IIS 7.5, .NET, Impersonation, And Access To C:WindowsTemp?
Jun 7, 2010
Summary: One of our web applications requires write access to C:WindowsTemp. However, no matter how much I weaken the NTFS permission, procmon shows ACCESS DENIED.Background (which might or might not be relevant for the problem): We are using OLEDB to access an MS Access database (which is located outside of C:WindowsTemp). Unfortunately, this OLEDB driver requires write access to the user profile's TEMP directory (which happens to be C:WindowsTemp when running under IIS 7.5), otherwise the dreaded "Unspecified Error" OleDbException is thrown.
I run a simple .aspx website on a Windows Server 2008 machine.There is no impersonation, and System.Security.Principal.WindowsIdentity.GetCurrent().Name returns NT AUTHORITYNETWORK SERVICE, which it the account which the application pool runs.I tried to test the security of the application and server by removing file permissions to the .aspx files. I was greatly worried when the website continued to run without problem (it should not have been able to read the .aspx files).By turning on file level auditing, I discovered that the .aspx files were being read by the machine$ account (if the machine is called Serv1, then the files would be read by the Serv1$ account, which seems to have access to all files on the local machine).Is this a security breach or is this behaviour by design ?
Is there a reason Impersonation does not seem to work with a UNC path using File.OpenRead()? I'm utilizing codeproject's Impersonation utility: [URL] I have a user with rights to the share that I'm passing to OpenRead(). This is my code and it's not accessing the file:
try { bool canImp = imp.ImpersonateValidUser(impUser, domain, impPwd); FileStream fs = File.OpenRead(filePath); logger.Debug("File stream opened..."); byte[] b = new byte[fs.Length]; fs.Read(b, 0, b.Length); fs.Close(); //code continued
I wrote an asp.net application that I'm trying to run on a godaddy domain I bought. I need to read a file in a folder that I did not give read access to so that your average user cannot see in the informaion in that folder. I assumed that the asp.net program would have the same credentials as myself because server-side code. Turns out I am wrong. When I go to use the asp.net application it throws an access denied error saying that the ASP.NET user account has to be given permissions to access the folder.
After talking to two different tech support people at godaddy I've come to the realization that they are either dumb or lazy (or a combo of the two).I came across some code that you can put into the web.config file that would allow the asp.net application to impersonate a user, which would work great to use myself as the impersonated user. However it seems that godaddy cannot give me the name of the server that my domain is on (that's understandable) so I don't know what to put in the identity tag to get this to work.
Here is the code I found:
[Code]....
(of course I filled in the username and password with the correct info)
When I went to use it again it threw this error:
System.Web.HttpException: The current identity (PHX3username) does not have write access to 'C:WindowsMicrosoft.NETFrameworkv2.0.50727Temporary ASP.NET Files'.
I modified the ASP.NET login control to also allow specifying UserRole ('Employee' or 'Volunteer'). Users are authenticated via a call to a webservice written by our client, which accepts username/password/role and returns true or false.If role is 'Employee' it represents an active directory user. The application should impersonate the user with the given username/password.If role is 'Volunteer' the application should run under a set Windows account whose username/password are known in advance (i.e. hard-coded in web.config file).
I need to pass a NetworkCredential object with the credentials of the currently impersonated user to a web service from an asp.net application.My code looks like this:
The masterpage of my site is using a control that reads data from a network share. To make this work on all pages I'm having to enable impersonation for the whole site. But what I want to do is only enable it for the pages that actually read/write to the share. Eg:
We are in the process of building ASP.NET windows auth application. Where user need to interact with other internal system using the same single sign on. To interact application DB the system relies on App Pool account, for this we are every time doing the imporsanation to before every DB call. We can not have all useres added to DB, or create an SQL account. Which requires password and user to store in Web Config. We can encrypt it again you encrypt with what and etc ..So we have one windows account wihich same windows account used for our app pool as well.
I would like to know from the team is what is the best way to do the DB connection in this case?What is the implcations if we imporsanate the DB calls based on the app pool account ? Is it a best practice? I have read it creates its own thred and stuff, Do we need to worry ?
On http://msdn.microsoft.com/en-us/library/w070t6ka(v=VS.100).aspx there is an example on how to do impersonation with .net 4.0. We have used this example in a class that inherits IDisposable for ease of use. However, when we use this class in a asp.net web application, we notice a slight but steady increase of Pool Paged Bytes in performance monitor. After a week, the application crashes.
I've tried different implementations of the impersonation-class, using http://msdn.microsoft.com/en-us/library/w070t6ka(v=VS.90).aspx and http://support.microsoft.com/kb/306158 as reference, but they all show the same leak.
Where does this leak come from? Is there a problem with the windows api? We are running Windows 2008 R2.
This is our current version of the impersonation class:
public class Impersonator : IDisposable { public Impersonator(string username, string domain, string password) { if (!ImpersonateValidUser(username, domain, password))[code]....
And this is the performance monitor graph of two webservers using different versions of the class:
When we disable the class, and use global impersonation via web.config, those lines are completely flat.
Update,I have made a test-application that successfully reproduce the problem. It can be downloaded here:
I noticed impersonation is turned on by default in MOSS web configs. I tried disabling it but the web app returns an error. So my question, is it possible to disable impersonation in MOSS? If it is possible are there any special considerations I should be aware of?
If you're interested in why I need to do this...I need to have a custom web part (developed with SmartPart) talk to a separate SQL server using the application pool rather than the current user (Kerberos is enabled). If I set the authentication mode to NTLM I get NTAuthority/ANonymous login errors from my SQL connection. If I turn Kerberos on, the currently logged in user's credentials are passed. If I hard code the user id and password in the connection string it seems to ignore it and default to whichever security model is in place (NTLM or Kerberos).
I've added the identity tag for impersonation. I've configured my site under IIS 5.1. The identity i've added is my domain username/password. But when I run any exe file from my asp.net file, it still runs under "aspnet" user name.
I am trying to use impersonation on an IIS server while I access Active Directory data. The following code works fine on the localmachine but when I put this same code on an IIS server I get an error: System.DirectoryServices.DirectoryServicesCOMException: An operations error occurred.
If I remove the top 4 lines and add my ID and passcode to the DirectoryEntry, everything works fine. I would prefer to not have my id and passcode anywhere on the web. Any ideas on how to fix this? Dim impersonationContext As System.Security.Principal.WindowsImpersonationContext
I am using impersonation in my ASP.NET application to access network resources. It works fine when I run on my computer, however when I setup the site on IIS6, it does not work. Is there some extra configuration, I need make in IIS for it?1. I created an account "TestUser" with the privilege as "act as operating system" on a server that has the resources which I want to access.2. The impersonation works fine on my computer, when I run from visual studio. My computer is on the network under same domain where the "TestUser" is created.
I am running ASP.MVC 2 with LINQ2SQL on IIS 7.5. I have enabled Windows Authentication with ASP.NET Impersonation. Application pool is running on different domain account [AsiaTestWebUser] is part of windows group [AsiaTestUserGrp]When i enable Asp.net impersonation on MVC web site. Once i hit LogOn from the default page , it's throwing me with below error message
We are using RDLC's in a Asp.net web application. For reasons beyond our understanding, the first call to the database server fails with the following error:
An error has occurred during report processing. Cannot open database "TryParkingIt2" requested by the login. The login failed. Login failed for user 'EXTRANETOurServerNameHere$'.
Run the report again, it works.
Update Click the button the first time, it fails. Click the button again, it works. The account being impersonated is a domain account. Also, this error occurs on all five different report pages, which is why I didn't include any code.
So I have an ASP DOT NET web service which needs to impersonate Windows Authenticated users. This web service calls into a Com Api to perform database operations.
It seems like the Impersonation does not persist into the Com Api. Is this because the Com DLL is loaded into its own memory space and treated as a separate process? Also what would be some ways to deal with this issue and persist the Impersonation into the Com Api Dll?
Moving the functionality of the Com Api into the dot net code is not an option at this point. Also the Com Api was written in C++.
I'm trying to enable passthrough or impersonation authentication inside an ASP.NET website that uses the TFS2010 API.I've got this working correctly with Cassini, however with IIS 7.5 (Windows 7) something is going wrong.I found this blog post on the subject, and tried the following:
ExchangeServiceBinding binding = new ExchangeServiceBinding(); binding.Credentials = new NetworkCredential(username, password); binding.Url = "http://servername/ews/exchange.asmx";
The above web services throws Unauthorized Access Error (Error : 401) for newly created users.I would like to know how to impersonate this user for accessing this exchange web services.
I'm having problems with impersonation in WCF. Namely, I'm calling a named pipe service from within ASP.NET with impersonation turned on. This fails (due to permissions on the pipe blocking anyone from the network). So, is there any way I can make the call outside of the impersonation context? I don't need to be impersonating to make this call, but can't see any way of doing this.
PS. I need to do this declaratively, through config...
