Solved

Web service thread doesn’t inherit security context

Posted on 2004-08-24
2
327 Views
Last Modified: 2010-04-17
Using .NET 1.1 – Windows 2003.

I've created a web service that spawns a thread.  The service needs access to other servers, so I've created a user (lets call it "ServiceUser") with privileges and assigned the "anonymous user" in IIS to that user.  I then added <identity impersonate="true"/> to the web.config of my web service.

From inside any of the functions of the web service I make a call to WindowsIdentity.GetCurrent (which displays the current user), it returns "ServiceUser".  Great!  If I spawn a thread from that function and launch it, then I call WindowsIdentity.GetCurrent inside that spawned thread, it returns "ASPNET".

All I want is for the thread to have the same security context as it's calling function.  I've read solutions that require "ServiceUser" or ASPNET to have "Act as part of operating system" checked.  Anyone have a more elegant solution?

Thanks,
Chris
0
Comment
Question by:zebrachris
2 Comments
 
LVL 5

Accepted Solution

by:
Dragonmen earned 500 total points
ID: 11890163
Thread that you are spawning is using an ASP.NET account becouse no other account is given to that thread.
Every thread has it's own security context.
Look @ this:
http://pluralsight.com/wiki/default.aspx/Keith.GuideBook.HowToImpersonateAUserGivenHerToken
0
 

Author Comment

by:zebrachris
ID: 11894112
Actually I've tried assigning the context to the thread directly.

   'create thread to handle processing
   Dim th_DORProcess = New Thread(AddressOf oImportObject.StartProcess_Thread)
   'Pass credentials
   th_DORProcess.CurrentPrincipal = New System.Security.Principal.WindowsPrincipal(System.Security.Principal.WindowsIdentity.GetCurrent)
   'start the thread executing
   th_DORProcess.Start()

I've walked through this code and verified that the windows identity I want is set to the current principle of the thread.  Once the thread is started though, it reverts to the ASPNET process.

I tried WindowsImpersonationContext as per Dragonmen's link above and it works great.  (Thanks Dragonmen)

..I am wondering though, why it works.  Microsoft themselves even says that it shouldn't in the comments of the WindowsImpersonationContext example code:

' This sample demonstrates the use of the WindowsIdentity class to impersonate a user.
' IMPORTANT NOTES:
' This sample can be run only on Windows XP.  The default Windows 2000 security policy
' prevents this sample from executing properly, and changing the policy to allow
' proper execution presents a security risk.




0

Featured Post

Is Your Active Directory as Secure as You Think?

More than 75% of all records are compromised because of the loss or theft of a privileged credential. Experts have been exploring Active Directory infrastructure to identify key threats and establish best practices for keeping data safe. Attend this month’s webinar to learn more.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

Title # Comments Views Activity
ClickOnce Install - Shortcut Question 3 70
changeXy challenge 13 67
silent install of security banner via msiexec command 4 73
Adoquery sql  left join does not work 25 80
Since upgrading to Office 2013 or higher installing the Smart Indenter addin will fail. This article will explain how to install it so it will work regardless of the Office version installed.
Whether you've completed a degree in computer sciences or you're a self-taught programmer, writing your first lines of code in the real world is always a challenge. Here are some of the most common pitfalls for new programmers.
An introduction to basic programming syntax in Java by creating a simple program. Viewers can follow the tutorial as they create their first class in Java. Definitions and explanations about each element are given to help prepare viewers for future …
In this seventh video of the Xpdf series, we discuss and demonstrate the PDFfonts utility, which lists all the fonts used in a PDF file. It does this via a command line interface, making it suitable for use in programs, scripts, batch files — any pl…

947 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

22 Experts available now in Live!

Get 1:1 Help Now