ASP.NET 拒绝尊重我的权威。

发布于 2024-11-26 19:37:54 字数 1118 浏览 2 评论 0原文

我已成功模拟用户。使用 LogonUser Interop，例如

    [DllImport("advapi32.dll", SetLastError = true)]
    static extern bool LogonUser(
      string principal,
      string authority,
      string password,
      LogonSessionType logonType,
      LogonProvider logonProvider,
      out IntPtr token);

这工作正常。当我转到即时窗口并输入 WindowsIdentity.GetCurrent().Name 时，模拟的用户显示为我的 CurrentUser。当我释放该用户时，它会返回到我的真实用户。这里没有问题——我正在冒充。

但是，当我尝试将文件写入用户有权访问的共享时，我得到：

访问路径 [路径名称] 被拒绝。。

我已经能够以我模拟的用户身份手动登录 Windows，进行导航并将文件写入共享。用户肯定对我的目标目录具有管理权限。

我允许最终用户上传文件，并使用 HttpPostedFileBase 对象将文件写入此共享。本质上，我将模拟限制为上传文件的代码块。完成后，它会返回到原始的经过身份验证的 LDAP 用户，例如

 imp = Impersonation.ImpersonateUser("someuser","somepassword");
 HttpPostedFileBase hpf = Request.Files[file] as HttpPostedFileBase;
 ...
 hpf.SaveAs(path);
 Impersonation.StopImpersonating(imp);

路径是正确的。

当我使用 SaveAs 方法保存文件时，它是否尊重我的模拟？

它是否试图在我不知道的另一个帐户下写入文件？如果是这样，我该如何改变这一点？

使用 SaveAs 方法似乎没有太多的控制——没有一个重载。除了使用此对象之外，还有其他替代方法可以让我更好地控制我的凭据吗？

原文

I've managed to impersonate a user successfully. Using the LogonUser Interop, e.g.

    [DllImport("advapi32.dll", SetLastError = true)]
    static extern bool LogonUser(
      string principal,
      string authority,
      string password,
      LogonSessionType logonType,
      LogonProvider logonProvider,
      out IntPtr token);

This works fine. When I go to my immediate window and enter WindowsIdentity.GetCurrent().Name, the impersonated user shows as my CurrentUser. When I release this user, it goes back to my real user. No problems here -- I'm am impersonating.

However, when I attempt to write a file to a share that the user has access to, I get:

Access to the path [path name] denied..

I've been able to log into Windows manually as the user I am impersonating, navigated, and written a file to the share. The user definately has administrative privlidges to the directory I'm targeting.

I am allowing the end user to upload a file, and using the HttpPostedFileBase object, write a file to this share. Essentially, I am restricting the impersonation to the block of code to upload the file. Once it's finished, it goes back to the original authenticated LDAP user e.g.

 imp = Impersonation.ImpersonateUser("someuser","somepassword");
 HttpPostedFileBase hpf = Request.Files[file] as HttpPostedFileBase;
 ...
 hpf.SaveAs(path);
 Impersonation.StopImpersonating(imp);

The path is correct.

When I save the file using the SaveAs method, is it respecting my impersonation?

Is it attempting to write the file under another account I'm not aware of? And if so, how can I change this?

There doesn't seem to be a whole lot of control using the SaveAs method -- not a single overload. Are there any other alternatives to using this object that would give me greater control over my credentials?

分享到QQ

分享到微博