Re: Copy files in network with authentication ??
- From: "Willy Denoyette [MVP]" <willy.denoyette@xxxxxxxxxx>
- Date: Mon, 5 Sep 2005 16:42:41 +0200
Tamas,
Inline.
Willy.
"Tamas Demjen" <tdemjen@xxxxxxxxx> wrote in message
news:us41%23QisFHA.2492@xxxxxxxxxxxxxxxxxxxxxxx
> Willy Denoyette [MVP] wrote:
>> The purpose of LogonUser is to obtain an access token specifying the
>> credentials of a valid local or domain (remote) account. If you specify a
>> remote users credentials, the token obtained can be used to impersonate
>> the current thread and access the remote resource. Now, if you use non
>> local user credentials, accesses to local FS objects will fail (unless
>> the remote user is a shadow account of a local account), this can be
>> solved by:
>> - specifying a domain user when calling LogonUser and granting this
>> doamin account access to the loacl FS resources, or,
>> - by specifying LOGON32_LOGON_NEW_CREDENTIALS as dwLogonType (W2K2 or
>> higher).
>>
>> Willy.
>
> Thanks Willy, this seems to be solving a 2-year-old problem to me. The
> following works nicely:
>
> HANDLE token;
> if(LogonUser(
> "Tamas", "\\\\RemoteComputer",
> "password",
> LOGON32_LOGON_NEW_CREDENTIALS,
> LOGON32_PROVIDER_DEFAULT,
> &token))
> {
> if(ImpersonateLoggedOnUser(token))
> {
> CopyFile("c:\\0.txt", "\\\\RemoteComputer\\Share\\0.txt",
> TRUE);
> RevertToSelf();
> }
> CloseHandle(token);
> }
>
> Does the LOGON32_LOGON_NEW_CREDENTIALS flag require the server to be W2k+,
> or the client (local) computer only?
>
The computer calling LogonUser() needs W2K or higer (that is all, OS that
run Kerberos security providers).
> I also tried this:
> BOOL res = LogonUser(
> "Tamas@RemoteComputer", NULL,
> "password",
> LOGON32_LOGON_NETWORK,
> LOGON32_PROVIDER_DEFAULT,
> &token);
>
> and res was TRUE and the token was valid, but after the
> ImpersonateLoggedOnUser call the remote FS was not accessible. Note that
> RemoteComputer is not a true domain, it's just another computer in a
> workgroup. I guess if I knew how to add access to the FS, that would work
> too. <sigh> I'd spent days without success before.
>
This is by design, the logontype LOGON32_LOGON_NETWORK returns an access
token that has NO network access.
> Anyway, LOGON32_LOGON_NEW_CREDENTIALS does the trick, but only on W2k+.
>
Yep, no need to map shares to local drives anymore, or to impersonate domain
accounts to access SQL server, just create a logon session with "split
identity" and you can access the server while keeping you local access token
to access local resources.
> Tom
.
- Follow-Ups:
- Re: Copy files in network with authentication ??
- From: Tamas Demjen
- Re: Copy files in network with authentication ??
- References:
- Re: Copy files in network with authentication ??
- From: Tamas Demjen
- Re: Copy files in network with authentication ??
- From: Willy Denoyette [MVP]
- Re: Copy files in network with authentication ??
- From: Tamas Demjen
- Re: Copy files in network with authentication ??
- Prev by Date: Re: Copy files in network with authentication ??
- Next by Date: Re: Copy files in network with authentication ??
- Previous by thread: Re: Copy files in network with authentication ??
- Next by thread: Re: Copy files in network with authentication ??
- Index(es):
Relevant Pages
|
