User privilege issue

George George

Hello everyone,

My application runs under low privilege account like NetWork Service, but in some specific method I need to have high privilege (e.g. to write to registry or access some local file).

So, I want to change the user privilege of some specific method of a class. Does anyone have any good ideas how to do this in .Net?

I have investigated impersonate technologies and it looks good. But two more issues with impersonate technogies.

http://www.codeproject.com/KB/cs/zetaimpersonator.aspx

- How to manage the password expire issue? (for example, in the current domain, the policy is for every 6 months, password must be changed);

- Is it possible to impersonate from a high privilege to a low privilege user without providing password? My concern is to hardcode password in source code.

thanks in advance,
George

6 Replies

Know the answer? Post it — somebody with the same question will find it here.

George George18y ago
Thanks Ryan! The purpose I want to have is to make the application not be able to access some folder, except call the method in a DLL which helps the application to access the folder, and it is why I want to impersonate in the specific DLL function. Any comments or ideas to achive this?

regards,

George
+1
Ryan Alford18y ago
sorry to have to break this to you, but you can't give one piece your code a higher level of access than the current window's user has. It's either all(using impersonation) or nothing.

Think of the security concerns of Microsoft allowing a code set to be able to run with admin privileges even though the current user doesn't have those privileges. Viruses would be even worse than they are now.
+1
George George18y ago
Thanks Bechir,

1.

Let me clarify and confirm your points. You point is to impersonate we do need the password of the account which we will impersonate to? And your solution is to store password into configuration file?

2.

I am wondering which attribute of configuration file (app.config?) is reserved to store password?

3.

Store password in clear text in configuration file (I have this confusion because app.config is clear text file)??

regards,

George
+1
Bechir Bejaoui18y ago
No George you miss understand me, in the configuration file there is a tag named identity
it could be possible that the administrator stocks some info about password and id because you can't impersonate a user without knowing its password and id except that he lives without loggig out so you can snoof it
+1
George George18y ago
Hi Bechir,

I am confused why I need to check web.config? My confusion is web.config controls the behevior and configurations for the whole web site. I just want to impersonate in a special method (to access some storage). I think I need to write code to impersonate in the special method I want to make impersonate happen, not from the web.config to impact the whole web application.

Any comments?

regards,

George
+1
Bechir Bejaoui18y ago
To impersonate a user you do need a password and identity user, so try to have a look on the config file the web.config -> identity tag? and tell me if there are useful informations about password and id or any other useful info?
+1