Thread identity

Discussion in 'ASP .Net Security' started by Raster Space, Oct 6, 2005.

  1. Raster Space

    Raster Space Guest

    I have managed Web Application running on ASPNET user rights. How can I
    execute certain (not all) methods with administrator privileges? Any ideas?
     
    Raster Space, Oct 6, 2005
    #1
    1. Advertising

  2. You can impersonate an administrator for the duration of the call, or you
    can run the worker process as the administrator and undo the impersonation
    during the call. You can also put the admin code in a COM+ application that
    runs under a different identity.

    The WindowsImpersonationContext starts and stops impersonation. The only
    other thing is getting the logon token for the administrator to use to
    impersonate. The MSDN docs on WindowsImpersonationContext have a good
    sample on that though. Then the problem is securely storing the
    credentials...

    Joe K.

    "Raster Space" <> wrote in message
    news:di3v0t$pdn$...
    >I have managed Web Application running on ASPNET user rights. How can I
    >execute certain (not all) methods with administrator privileges? Any ideas?
     
    Joe Kaplan \(MVP - ADSI\), Oct 6, 2005
    #2
    1. Advertising

  3. Hello Joe,

    please - don't use impersonation for that -

    both approaches using impersonation will get you in trouble -

    a) WP runs as admin
    when an attacker can take over the application - he is admin

    b) WP runs as ASPNET - you impersonate admin
    you need to use LogonUser for that - where do you want to store the admin
    pwd - what happens with password change policy a.s.o...

    write a local COM+ server (even remoting would be ok :) that has the necessary
    privileges - factor out the code - and call into it from your ASP.NET app

    ---------------------------------------
    Dominick Baier - DevelopMentor
    http://www.leastprivilege.com

    > You can impersonate an administrator for the duration of the call, or
    > you can run the worker process as the administrator and undo the
    > impersonation during the call. You can also put the admin code in a
    > COM+ application that runs under a different identity.
    >
    > The WindowsImpersonationContext starts and stops impersonation. The
    > only other thing is getting the logon token for the administrator to
    > use to impersonate. The MSDN docs on WindowsImpersonationContext have
    > a good sample on that though. Then the problem is securely storing
    > the credentials...
    >
    > Joe K.
    >
    > "Raster Space" <> wrote in message
    > news:di3v0t$pdn$...
    >
    >> I have managed Web Application running on ASPNET user rights. How can
    >> I execute certain (not all) methods with administrator privileges?
    >> Any ideas?
    >>
     
    Dominick Baier [DevelopMentor], Oct 6, 2005
    #3
  4. Agreed. I was just trying to explain the available approaches. The COM+
    method is definitely the way to go. However, he may not want to deal with
    that. As long as the risks are known (which I did not explain in any good
    detail :)).

    Joe K.

    "Dominick Baier [DevelopMentor]" <>
    wrote in message news:...
    > Hello Joe,
    >
    > please - don't use impersonation for that -
    > both approaches using impersonation will get you in trouble -
    >
    > a) WP runs as admin
    > when an attacker can take over the application - he is admin
    >
    > b) WP runs as ASPNET - you impersonate admin
    > you need to use LogonUser for that - where do you want to store the admin
    > pwd - what happens with password change policy a.s.o...
    >
    > write a local COM+ server (even remoting would be ok :) that has the
    > necessary privileges - factor out the code - and call into it from your
    > ASP.NET app
    >
    > ---------------------------------------
    > Dominick Baier - DevelopMentor
    > http://www.leastprivilege.com
    >
    >> You can impersonate an administrator for the duration of the call, or
    >> you can run the worker process as the administrator and undo the
    >> impersonation during the call. You can also put the admin code in a
    >> COM+ application that runs under a different identity.
    >>
    >> The WindowsImpersonationContext starts and stops impersonation. The
    >> only other thing is getting the logon token for the administrator to
    >> use to impersonate. The MSDN docs on WindowsImpersonationContext have
    >> a good sample on that though. Then the problem is securely storing
    >> the credentials...
    >>
    >> Joe K.
    >>
    >> "Raster Space" <> wrote in message
    >> news:di3v0t$pdn$...
    >>
    >>> I have managed Web Application running on ASPNET user rights. How can
    >>> I execute certain (not all) methods with administrator privileges?
    >>> Any ideas?
    >>>

    >
    >
     
    Joe Kaplan \(MVP - ADSI\), Oct 6, 2005
    #4
  5. Raster Space

    Raster Guest

    Thanks guys! The COM+ method works just fine.

    Joe Kaplan (MVP - ADSI) wrote:
    > Agreed. I was just trying to explain the available approaches. The COM+
    > method is definitely the way to go. However, he may not want to deal with
    > that. As long as the risks are known (which I did not explain in any good
    > detail :)).
    >
    > Joe K.
    >
    > "Dominick Baier [DevelopMentor]" <>
    > wrote in message news:...
    >
    >>Hello Joe,
    >>
    >>please - don't use impersonation for that -
    >>both approaches using impersonation will get you in trouble -
    >>
    >>a) WP runs as admin
    >>when an attacker can take over the application - he is admin
    >>
    >>b) WP runs as ASPNET - you impersonate admin
    >>you need to use LogonUser for that - where do you want to store the admin
    >>pwd - what happens with password change policy a.s.o...
    >>
    >>write a local COM+ server (even remoting would be ok :) that has the
    >>necessary privileges - factor out the code - and call into it from your
    >>ASP.NET app
    >>
    >>---------------------------------------
    >>Dominick Baier - DevelopMentor
    >>http://www.leastprivilege.com
    >>
    >>
    >>>You can impersonate an administrator for the duration of the call, or
    >>>you can run the worker process as the administrator and undo the
    >>>impersonation during the call. You can also put the admin code in a
    >>>COM+ application that runs under a different identity.
    >>>
    >>>The WindowsImpersonationContext starts and stops impersonation. The
    >>>only other thing is getting the logon token for the administrator to
    >>>use to impersonate. The MSDN docs on WindowsImpersonationContext have
    >>>a good sample on that though. Then the problem is securely storing
    >>>the credentials...
    >>>
    >>>Joe K.
    >>>
    >>>"Raster Space" <> wrote in message
    >>>news:di3v0t$pdn$...
    >>>
    >>>
    >>>>I have managed Web Application running on ASPNET user rights. How can
    >>>>I execute certain (not all) methods with administrator privileges?
    >>>>Any ideas?
    >>>>

    >>
    >>

    >
    >
     
    Raster, Oct 7, 2005
    #5
    1. Advertising

Want to reply to this thread or ask your own question?

It takes just 2 minutes to sign up (and it's free!). Just click the sign up button to choose a username and then you can ask your own questions on the forum.
Similar Threads
  1. Giovanni Bassi
    Replies:
    0
    Views:
    651
    Giovanni Bassi
    Oct 20, 2003
  2. nalbayo
    Replies:
    2
    Views:
    5,507
    Bruce Barker
    Nov 11, 2005
  3. JimLad
    Replies:
    0
    Views:
    452
    JimLad
    Jan 16, 2009
  4. Frederick D'hont
    Replies:
    0
    Views:
    313
    Frederick D'hont
    Jul 25, 2005
  5. Replies:
    6
    Views:
    456
Loading...

Share This Page