Velocity Reviews - Computer Hardware Reviews

Velocity Reviews > Newsgroups > Programming > ASP .Net > ASP .Net Security > Setting impersonation values programmatically

Reply
Thread Tools

Setting impersonation values programmatically

 
 
itmanager
Guest
Posts: n/a
 
      09-14-2006
We have an ASP.NET application (v1.1) that requires some impersonation in
order to access network shares.

We have the following setting in the web.config file:

<identity impersonate="true" />

This allows the application to access network shares if the web site is
using Basic or Integrated Windows authentication; however, when using
Anonymous Authentication, it fails unless we also specify a user name and
password in clear text within the file; ie:

<identity impersonate="true"

userName="domain\user"
password="password" />

Due to security concerns, we do not want to specify this information in
clear text.

Is there a way to impersonate a particular user programmatically rather than
entering the value in the web.config file? Can this be done without resorting
to impersonation within a service?

Thanks for any assistance.

 
Reply With Quote
 
 
 
 
Joe Kaplan
Guest
Posts: n/a
 
      09-14-2006
The "canonical" sample is shown in the .NET Framework MSDN reference on the
WindowsImpersonationContext class documentation. You can basically copy and
paste that. There are some subtle flaws in this implementation, and Shawn
Farkas has written more about how to do this "the right way" on his blog.
Google will find it.

Joe K.

--
Joe Kaplan-MS MVP Directory Services Programming
Co-author of "The .NET Developer's Guide to Directory Services Programming"
http://www.directoryprogramming.net
--
"itmanager" <(E-Mail Removed)> wrote in message
news:(E-Mail Removed)...
> We have an ASP.NET application (v1.1) that requires some impersonation in
> order to access network shares.
>
> We have the following setting in the web.config file:
>
> <identity impersonate="true" />
>
> This allows the application to access network shares if the web site is
> using Basic or Integrated Windows authentication; however, when using
> Anonymous Authentication, it fails unless we also specify a user name and
> password in clear text within the file; ie:
>
> <identity impersonate="true"
>
> userName="domain\user"
> password="password" />
>
> Due to security concerns, we do not want to specify this information in
> clear text.
>
> Is there a way to impersonate a particular user programmatically rather
> than
> entering the value in the web.config file? Can this be done without
> resorting
> to impersonation within a service?
>
> Thanks for any assistance.
>



 
Reply With Quote
 
 
 
Reply

Thread Tools

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is On
HTML code is Off
Trackbacks are On
Pingbacks are On
Refbacks are Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
Programmatically adding a user control and setting values alun65@gmail.com ASP .Net 6 01-17-2008 11:19 PM
programmatically login using LDAP and impersonation bob ASP .Net Security 9 11-14-2006 02:35 AM
Programmatically getting impersonation and anonymous user name =?Utf-8?B?amVzdGVy?= ASP .Net 1 09-23-2004 05:04 PM
Disable impersonation programmatically? Tobias Lekman ASP .Net Security 0 11-03-2003 02:04 PM
localizing web form without setting values programmatically Philipp Sumi ASP .Net 2 07-23-2003 09:27 AM



Advertisments