Using LoginUser for Authentication

Tech-Archive recommends: Fix windows errors by optimizing your registry

From: Dan (anonymous_at_discussions.microsoft.com)
Date: 03/14/04 

Date: Sun, 14 Mar 2004 13:26:59 -0800

We are writing a component in VB.net that is supposed to
authenticate a predetermined user (using the user name,
password and
domain) and then copy a file to a file share (using a
mapped drive or UNC path).

This component will be called from an IIS process (either
IIS 4, 5 or 6).

The general code structure is as follows:

Call RevertToSelf()
Call LogonUser() to obtain a token
Call ImpersonateLoggedOnUser()
Copy the file over
.....

Sounds pretty simple, right?

We have the most difficult time getting past LogonUser().
We invariably get an error 1314: "A required privilege is
not held by the client".

We get this error even though we attempt to run the
program as a standalone executable outside of IIS and
using Administrator user accounts.

One solution we saw was to provide "Act as part of the OS
privileges" to the user account in question. Even if this
works, we cannot do that for security reasons.

Does anyone have any idea what we could be doing wrong?

Thanks in advance for any assistance.

Relevant Pages

  • Using LoginUser for Authentication
    ... IIS 4, 5 or 6). ... We have the most difficult time getting past LogonUser(). ... We invariably get an error 1314: "A required privilege is ... using Administrator user accounts. ...
    (microsoft.public.dotnet.framework.adonet)
  • Using LogonUser for authentication
    ... IIS 4, 5 or 6). ... We have the most difficult time getting past LogonUser(). ... We invariably get an error 1314: "A required privilege is ... using Administrator user accounts. ...
    (microsoft.public.dotnet.languages.vb)
  • Re: Identify which users are running which asp pages
    ... This can be figured out if you recursively search through the IIS metabase ... on that machine looking for hard-coded user accounts for UNC-access, ... Anonymous-Access, or AppPool Identity (any other form of hard-coded accounts ...
    (microsoft.public.inetserver.iis)
  • Re: Change computername with MS Server 2003 Web Edition
    ... > I am absolutely glad that IIS does not do it the way you want. ... > You have just changed the IUSR/IWAM user accounts to the new computer name ... How the customer wants to do it is highly debatable. ... >> then you can rename the server to something else so that you can put it on ...
    (microsoft.public.inetserver.misc)
  • Re: Windows authentication query
    ... install IIS, only the NetBIOS name of the IIS server is registered with the ... FQDN) with the KDC. ... Delegation is succeeding only for users accounts residing in the same ... :> HOW TO: Configure Computer Accounts and User Accounts So That They Are ...
    (microsoft.public.inetserver.iis.security)