Re: Remote call to COM impersonating another user

I'm new to this, so bear with me. I seem to be missing something.

When I call LogonUser, it fails, I think because the domain I need to log
into is not available from the machine I run this from. When I use
the local domain it works fine - I become the other user when I impersonate
him. This is how far I got before the original post. Is there a call
that sends this information to the server and tells it to do this? As I
said, this works with whatever JIntegra does it.


"Willy Denoyette [MVP]" <willy.denoyette@xxxxxxxxxx> wrote in message
news:OBIe$HVUIHA.4584@xxxxxxxxxxxxxxxxxxxxxxx
"JCav" <jcavanaugh@xxxxxxxxxxxx> wrote in message
news:47824941$0$8795$4c368faf@xxxxxxxxxxxxxxxxx
It's set up for remote calls - I am able to make these calls remotely
using JIntegra. I guess what I need is to duplicate what JIntegra does. I
get authentication errors which leads me to believe that I need the
mechanism that sets up the call with credentials - in this case userID,
password.



The client needs to set the security context for the DCOM call at the very
beginning of the start of the process (before creating the first (D)COM
instance).
This can be done by calling "CoInitializeSecurity" using PInvoke, when
calling CoInitializeSecurity you'll have to set "DynamicCloaking" and
the "Impersonate" level for proxies in order to be able to impersonate the
"caller" at the server.
Note that the client needs to impersonate "the" windows client before
calling into the DCOM server, this again requires you to use PInvoke to
call "LogonUser" followed by an WindowsIdentity.Impersonate call using the
token obtained from LogonUser.

Herewith the CoInitializeSecurity PInvoke stuff to get you started.


public enum RpcAuthnLevel
{
Default = 0,
None,
Connect,
Call,
Pkt,
PktIntegrity,
PktPrivacy
}

public enum RpcImpLevel
{
Default = 0,
Anonymous,
Identify,
Impersonate,
Delegate
}


public enum EoAuthnCap
{
None = 0x00,
MutualAuth = 0x01,
StaticCloaking = 0x20,
DynamicCloaking = 0x40,
AnyAuthority = 0x80,
MakeFullSIC = 0x100,
Default = 0x800,
SecureRefs = 0x02,
AccessControl = 0x04,
AppID = 0x08,
Dynamic = 0x10,
RequireFullSIC = 0x200,
AutoImpersonate = 0x400,
NoCustomMarshal = 0x2000,
DisableAAA = 0x1000
}

[DllImport("Ole32.dll",
ExactSpelling = true,
EntryPoint = "CoInitializeSecurity",
CallingConvention = CallingConvention.StdCall,
SetLastError = false,
PreserveSig = false)]

private static extern void CoInitializeSecurity(
IntPtr pVoid,
int cAuthSvc,
IntPtr asAuthSvc,
IntPtr pReserved1,
uint dwAuthnLevel,
uint dwImpLevel,
IntPtr pAuthList,
uint dwCapabilities,
IntPtr pReserved3);

// Usage
...
// Initialize COM security for the process specifying impersonate for the
outgoing calls
CoInitializeSecurity(IntPtr.Zero,
-1,
IntPtr.Zero,
IntPtr.Zero,
(uint)RpcAuthnLevel.Connect,
(uint)RpcImpLevel.Impersonate,
IntPtr.Zero,
(uint)EoAuthnCap.DynamicCloaking,
IntPtr.Zero);
...
// Impersonate a windows client (LogonUser & Impersonate) and call the
server here.
// Create/Create remote instance ...


Willy.



.

Relevant Pages

  • Re: Remote call to COM impersonating another user
    ... This can be done by calling "CoInitializeSecurity" using PInvoke, when calling CoInitializeSecurity you'll have to set "DynamicCloaking" and the "Impersonate" level for proxies in order to be able to impersonate the "caller" at the server. ... IntPtr asAuthSvc, ...
    (microsoft.public.dotnet.languages.csharp)
  • Re: Remote call to COM impersonating another user
    ... When I call LogonUser, it fails, I think because the domain I need to log ... that sends this information to the server and tells it to do this? ... type when calling LogonUser, before calling Impersonate. ...
    (microsoft.public.dotnet.languages.csharp)
  • Re: LogonUser fails across different domains
    ... You shouldn't be able to log on as a user from an untrusted domain (except ... And you shouldn't need to do an impersonate to access files on a ... > LogonUser() fails if the user is in a domain ... > different from that with which the executing process is running as. ...
    (microsoft.public.platformsdk.security)
  • Re: Running sysinternals PSPASSWD.exe from local system account
    ... skip over eveything except the local computer? ... Call LogonUser and impersonate, ... Its stdout and stderr can be captured: ...
    (microsoft.public.win2000.security)
  • Impersonation and UNC network resources
    ... network folder and b) an VFP8 OleDB connection. ... if I set up ASP.NET to impersonate the user, I have no problems, providing I ... don't cause ASP.NET to recompile the ASPX files. ... LogonUser() succeeds, but the directory code: ...
    (microsoft.public.dotnet.framework.aspnet.security)