Impersonation

[Thorsten Schiller]

Hi,

I'm using impersonation in an ASPNET app, where the impersonated user is
configured in the web.config:
<identity impersonate="true" userName="userWithAppropiateRightsForTheApp"
password="cool"/>

So far, so good. It seems to work in come ways, i.e. the app can access a
network share which cannot be accessed by the ASPNET account. The ASPNET
account is still configured in the machine.config, but the account was added
to the Administrators group (to enable impersonation thru LogonUserA, see
below).

<processModel ...userName="machine" password="AutoGenerate" .../>

But, when I call System.Diagnostics.Process.Start("LegacyApp.exe", "args"),
LegacyApp runs in the ASPNET account! This is still true if I impersonate
the user with Win32 API calls (LogonUserA, DuplicateToken, ...).

I don't understand this. What does impersonation means? Which code is
executed in the impersonated account and which not? Is there a way to spawn
a process from an ASPNET app that runs in an account that I specify?

Any help is appreciated.

Thanks, Panther.