Re: Trouble using LogonUser

NEW_CREDENTIAL also works in p2p scenarios - but the credentials will only
be checked when you access a remote resource.


HTH

cheers,
dominick

-----------------------------
Dominick Baier, DevelopMentor
http://www.leastprivilege.com


-----Original Message-----
From: Discussion relating to the specifics of the C# and Managed C++
languages [mailto:[email protected]] On Behalf Of Mont Rothstein
Sent: Mittwoch, 2. August 2006 22:35
To: [email protected]
Subject: Re: [DOTNET-CX] Trouble using LogonUser

Sorry, I wasn't clear.  The outer/inner were my terms.

What I am doing is nesting WindowsImpersonationContexts, i.e. as user A I
impersonate user B, and then without calling Undo I impersonate user C.
When I am done performing actions as user C I undo both contexts.

Why do I want to do this?  I want to do this because I need to run the
application as a user (B) other than the one logged in (A) and perform
certain operations as an admin user (C).

I'll take a look at NEW_CREDENTIAL, but I suspect I will have to have the
computer on the domain.

Thanks for the help,
-Mont


On 8/2/06, Dominick Baier <[email protected]> wrote:
>
> Hi,
>
> there are no outer/inner impersonation users.
>
> There is a process identity and some token you use as a thread identity.
> You
> need this privilege to impersonate, that's right.
>
> So I guess your process runs as a domain user and you try to
> impersonate a domain admin right to access local resources?
>
> right?
>
>
> re a)
>
> no. sorry. There is the NEW_CREDENTIAL logon type in LogonUser - this
> will verify credentials when you impersonate and try to access a
> remote resource.
> But besides that you need a trust relationship with that domain where
> the account resides.
>
>
>
>
> cheers,
> dominick
>
> -----------------------------
> Dominick Baier, DevelopMentor
> http://www.leastprivilege.com
>
>
> -----Original Message-----
> From: Discussion relating to the specifics of the C# and Managed C++
> languages [mailto:[email protected]] On Behalf Of Mont
> Rothstein
> Sent: Mittwoch, 2. August 2006 21:36
> To: [email protected]
> Subject: Re: [DOTNET-CX] Trouble using LogonUser
>
> a) I was starting to get that impression.  Is there some other method
> (other than LogonUser) to authenticate a user against a domain and get
> an access token?
>
> b) The outer impersonated user is a domain user and the inner
> impersonated user is a domain admin.  I think I have this half figured
> out.  I discovered the "Impersonate a client after authentication"
> local security policy.  If I add the user running the app to this
> policy then the nesting works, or at lest my single File.Create on the
> local machine works.
>
> I worry that the impersonation level still reporting as None means
> that at some point (adding/removing ACEs?) I am not going to be able
> to perform some action I want to as the impersonated user.
>
> Any ideas how/where I change the impersonation level?
>
> Thanks,
> -Mont
>
>
> On 8/2/06, Dominick Baier <[email protected]> wrote:
> >
> > Hi,
> >
> > a) not that's not possible
> > b) what nested impersonation/users?
> >
> >
> >
> >
> > cheers,
> > dominick
> >
> > -----------------------------
> > Dominick Baier, DevelopMentor
> > http://www.leastprivilege.com
> >
> >
> > -----Original Message-----
> > From: Discussion relating to the specifics of the C# and Managed C++
> > languages [mailto:[email protected]] On Behalf Of Mont
> > Rothstein
> > Sent: Mittwoch, 2. August 2006 20:51
> > To: [email protected]
> > Subject: [DOTNET-CX] Trouble using LogonUser
> >
> > I am running into a couple of problems using LogonUser().
> >
> > My first problem is that I can't seem to authenticate a user against
> > a domain in which the computer is not a member.  Is this possible?
> >
> > Second, I am having problems with nested impersonations.  When I
> > nest impersonations they succeed (the current user is the nested
> > impersonated
> > user) but a File.Create() operation complains that I do not have the
> > proper impersonation level.  Impersonating the nested user directly
> > works fine.  In both cases my impersonation level reports as None,
> > but I can't figure out how to change this.
> >
> > Thanks,
> > -Mont
> >
> > ===================================
> > This list is hosted by DevelopMentorR  http://www.develop.com
> >
> > View archives and manage your subscription(s) at
> > http://discuss.develop.com
> >
> > ===================================
> > This list is hosted by DevelopMentor(r)  http://www.develop.com
> >
> > View archives and manage your subscription(s) at
> > http://discuss.develop.com
> >
>
> ===================================
> This list is hosted by DevelopMentorR  http://www.develop.com
>
> View archives and manage your subscription(s) at
> http://discuss.develop.com
>
> ===================================
> This list is hosted by DevelopMentor(r)  http://www.develop.com
>
> View archives and manage your subscription(s) at
> http://discuss.develop.com
>

===================================
This list is hosted by DevelopMentorR  http://www.develop.com

View archives and manage your subscription(s) at http://discuss.develop.com

===================================
This list is hosted by DevelopMentor®  http://www.develop.com

View archives and manage your subscription(s) at http://discuss.develop.com