Re: Trouble using LogonUser

Hi,

there are no outer/inner impersonation users.

There is a process identity and some token you use as a thread identity. You
need this privilege to impersonate, that's right.

So I guess your process runs as a domain user and you try to impersonate a
domain admin right to access local resources?

right?


re a)

no. sorry. There is the NEW_CREDENTIAL logon type in LogonUser - this will
verify credentials when you impersonate and try to access a remote resource.
But besides that you need a trust relationship with that domain where the
account resides.




cheers,
dominick

-----------------------------
Dominick Baier, DevelopMentor
http://www.leastprivilege.com


-----Original Message-----
From: Discussion relating to the specifics of the C# and Managed C++
languages [mailto:[email protected]] On Behalf Of Mont Rothstein
Sent: Mittwoch, 2. August 2006 21:36
To: [email protected]
Subject: Re: [DOTNET-CX] Trouble using LogonUser

a) I was starting to get that impression.  Is there some other method (other
than LogonUser) to authenticate a user against a domain and get an access
token?

b) The outer impersonated user is a domain user and the inner impersonated
user is a domain admin.  I think I have this half figured out.  I discovered
the "Impersonate a client after authentication" local security policy.  If I
add the user running the app to this policy then the nesting works, or at
lest my single File.Create on the local machine works.

I worry that the impersonation level still reporting as None means that at
some point (adding/removing ACEs?) I am not going to be able to perform some
action I want to as the impersonated user.

Any ideas how/where I change the impersonation level?

Thanks,
-Mont


On 8/2/06, Dominick Baier <[email protected]> wrote:
>
> Hi,
>
> a) not that's not possible
> b) what nested impersonation/users?
>
>
>
>
> cheers,
> dominick
>
> -----------------------------
> Dominick Baier, DevelopMentor
> http://www.leastprivilege.com
>
>
> -----Original Message-----
> From: Discussion relating to the specifics of the C# and Managed C++
> languages [mailto:[email protected]] On Behalf Of Mont
> Rothstein
> Sent: Mittwoch, 2. August 2006 20:51
> To: [email protected]
> Subject: [DOTNET-CX] Trouble using LogonUser
>
> I am running into a couple of problems using LogonUser().
>
> My first problem is that I can't seem to authenticate a user against a
> domain in which the computer is not a member.  Is this possible?
>
> Second, I am having problems with nested impersonations.  When I nest
> impersonations they succeed (the current user is the nested
> impersonated
> user) but a File.Create() operation complains that I do not have the
> proper impersonation level.  Impersonating the nested user directly
> works fine.  In both cases my impersonation level reports as None, but
> I can't figure out how to change this.
>
> Thanks,
> -Mont
>
> ===================================
> This list is hosted by DevelopMentorR  http://www.develop.com
>
> View archives and manage your subscription(s) at
> http://discuss.develop.com
>
> ===================================
> This list is hosted by DevelopMentor(r)  http://www.develop.com
>
> View archives and manage your subscription(s) at
> http://discuss.develop.com
>

===================================
This list is hosted by DevelopMentorR  http://www.develop.com

View archives and manage your subscription(s) at http://discuss.develop.com

===================================
This list is hosted by DevelopMentor®  http://www.develop.com

View archives and manage your subscription(s) at http://discuss.develop.com