Hej Vide. Jag fick följande att fungerar utan problem. Detta är en Webapplication som försöker nå en fil över en filshare där ASPNET inte har några rättigheter.
Först så skapade jag en Security assembly med en class user som används för att logga in.
using System;
using System.Security.Principal;
using System.Runtime.InteropServices;
using System.IO;
namespace TS.Classes.Security
{
/// <summary>
/// Summary description for User.
/// </summary>
public class User
{
#region -- WIN 32 API Impelentation -------------------------------------------------
[DllImport("advapi32.dll")]
private static extern int LogonUserA(String lpszUserName, String lpszDomain, String lpszPassword, int dwLogonType, int dwLogonProvider, ref IntPtr phToken);
[DllImport("kernel32.dll", CharSet=CharSet.Auto)]
private extern static bool CloseHandle(IntPtr handle);
[DllImport("advapi32.dll", CharSet=CharSet.Auto, SetLastError=true)]
private extern static bool DuplicateToken(IntPtr ExistingTokenHandle, int SECURITY_IMPERSONATION_LEVEL, ref IntPtr DuplicateTokenHandle);
#endregion
#region -- Declaration --------------------------------------------------------------
//-- Constat ints for WIN 32 API
private const int LOGON32_LOGON_INTERACTIVE = 2;
private const int LOGON32_PROVIDER_DEFAULT = 0;
/// <summary>
/// Used to Impersonat the new windows Identity
/// </summary>
WindowsImpersonationContext _WindowsImpersonationContext;
/// <summary>
/// tokens to the new Widnows Identity
/// </summary>
IntPtr _WindowsIdentitytoken = IntPtr.Zero;
#endregion
#region -- Methods ------------------------------------------------------------------
/// <summary>
/// Logs on with a new user
/// </summary>
/// <remarks>
/// <para>
/// Uses the WIN 32 API LogonUserA to log on a user and get a token back.
/// </para>
/// <para>
/// The token is used later to impersonate the new user as WindowsIdentity, so the application
/// is runned under the new User
/// </para>
/// <para>
/// This metohd is treadsafe, that means if one thread logs in with a new user, no other threads are
/// affected by this logon.
/// </para>
/// </remarks>
/// <param name="userName">username of the user</param>
/// <param name="domainName">domain that the user belongs to</param>
/// <param name="password">password to the user</param>
/// <returns>return true if everything went ok, else false</returns>
public bool LogOn(string userName, string domainName, string password)
{
try
{
//-- Logon the new user
LogonUserA(userName, domainName, password, LOGON32_LOGON_INTERACTIVE, LOGON32_PROVIDER_DEFAULT, ref _WindowsIdentitytoken);
//-- Create an Impersonation off the new user
_WindowsImpersonationContext = WindowsIdentity.Impersonate(_WindowsIdentitytoken);
//-- Returns true
return true;
}
catch(Exception exception)
{
return false;
}
}
/// <summary>
///
/// </summary>
/// <returns>returns true if the logoff went ok, else false</returns>
public bool LogOff()
{
try
{
//-- Undo impersonation
_WindowsImpersonationContext.Undo();
//-- logoff the new user
CloseHandle(_WindowsIdentitytoken);
//-- returns true;
return true;
}
catch(Exception exception)
{
return false;
}
}
#endregion
#region -- Constructor --------------------------------------------------------------
public User(){}
#endregion
}
}
Sedan så skapade jag en dummy webapplication som försöker läsa filen som jag har på min fileshare.
using System;
using System.Collections;
using System.ComponentModel;
using System.Data;
using System.Drawing;
using System.Web;
using System.Web.SessionState;
using System.Web.UI;
using System.Web.UI.WebControls;
using System.Web.UI.HtmlControls;
using System.IO;
using TS.Classes.Security;
namespace WebApplication5
{
/// <summary>
/// Summary description for WebForm1.
/// </summary>
public class WebForm1 : System.Web.UI.Page
{
private void Page_Load(object sender, System.EventArgs ex)
{
//-- Open file that only the new user can do, this will throw an Access denied Exception
try
{
FileStream fs2 = File.Open(@"\\homlyn01\mgl\email.cs",FileMode.Open);
fs2.Close();
}
catch(Exception e)
{
string s = e.Message;
}
User user = new User();
user.LogOn("username", "domain","password");
//-- Open file that only the new user can do
try
{
FileStream fs2 = File.Open(@"\\homlyn01\mgl\email.cs",FileMode.Open);
fs2.Close();
}
catch(Exception e){}
user.LogOff();
//-- Open file that only the new user can do
try
{
FileStream fs2 = File.Open(@"\\homlyn01\mgl\email.cs",FileMode.Open);
fs2.Close();
}
catch(Exception e){}
}
#region Web Form Designer generated code
override protected void OnInit(EventArgs e)
{
//
// CODEGEN: This call is required by the ASP.NET Web Form Designer.
//
InitializeComponent();
base.OnInit(e);
}
/// <summary>
/// Required method for Designer support - do not modify
/// the contents of this method with the code editor.
/// </summary>
private void InitializeComponent()
{
this.Load += new System.EventHandler(this.Page_Load);
}
#endregion
}
}
Detta fungerar utmärkt utan några som helst problem. Har dock för mig att det kan vara så att din webserver inte "flyttar" med kredentials över nätverket, men det brukar vara rätt ovanligt så det är det nog inte, någon inställning man kan sätta...
Som sagt, ovanstående återspeglar ditt problem och det fungerar perfekt för mig i vår miljö.
- Magnus
