Click here to Skip to main content
15,888,461 members
Home / Discussions / Visual Basic
   

Visual Basic

 
Questioncombo box in DataGridView select item event Pin
steve_rm19-Jul-07 7:39
steve_rm19-Jul-07 7:39 
AnswerRe: combo box in DataGridView select item event Pin
kubben19-Jul-07 8:24
kubben19-Jul-07 8:24 
QuestionRe: combo box in DataGridView select item event Pin
steve_rm19-Jul-07 11:16
steve_rm19-Jul-07 11:16 
AnswerRe: combo box in DataGridView select item event Pin
cutequencher20-Jul-07 5:04
cutequencher20-Jul-07 5:04 
QuestionUsing InvokeRequired with a Timer control and a second thread Pin
ESTAN19-Jul-07 7:04
ESTAN19-Jul-07 7:04 
AnswerRe: Using InvokeRequired with a Timer control and a second thread Pin
Luc Pattyn19-Jul-07 8:07
sitebuilderLuc Pattyn19-Jul-07 8:07 
AnswerRe: Using InvokeRequired with a Timer control and a second thread Pin
ESTAN19-Jul-07 22:32
ESTAN19-Jul-07 22:32 
QuestionImpersonation Context Breaks when setting owner on NTFS file Pin
GenesisCraigM19-Jul-07 7:04
GenesisCraigM19-Jul-07 7:04 
Hello! I wrote an application for our HR department so that they can enter employee information (name, title, company cell, extension, etc.), and then magic happens in the background that causes the Active Directory user account to be created, Exchange mailbox generated, home directory created, and even an Outlook signature file is generated. It then emails our IT staff to provision a workstation. It works great, although I'm running into a weird problem.

My application uses impersonation to perform all of it's tasks under a limited account (account name is "createnewuser". It specifically only has access to create folders in our home directory share, Outlook signature file share, and create user accounts and set specific AD attributes). Everything works and all of the tasks are performed by the limited account properly except my impersonation context drops after the owner of the home directory is set. Detail follows:

Here is the code I am using for impersonation (unfortunately, I don't recall where I got it, or I'd attrib):
----------
Imports System.Security.Principal
Imports System.Runtime.InteropServices
Imports System.Web
Imports System.Web.Security

Public Module Impersonation
#Region " API Declarations "


Public LOGON32_LOGON_INTERACTIVE As Integer = 2
Public LOGON32_PROVIDER_DEFAULT As Integer = 0

Public impersonationContext As WindowsImpersonationContext

Declare Function LogonUserA Lib "advapi32.dll" (ByVal lpszUsername As String, _
ByVal lpszDomain As String, _
ByVal lpszPassword As String, _
ByVal dwLogonType As Integer, _
ByVal dwLogonProvider As Integer, _
ByRef phToken As IntPtr) As Integer

Declare Auto Function DuplicateToken Lib "advapi32.dll" ( _
ByVal ExistingTokenHandle As IntPtr, _
ByVal ImpersonationLevel As Integer, _
ByRef DuplicateTokenHandle As IntPtr) As Integer

Declare Auto Function RevertToSelf Lib "advapi32.dll" () As Long
Declare Auto Function CloseHandle Lib "kernel32.dll" (ByVal handle As IntPtr) As Long
#End Region


Public Function impersonateValidUser(ByVal userName As String, _
ByVal domain As String, ByVal password As String) As Boolean
Dim tempWindowsIdentity As WindowsIdentity
Dim token As IntPtr = IntPtr.Zero
Dim tokenDuplicate As IntPtr = IntPtr.Zero
impersonateValidUser = False

If RevertToSelf() Then
If LogonUserA(userName, domain, password, LOGON32_LOGON_INTERACTIVE, _
LOGON32_PROVIDER_DEFAULT, token) <> 0 Then
If DuplicateToken(token, 2, tokenDuplicate) <> 0 Then
tempWindowsIdentity = New WindowsIdentity(tokenDuplicate)
impersonationContext = tempWindowsIdentity.Impersonate()
If Not impersonationContext Is Nothing Then
impersonateValidUser = True
End If
End If
End If
End If
If Not tokenDuplicate.Equals(IntPtr.Zero) Then
CloseHandle(tokenDuplicate)
End If
If Not token.Equals(IntPtr.Zero) Then
CloseHandle(token)
End If
End Function

Public Sub undoImpersonation()
impersonationContext.Undo()
End Sub
End Module
---------------

Here's the code that I am using to perform my tasks (I have excluded all of the active directory account creation stuff because that all works great)
-----------------
Imports System.DirectoryServices
Imports System.IO
Imports Microsoft.Win32.Security
Imports ActiveDs
If impersonateValidUser(ADLogin, ActiveDirectoryLegacyDomainName, ADPW) Then
(.... a whole bunch of stuff that creates the AD account, exchange mailbox,
sets variables such as the username for the new user, home directory path, etc..not
shown here, avail on request...)

If Not Directory.Exists(m_HomeDirPath) Then
Dim mySecPrincipal As WindowsUser
Dim myProtectedResource As SecuredObject
Directory.CreateDirectory(m_HomeDirPath)
mySecPrincipal = New WindowsUser(m_ADLegacyDomainName & "\" & m_Login)
myProtectedResource = New SecuredObject(m_HomeDirPath, SecuredObjectType.FileObject)
myProtectedResource.Permissions.SetAccess(mySecPrincipal, AccessRights.FileFullControl, AceInheritanceFlags.ContainerInherit Or AceInheritanceFlags.ObjectInherit)
myProtectedResource.Owner = mySecPrincipal
End If
end if
--------------------
As you can see, the program has previously determined the path to the home directory for the user. If that directory doesn't exist, it goes ahead and creates it. It then creates an instance of WindowsUser (mySecPrincipal) and SecuredObject (myProtectedResource). It sets the permissions on the new directory appropriately, however when it gets to
--------------------
myProtectedResource.Owner = mySecPrincipal
--------------------
the owner of the directory is correctly set to the new user (referenced by mySecPrincipal), however, when this command executes, my impersonation context is dropped and the process reverts back to the logged in user (and therefore, any code executing after this line is run under the context of the logged in user instead of the intended impersonated user). I never call undoImpersonation() until way later in the code.

In other words, before setting the .Owner property of myProtectedResource, Environment.Username = "createnewuser" After setting the .Owner property of myProtectedResource, Environment.Username = Logged In User.

I've been racking my brain trying to figure this out, but I can't figure out why setting the owner of a file system object would affect the impersonation context of the process doing it. It doesn't make any sense, unless I'm missing something really crazy.

Thanks for any help!
WTF | :WTF:

QuestionSplit IP Address Pin
Froz3n19-Jul-07 6:47
Froz3n19-Jul-07 6:47 
AnswerRe: Split IP Address Pin
saeed_rezaei19-Jul-07 7:00
saeed_rezaei19-Jul-07 7:00 
QuestionSession Pin
shrihit19-Jul-07 6:47
shrihit19-Jul-07 6:47 
AnswerRe: Session Pin
Paul Conrad19-Jul-07 6:52
professionalPaul Conrad19-Jul-07 6:52 
AnswerRe: Session Pin
kubben19-Jul-07 7:20
kubben19-Jul-07 7:20 
GeneralRe: Session Pin
shrihit19-Jul-07 7:52
shrihit19-Jul-07 7:52 
GeneralRe: Session Pin
kubben19-Jul-07 7:56
kubben19-Jul-07 7:56 
QuestionPlay mp3 from byte array in VB.NET Pin
jfkasenda19-Jul-07 5:21
jfkasenda19-Jul-07 5:21 
AnswerRe: Play mp3 from byte array in VB.NET Pin
ciacia19-Jul-07 5:48
ciacia19-Jul-07 5:48 
QuestionSpecify absolute path in classic ASP script Pin
dwreck_stg19-Jul-07 4:17
dwreck_stg19-Jul-07 4:17 
AnswerRe: Specify absolute path in classic ASP script Pin
Dave Kreskowiak19-Jul-07 6:20
mveDave Kreskowiak19-Jul-07 6:20 
GeneralRe: Specify absolute path in classic ASP script Pin
dwreck_stg19-Jul-07 9:29
dwreck_stg19-Jul-07 9:29 
GeneralRe: Specify absolute path in classic ASP script Pin
Dave Kreskowiak19-Jul-07 10:06
mveDave Kreskowiak19-Jul-07 10:06 
QuestionAllowing user to add to/edit combobox Pin
GuyThiebaut19-Jul-07 3:20
professionalGuyThiebaut19-Jul-07 3:20 
AnswerRe: Allowing user to add to/edit combobox Pin
ciacia19-Jul-07 4:35
ciacia19-Jul-07 4:35 
GeneralRe: Allowing user to add to/edit combobox Pin
GuyThiebaut19-Jul-07 4:54
professionalGuyThiebaut19-Jul-07 4:54 
AnswerRe: Allowing user to add to/edit combobox Pin
Dave Kreskowiak19-Jul-07 6:12
mveDave Kreskowiak19-Jul-07 6:12 

General General    News News    Suggestion Suggestion    Question Question    Bug Bug    Answer Answer    Joke Joke    Praise Praise    Rant Rant    Admin Admin   

Use Ctrl+Left/Right to switch messages, Ctrl+Up/Down to switch threads, Ctrl+Shift+Left/Right to switch pages.