iis 7 - Shared folder access with login & password impersonation - W2K8 IIS7 -
hope here.
i'm using impersonation login shared folder , works locally (win8). doens't work on win2k8 iis7 server.
following code used impersonation:
public sealed class wrappedimpersonation { public enum logontype : int { interactive = 2, network = 3, batch = 4, service = 5, unlock = 7, networkcleartext = 8, newcredentials = 9 } public enum logonprovider : int { default = 0, // logon32_provider_default winnt35 = 1, winnt40 = 2, // use ntlm logon provider. winnt50 = 3 // use negotiate logon provider. } public enum impersonationlevel { securityanonymous = 0, securityidentification = 1, securityimpersonation = 2, securitydelegation = 3 } [dllimport("advapi32.dll", entrypoint = "logonuserw", setlasterror = true, charset = charset.unicode)] public static extern bool logonuser(string lpszusername, string lpszdomain, string lpszpassword, logontype dwlogontype, logonprovider dwlogonprovider, ref intptr phtoken); [dllimport("kernel32.dll")] public extern static bool closehandle(intptr handle); [dllimport("advapi32.dll", charset = charset.auto, setlasterror = true)] public static extern int duplicatetoken(intptr htoken, int impersonationlevel, ref intptr hnewtoken); [dllimport("advapi32.dll", charset = charset.auto, setlasterror = true)] public static extern bool reverttoself(); private string _domain, _password, _username; private intptr _token; private windowsimpersonationcontext _context; private intptr _duplicatetoken; private bool isincontext { { return _context != null; } } public wrappedimpersonation(string domain, string username, string password) { _domain = string.isnullorempty(domain) ? "." : domain; _username = username; _password = password; _token = intptr.zero; } // changes windows identity of thread. make sure call leave() @ end. [permissionset(securityaction.demand, name = "fulltrust")] public void enter() { if (isincontext) return; _token = intptr.zero; bool logonsuccessfull = logonuser(_username, _domain, _password, logontype.newcredentials, logonprovider.winnt50, ref _token); if (!logonsuccessfull) { throw new win32exception(marshal.getlastwin32error()); } duplicatetoken(_token, (int)impersonationlevel.securityimpersonation, ref _duplicatetoken); windowsidentity identity = new windowsidentity(_duplicatetoken); _context = identity.impersonate(); debug.writeline(windowsidentity.getcurrent().name); } [permissionsetattribute(securityaction.demand, name = "fulltrust")] public void leave() { if (!isincontext) return; _context.undo(); if (_token != intptr.zero) { closehandle(_token); } _context = null; } usage:
var impersonationcontext = new wrappedimpersonation(_url, _login, _password); impersonationcontext.enter(); list<string> files = directory.getfiles(_dataset.transfermethod.url).tolist(); impersonationcontext.leave(); server settings: local security policy -> local policies -> user rights assignments -> impersonate client after authentication : apppool identity need added here?
secondary logon service started.
error code on server: system.unauthorizedaccessexception: access path '\myserver\mysharedfolder' denied.
i've tried wnetaddconnection2 methods, these not sufficient if want switch between shares because blocks after while.
application: mvc.net .net version: 4.5
did got work on win2k8 iis7 machine?
Comments
Post a Comment