directoryprogramming.net
> --
> "Lee" <(E-Mail Removed)> wrote in message
> news:(E-Mail Removed)...
> > Thanks for your time guys, yes to confirm the OS is w2k
> >
> > "Dominick Baier" wrote:
> >
> >> Hi,
> >>
> >> which OS are you using? On W2K you need SYSTEM privileges to call
> >> LogonUser...
> >>
> >> dominick
> >> www.leastprivilege.com
> >>
> >> > I am having problems trying to impersonate as a user in asp.net.
> >> >
> >> > I get an access denied error on the LogonUser method of the following
> >> > code;
> >> >
> >> > /// <summary>
> >> > /// Summary description for CustomWindowsIdentity.
> >> > /// </summary>
> >> > public class CustomWindowsIdentity : WindowsIdentity
> >> > {
> >> > [DllImport("advapi32.dll", SetLastError=true)]
> >> > private static extern int LogonUser(String lpszUsername, String
> >> > lpszDomain, String lpszPassword,
> >> > int dwLogonType, int dwLogonProvider, out int phToken);
> >> > [DllImport("kernel32.dll")]
> >> > private static extern int GetLastError();
> >> > public CustomWindowsIdentity( string domain, string username, string
> >> > password ) :
> >> > base( CustomWindowsIdentity.LogonUser(domain,username,pa ssword) )
> >> > {
> >> > }
> >> >
> >> > //--------------------------------------------------------------------
> >> > ------
> >> > // Impersonates as the supplied user.
> >> > // Domain must be in standard NT format: e.g. "DOMAIN"
> >> >
> >> > //--------------------------------------------------------------------
> >> > ------
> >> > public static WindowsImpersonationContext Impersonate( string
> >> > domain,
> >> > string username, string password )
> >> > {
> >> > IntPtr token = LogonUser( domain, username, password );
> >> > return WindowsIdentity.Impersonate( token );
> >> > }
> >> > private static IntPtr LogonUser( string domain, string username,
> >> > string
> >> > password )
> >> > {
> >> > int token = 0;
> >> > int loggedOn = LogonUser( username, domain, password,
> >> > 0x8, 0x0,
> >> > //WindowsLogonType.NetworkClearText,
> >> > //WindowsLogonProvider.Default,
> >> > out token );
> >> > if (loggedOn==0 || token==0)
> >> > {
> >> > int ret = GetLastError();
> >> > //int ret = Marshal.GetLastWin32Error(); //GetLastError();
> >> > if (ret!=0)
> >> > {
> >> > WindowsIdentity currentUser = WindowsIdentity.GetCurrent();
> >> > throw new Win32Exception(ret,"DEBUG: " +
> >> > currentUser.Name.ToString());
> >> > }
> >> > }
> >> > IntPtr tokenOut = new IntPtr( token );
> >> >
> >> > return tokenOut;
> >> > }
> >> > }
> >> > Its worth noting we are using a different user account for IIS
> >> > anonymous
> >> > authentication so the user that is trying to impersonate is
> >> > 'DOMAIN\MY_READER'.
> >> > This same code block works on the production environment so my
> >> > thinking is
> >> > that its a permission or setting missing for the specific user on the
> >> > staging
> >> > server? Ive even tried having IIS use an administrator account for
> >> > anonymous
> >> > access but get the same error?
> >> > Any help, clues or pointers would be great.
> >> > many thanks
> >> >
> >>
> >>
> >>

>
>
>

 
Reply With Quote
 
Joe Kaplan
Guest
Posts: n/a
 
      08-28-2006
It sounds like that isn't the problem. That makes some sense, as normally
when that is the problem, GetLastError returns something like "a required
privilege is not held by the client".

I just checked the docs and it says that under Win2K, the ID must have the
SE_CHANGE_NOTIFY_NAME (bypass traverse checking) privilege as well, or you
will get the Access Denied, so I'd try that next.

DO NOT leave act as part of the operating system set to everyone. It is a
very dangerous privilege! There is a reason that not even administrators
have it by default.

Joe K.

--
Joe Kaplan-MS MVP Directory Services Programming
Co-author of "The .NET Developer's Guide to Directory Services Programming"
http://www.directoryprogramming.net
--
"Lee" <(E-Mail Removed)> wrote in message
news:(E-Mail Removed)...
> Hi Joe,
> just checking the code i posted and noticed a slight difference. I
> modified
> the code so it would output the user name in the error message
>
> throw new Win32Exception(ret,"DEBUG: " + currentUser.Name.ToString());
>
> Ive looked at the Local security policy and the account has "act as part
> of
> the operating system" privellege? So when this didnt work i thought id
> temporarily set 'Everyone' to have this privellege but still got the
> access
> denied error. Any suggestions on how to troubleshoot this?
>
> "Joe Kaplan" wrote:
>
>> I'd expect to see a different error returned than what you are getting
>> (maybe there is some little coding difference), but the bottom line is
>> that
>> you must either be running as SYSTEM or have the process account have the
>> "act as part of the operating system" OS privilege to call LogonUser on
>> Win2K.
>>
>> Joe K.
>>
>> --
>> Joe Kaplan-MS MVP Directory Services Programming
>> Co-author of "The .NET Developer's Guide to Directory Services
>> Programming"
>> http://www.directoryprogramming.net
>> --
>> "Lee" <(E-Mail Removed)> wrote in message
>> news:(E-Mail Removed)...
>> > Thanks for your time guys, yes to confirm the OS is w2k
>> >
>> > "Dominick Baier" wrote:
>> >
>> >> Hi,
>> >>
>> >> which OS are you using? On W2K you need SYSTEM privileges to call
>> >> LogonUser...
>> >>
>> >> dominick
>> >> www.leastprivilege.com
>> >>
>> >> > I am having problems trying to impersonate as a user in asp.net.
>> >> >
>> >> > I get an access denied error on the LogonUser method of the
>> >> > following
>> >> > code;
>> >> >
>> >> > /// <summary>
>> >> > /// Summary description for CustomWindowsIdentity.
>> >> > /// </summary>
>> >> > public class CustomWindowsIdentity : WindowsIdentity
>> >> > {
>> >> > [DllImport("advapi32.dll", SetLastError=true)]
>> >> > private static extern int LogonUser(String lpszUsername, String
>> >> > lpszDomain, String lpszPassword,
>> >> > int dwLogonType, int dwLogonProvider, out int phToken);
>> >> > [DllImport("kernel32.dll")]
>> >> > private static extern int GetLastError();
>> >> > public CustomWindowsIdentity( string domain, string username, string
>> >> > password ) :
>> >> > base( CustomWindowsIdentity.LogonUser(domain,username,pa ssword) )
>> >> > {
>> >> > }
>> >> >
>> >> > //--------------------------------------------------------------------
>> >> > ------
>> >> > // Impersonates as the supplied user.
>> >> > // Domain must be in standard NT format: e.g. "DOMAIN"
>> >> >
>> >> > //--------------------------------------------------------------------
>> >> > ------
>> >> > public static WindowsImpersonationContext Impersonate( string
>> >> > domain,
>> >> > string username, string password )
>> >> > {
>> >> > IntPtr token = LogonUser( domain, username, password );
>> >> > return WindowsIdentity.Impersonate( token );
>> >> > }
>> >> > private static IntPtr LogonUser( string domain, string username,
>> >> > string
>> >> > password )
>> >> > {
>> >> > int token = 0;
>> >> > int loggedOn = LogonUser( username, domain, password,
>> >> > 0x8, 0x0,
>> >> > //WindowsLogonType.NetworkClearText,
>> >> > //WindowsLogonProvider.Default,
>> >> > out token );
>> >> > if (loggedOn==0 || token==0)
>> >> > {
>> >> > int ret = GetLastError();
>> >> > //int ret = Marshal.GetLastWin32Error(); //GetLastError();
>> >> > if (ret!=0)
>> >> > {
>> >> > WindowsIdentity currentUser = WindowsIdentity.GetCurrent();
>> >> > throw new Win32Exception(ret,"DEBUG: " +
>> >> > currentUser.Name.ToString());
>> >> > }
>> >> > }
>> >> > IntPtr tokenOut = new IntPtr( token );
>> >> >
>> >> > return tokenOut;
>> >> > }
>> >> > }
>> >> > Its worth noting we are using a different user account for IIS
>> >> > anonymous
>> >> > authentication so the user that is trying to impersonate is
>> >> > 'DOMAIN\MY_READER'.
>> >> > This same code block works on the production environment so my
>> >> > thinking is
>> >> > that its a permission or setting missing for the specific user on
>> >> > the
>> >> > staging
>> >> > server? Ive even tried having IIS use an administrator account for
>> >> > anonymous
>> >> > access but get the same error?
>> >> > Any help, clues or pointers would be great.
>> >> > many thanks
>> >> >
>> >>
>> >>
>> >>

>>
>>
>>



 
Reply With Quote
 
Lee
Guest
Posts: n/a
 
      08-28-2006
Joe - really appreciate your efforts on this one, i will try the privilege
mentioned next and let you know how it goes. I was investigating the problem
today and managed to get it to work by setting impersonate in the web.config
to false. Although this seemed to get around the problem im apprehensive
about saying the problem is resolved as the web.config on my other server has
impersonate set to true?!

Oh and no worries i changed the the Everyone setting straight back!

Thanks once again,
Lee

"Joe Kaplan" wrote:

> It sounds like that isn't the problem. That makes some sense, as normally
> when that is the problem, GetLastError returns something like "a required
> privilege is not held by the client".
>
> I just checked the docs and it says that under Win2K, the ID must have the
> SE_CHANGE_NOTIFY_NAME (bypass traverse checking) privilege as well, or you
> will get the Access Denied, so I'd try that next.
>
> DO NOT leave act as part of the operating system set to everyone. It is a
> very dangerous privilege! There is a reason that not even administrators
> have it by default.
>
> Joe K.
>
> --
> Joe Kaplan-MS MVP Directory Services Programming
> Co-author of "The .NET Developer's Guide to Directory Services Programming"
> http://www.directoryprogramming.net
> --
> "Lee" <(E-Mail Removed)> wrote in message
> news:(E-Mail Removed)...
> > Hi Joe,
> > just checking the code i posted and noticed a slight difference. I
> > modified
> > the code so it would output the user name in the error message
> >
> > throw new Win32Exception(ret,"DEBUG: " + currentUser.Name.ToString());
> >
> > Ive looked at the Local security policy and the account has "act as part
> > of
> > the operating system" privellege? So when this didnt work i thought id
> > temporarily set 'Everyone' to have this privellege but still got the
> > access
> > denied error. Any suggestions on how to troubleshoot this?
> >
> > "Joe Kaplan" wrote:
> >
> >> I'd expect to see a different error returned than what you are getting
> >> (maybe there is some little coding difference), but the bottom line is
> >> that
> >> you must either be running as SYSTEM or have the process account have the
> >> "act as part of the operating system" OS privilege to call LogonUser on
> >> Win2K.
> >>
> >> Joe K.
> >>
> >> --
> >> Joe Kaplan-MS MVP Directory Services Programming
> >> Co-author of "The .NET Developer's Guide to Directory Services
> >> Programming"
> >> http://www.directoryprogramming.net
> >> --
> >> "Lee" <(E-Mail Removed)> wrote in message
> >> news:(E-Mail Removed)...
> >> > Thanks for your time guys, yes to confirm the OS is w2k
> >> >
> >> > "Dominick Baier" wrote:
> >> >
> >> >> Hi,
> >> >>
> >> >> which OS are you using? On W2K you need SYSTEM privileges to call
> >> >> LogonUser...
> >> >>
> >> >> dominick
> >> >> www.leastprivilege.com
> >> >>
> >> >> > I am having problems trying to impersonate as a user in asp.net.
> >> >> >
> >> >> > I get an access denied error on the LogonUser method of the
> >> >> > following
> >> >> > code;
> >> >> >
> >> >> > /// <summary>
> >> >> > /// Summary description for CustomWindowsIdentity.
> >> >> > /// </summary>
> >> >> > public class CustomWindowsIdentity : WindowsIdentity
> >> >> > {
> >> >> > [DllImport("advapi32.dll", SetLastError=true)]
> >> >> > private static extern int LogonUser(String lpszUsername, String
> >> >> > lpszDomain, String lpszPassword,
> >> >> > int dwLogonType, int dwLogonProvider, out int phToken);
> >> >> > [DllImport("kernel32.dll")]
> >> >> > private static extern int GetLastError();
> >> >> > public CustomWindowsIdentity( string domain, string username, string
> >> >> > password ) :
> >> >> > base( CustomWindowsIdentity.LogonUser(domain,username,pa ssword) )
> >> >> > {
> >> >> > }
> >> >> >
> >> >> > //--------------------------------------------------------------------
> >> >> > ------
> >> >> > // Impersonates as the supplied user.
> >> >> > // Domain must be in standard NT format: e.g. "DOMAIN"
> >> >> >
> >> >> > //--------------------------------------------------------------------
> >> >> > ------
> >> >> > public static WindowsImpersonationContext Impersonate( string
> >> >> > domain,
> >> >> > string username, string password )
> >> >> > {
> >> >> > IntPtr token = LogonUser( domain, username, password );
> >> >> > return WindowsIdentity.Impersonate( token );
> >> >> > }
> >> >> > private static IntPtr LogonUser( string domain, string username,
> >> >> > string
> >> >> > password )
> >> >> > {
> >> >> > int token = 0;
> >> >> > int loggedOn = LogonUser( username, domain, password,
> >> >> > 0x8, 0x0,
> >> >> > //WindowsLogonType.NetworkClearText,
> >> >> > //WindowsLogonProvider.Default,
> >> >> > out token );
> >> >> > if (loggedOn==0 || token==0)
> >> >> > {
> >> >> > int ret = GetLastError();
> >> >> > //int ret = Marshal.GetLastWin32Error(); //GetLastError();
> >> >> > if (ret!=0)
> >> >> > {
> >> >> > WindowsIdentity currentUser = WindowsIdentity.GetCurrent();
> >> >> > throw new Win32Exception(ret,"DEBUG: " +
> >> >> > currentUser.Name.ToString());
> >> >> > }
> >> >> > }
> >> >> > IntPtr tokenOut = new IntPtr( token );
> >> >> >
> >> >> > return tokenOut;
> >> >> > }
> >> >> > }
> >> >> > Its worth noting we are using a different user account for IIS
> >> >> > anonymous
> >> >> > authentication so the user that is trying to impersonate is
> >> >> > 'DOMAIN\MY_READER'.
> >> >> > This same code block works on the production environment so my
> >> >> > thinking is
> >> >> > that its a permission or setting missing for the specific user on
> >> >> > the
> >> >> > staging
> >> >> > server? Ive even tried having IIS use an administrator account for
> >> >> > anonymous
> >> >> > access but get the same error?
> >> >> > Any help, clues or pointers would be great.
> >> >> > many thanks
> >> >> >
> >> >>
> >> >>
> >> >>
> >>
> >>
> >>

>
>
>

 
Reply With Quote
 
 
 
Reply

Thread Tools

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is On
HTML code is Off
Trackbacks are On
Pingbacks are On
Refbacks are Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
Very annoying error: Access to the path is denied. ASP.NET is not authorized to access the requested resource. Consider granting access rights to the resource to the ASP.NET request identity Jay ASP .Net 2 08-20-2007 07:38 PM
LogonUser Access Denied Dominick Baier ASP .Net Security 2 10-10-2006 07:29 PM
403 Forbidden: You were denied access because: Access denied by access control list Southern Kiwi NZ Computing 6 03-19-2006 05:19 AM
To grant access to a protected directory use " impersonate" or " LogonUser"? Johannes Hammersen ASP .Net Security 1 06-12-2005 02:27 AM
Re: Impersonation in ASPNET and LogonUser Mary Chipman ASP .Net 0 09-03-2003 03:48 PM



Advertisments