如何给子线程做impersonate?

[ElwinLuo]

Asp.net 程序中可以impersonate 一个帐号用来访问网络资源，但是如何给新建线程做impersonate ?
因为程序中调用了一个外部exe程序，
Process proc = new Process();
proc.StartInfo.FileName = "***.exe";
proc.start();
return proc.StandardOutput.ReadToEnd();

我试过用ShellExecute调用外部exe程序，
可是不能得到output...

[kfps8kfps8]

帮顶

[Garnett_KG]

[return: MarshalAs(UnmanagedType.Bool)]
[DllImport("advapi32.dll", SetLastError=true)]
internal static extern bool ImpersonateSelf(int level);

[return: MarshalAs(UnmanagedType.Bool)]
[DllImport("advapi32.dll", SetLastError=true)]
internal static extern bool RevertToSelf();


...
ImpersonateSelf(2)

Process proc = new Process();
proc.StartInfo.FileName = "***.exe";
proc.start();
 string output=proc.StandardOutput.ReadToEnd(); 

RevertToSelf()

return output;

[yagebu1983]

委托。。。

[ZJ159]

顶

[ElwinLuo]

好像不行啊，调用ImpersonateSelf之后显示的错误是:
[HttpException (0x80004005): An error occurred while attempting to impersonate. Execution of this request cannot continue.]
System.Web.ImpersonationContext.GetCurrentToken() +8845961
System.Web.ImpersonationContext.get_CurrentThreadTokenExists() +58
System.Web.HttpApplication.ExecuteStep(IExecutionStep step, Boolean& completedSynchronously) +193
System.Web.ApplicationStepManager.ResumeSteps(Exception error) +501
System.Web.HttpApplication.System.Web.IHttpAsyncHandler.BeginProcessRequest(HttpContext context, AsyncCallback cb, Object extraData) +123
System.Web.HttpRuntime.ProcessRequestInternal(HttpWorkerRequest wr) +379

[ElwinLuo]

我尝试给子线程加username 和 password;
proc.StartInfo.Domain = "domain";
proc.StartInfo.UserName = "username";
string password = "password";

SecureString secureString = new SecureString();
foreach (char c in password.ToCharArray())
{
secureString.AppendChar(c);
}
proc.StartInfo.Password = secureString;
部署到IIS上,运行时出现的错误是: The application failed to initialize properly (0xc0000142). Click on OK to terminate the application.

any comments or suggestions are appreciated.

[Garnett_KG]

internal static class NativeMethods
{
    // WIN32 API 
    [DllImport("kernel32.dll")]
    internal static extern IntPtr GetCurrentThread();
    [return: MarshalAs(UnmanagedType.Bool)]
    [DllImport("advapi32.dll", SetLastError = true)]
    internal static extern bool ImpersonateSelf(int level);
    [return: MarshalAs(UnmanagedType.Bool)]
    [DllImport("advapi32.dll", SetLastError = true)]
    internal static extern bool OpenThreadToken(IntPtr thread, uint desiredAccess, [MarshalAs(UnmanagedType.Bool)] bool openAsSelf, ref IntPtr handle);
    [return: MarshalAs(UnmanagedType.Bool)]
    [DllImport("advapi32.dll", SetLastError = true)]
    internal static extern bool RevertToSelf();
    [return: MarshalAs(UnmanagedType.Bool)]
    [DllImport("advapi32.dll", SetLastError = true)]
    internal static extern bool SetThreadToken(IntPtr thread, IntPtr token);
}
....

        IntPtr currentToken=IntPtr.Zero;
        IntPtr currentThread = NativeMethods.GetCurrentThread();
        NativeMethods.OpenThreadToken(currentThread, 4, true, ref currentToken);
        NativeMethods.SetThreadToken(IntPtr.Zero, IntPtr.Zero);

        NativeMethods.ImpersonateSelf(2);
        Process proc = new Process();
        proc.StartInfo.FileName = "***.exe";
        proc.start();
        string output=proc.StandardOutput.ReadToEnd(); 


        NativeMethods.RevertToSelf();
        NativeMethods.SetThreadToken(IntPtr.Zero, currentToken);
        return output;

[a2220046]

帮顶一下~~~

[ElwinLuo]

Hi Garnett_KG:
用了你的代码后创建的new process的信息是

Name: NT AUTHORITY\NETWORK SERVICE

IsAuthenticated: True

ImpersonationLevel: None

IsSystem: False

跟我在asp.net 配置的impersonate unsername 不一样啊....

[Garnett_KG]

asp.net是怎么配置的?

[Garnett_KG]

参考:

http://support.microsoft.com/kb/306158

[ElwinLuo]

asp.net 中使用 <identity impersonate="true" userName="accountname" password="password" />做配置，
只针对于asp.net 当前的线程是没有问题的，
关键是子进程中的Windows identity name 却跟父进程的windows identity name 不同了。

[ElwinLuo]

在父进程中 WindowsIdentity.Name = "domain\userName",
在子进程中,就变成了 "NT AUTHORITY\NETWORK SERVICE"

[ElwinLuo]

windows identity of asp.net server:

windowsIdentity.Name: domain\UserName
windowsIdentity.IsAuthenticated: True
windowsIdentity.ImpersonationLevel: Impersonation
windowsIdentity.IsSystem: False



windows identity of child process:

windowsIdentity.Name: NT AUTHORITY\NETWORK SERVICE
windowsIdentity.IsAuthenticated: True
windowsIdentity.ImpersonationLevel: None
windowsIdentity.IsSystem: False

任何意见都表示感谢。

[悔说话的哑巴]

这个不是很懂，不敢乱说帮顶

[ElwinLuo]

hi Garnett_KG,
我尝试用了你的代码去给一个进程impersonate后去访问网络资源，（部署在IIS上, 用ASP.net 调用)
结果还是显示无法获取网络资源...

该进程直接调用是可以的。

[ElwinLuo]

谢谢Garnett_KG ,我后来使用CreateProcessWithLogonW 解决了这个问题，不过碰到的新问题是不能获取输出，谁能帮我看看， 谢谢。
请看下面这个链接:
http://topic.csdn.net/u/20090423/11/75a6f0ef-c77c-4197-b106-cde9da7d582a.html