Re: Logging, Login API and SSPI
- From: "William DePalo [MVP VC++]" <willd.no.spam@xxxxxxxx>
- Date: Wed, 24 Jan 2007 20:40:12 -0500
"James V" <jamesv123@xxxxxxxxxxx> wrote in message
news:u%23csy5$PHHA.3960@xxxxxxxxxxxxxxxxxxxxxxx
I am trying to add logging capabilities to a Windows(2000/XP/2003)
application that can run under any user context(not neceseraly a member of
admin).
The problem is that every time a diffrent user will run the application,
the log files would be created/written under his credentials.
Some users can have limited permissions and not allowed to access various
parts of the file system. Further more, if a limited user created/written
a/to file he has permissions to view and change it and I do not want
limited users to be able to view modify the log files.
The standard way to deal with a set of requirements such as yours would be
to split the application into two pieces. One, a service installed and run
under the local system account. Two, an interactive aplication which runs
under the current logged on user. Then what you do is use an impersonable
mechanism (a pipe works nicely) to communicate requests from the interactive
application to the service. When required, the service can use
ImpersonateNamedPipeClient() to "do stuff" as the user making a request, and
when not impersonating it "does stuff" under the local system acccount which
has free reign over local resources such as the log you speak of.
I could create a logging service that uses IPC to connect to the server
application and manage the loging for it, but it seems like an overkill.
Not at all.
I considered using a special user account that would be impersonated by
our application(using login API and SSPI ) and would do the actual log
file manipulation, but the problem is that login API and SSPI can require
certain privilged user permissions (SE_TCB_NAME ) for the impersonation to
work properly (The impersonation level does not allow resource access).
FWIW: SSPI doesn't require elevated privileges. LogonUser() requires
SE_TCB_NAME privilege on platforms older than XP.
Regards,
Will
www.ivrforbeginners.com
.
- Follow-Ups:
- Re: Logging, Login API and SSPI
- From: James V
- Re: Logging, Login API and SSPI
- Prev by Date: Re: how can i disble irq15 through C/assembly programming.
- Next by Date: Re: Traversing Directories in Kernel Mode
- Previous by thread: attn: tedman - interesting posts - lilko as ejya - (1/1)
- Next by thread: Re: Logging, Login API and SSPI
- Index(es):
Relevant Pages
|
