RE: Issue With Programmatically Impersonating a User in a Web-Part

I'd start by making some changes to your impersonation code. Yours looks a
little more complicated than it has to be, plus you've got application logic
mixed in there with it. Try this code instead:

To start impersonating the Sharepoint domain service account:

WindowsIdentity objOriginalUser = WindowsIdentity.GetCurrent();
RevertToSelf();
WindowsIdentity.GetCurrent().Impersonate();

To stop:
objOriginalUser.Impersonate();


To start impersonating a specific account:

WindowsImpersonationContext wic =
CreateIdentity(ACCOUNTNAME,DOMAIN,PASSWORD).Impersonate();

To stop:

wic.Undo();



And you'll need this code to call that previous code:

using System.Security.Principal;
using System.Runtime.InteropServices;
//////////////////////////////////////


#region Impersonation code
protected static WindowsIdentity CreateIdentity(string User, string
Domain, string Password)
{
// The Windows NT user token.
IntPtr tokenHandle = new IntPtr(0);

const int LOGON32_PROVIDER_DEFAULT = 0;
const int LOGON32_LOGON_NETWORK = 3;

tokenHandle = IntPtr.Zero;

// Call LogonUser to obtain a handle to an access token.
bool returnValue = LogonUser(User, Domain, Password,
LOGON32_LOGON_NETWORK, LOGON32_PROVIDER_DEFAULT,
ref tokenHandle);

if (false == returnValue)
{
int ret = Marshal.GetLastWin32Error();
throw new Exception("LogonUser failed with error code: " + ret);
}

System.Diagnostics.Debug.WriteLine("Created user token: " + tokenHandle);

//The WindowsIdentity class makes a new copy of the token.
//It also handles calling CloseHandle for the copy.
WindowsIdentity id = new WindowsIdentity(tokenHandle);
CloseHandle(tokenHandle);
return id;
}

[DllImport("advapi32.dll", SetLastError=true)]
private static extern bool LogonUser(String lpszUsername, String
lpszDomain, String lpszPassword,
int dwLogonType, int dwLogonProvider, ref IntPtr phToken);

[DllImport("kernel32.dll", CharSet=CharSet.Auto)]
private extern static bool CloseHandle(IntPtr handle);

[DllImport("advapi32.dll")]
static extern bool RevertToSelf();

#endregion



"ptranfa@xxxxxxxxx" wrote:

I'm trying to impliment a web-part that will allow select users (ones
that are added to a custom sharepoint list) to Add, Edit and Delete
user accounts on a Server. The client isn't using active directory yet,
so I'm simply creating local machine accounts. I thought I had
everything up and running, if I hit the web-part logged in with
administrator privelages, the impersonation works, Prints out the
correct name BEFORE impersonation, AFTER impersonation, and then AFTER
UNDOING impersonation. It also creates, edits or deletes the user
account appropriately.

However, if I'm not logged in as a user that has Administrator
privelages, the impersonation fails (kinda the whole point for
impersonation..). Any help would be MUCH appreciated.


.

Relevant Pages

  • RE: Issue With Programmatically Impersonating a User in a Web-Par
    ... To start impersonating the Sharepoint domain service account: ... WindowsIdentity objOriginalUser = WindowsIdentity.GetCurrent; ... private static extern bool LogonUser(String lpszUsername, ... administrator privelages, the impersonation works, Prints out the ...
    (microsoft.public.sharepoint.portalserver.development)
  • Re: Problem with Protocol Transition
    ... then the token is impersonation level. ... Joe Kaplan-MS MVP Directory Services Programming ... Co-author of "The .NET Developer's Guide to Directory Services ... I'm just setting httpcontext.current.user to be a new WindowsIdentity ...
    (microsoft.public.dotnet.framework.aspnet.security)
  • Re: Problem with Protocol Transition
    ... I set up a domain account called DPool and gave it act as part of the ... then the token is impersonation level. ... Joe Kaplan-MS MVP Directory Services Programming ... I'm just setting httpcontext.current.user to be a new WindowsIdentity ...
    (microsoft.public.dotnet.framework.aspnet.security)
  • Re: Hybrid sql server and asp.net windows authentication
    ... With Windows authentication, impersonation will just make whoever ... changing the process account is done by changing the ... To impersonate any WindowsIdentity, ...
    (microsoft.public.dotnet.framework.aspnet.security)
  • Re: Impersonation using WindowsIdentity( upn ) ctor
    ... are using under the hood when you use the WindowsIdentity "UPN" ctor. ... the token returned by the API will either be an Impersonation ... Only accounts with with that privilege can create an ... only the SYSTEM account has ...
    (microsoft.public.dotnet.security)
Loading