|
Hello! I wrote an application for our HR department so that they can enter employee information (name, title, company cell, extension, etc.), and then magic happens in the background that causes the Active Directory user account to be created, Exchange mailbox generated, home directory created, and even an Outlook signature file is generated. It then emails our IT staff to provision a workstation. It works great, although I'm running into a weird problem.
My application uses impersonation to perform all of it's tasks under a limited account (account name is "createnewuser". It specifically only has access to create folders in our home directory share, Outlook signature file share, and create user accounts and set specific AD attributes). Everything works and all of the tasks are performed by the limited account properly except my impersonation context drops after the owner of the home directory is set. Detail follows:
Here is the code I am using for impersonation (unfortunately, I don't recall where I got it, or I'd attrib):
----------
Imports System.Security.Principal
Imports System.Runtime.InteropServices
Imports System.Web
Imports System.Web.Security
Public Module Impersonation
#Region " API Declarations "
Public LOGON32_LOGON_INTERACTIVE As Integer = 2
Public LOGON32_PROVIDER_DEFAULT As Integer = 0
Public impersonationContext As WindowsImpersonationContext
Declare Function LogonUserA Lib "advapi32.dll" (ByVal lpszUsername As String, _
ByVal lpszDomain As String, _
ByVal lpszPassword As String, _
ByVal dwLogonType As Integer, _
ByVal dwLogonProvider As Integer, _
ByRef phToken As IntPtr) As Integer
Declare Auto Function DuplicateToken Lib "advapi32.dll" ( _
ByVal ExistingTokenHandle As IntPtr, _
ByVal ImpersonationLevel As Integer, _
ByRef DuplicateTokenHandle As IntPtr) As Integer
Declare Auto Function RevertToSelf Lib "advapi32.dll" () As Long
Declare Auto Function CloseHandle Lib "kernel32.dll" (ByVal handle As IntPtr) As Long
#End Region
Public Function impersonateValidUser(ByVal userName As String, _
ByVal domain As String, ByVal password As String) As Boolean
Dim tempWindowsIdentity As WindowsIdentity
Dim token As IntPtr = IntPtr.Zero
Dim tokenDuplicate As IntPtr = IntPtr.Zero
impersonateValidUser = False
If RevertToSelf() Then
If LogonUserA(userName, domain, password, LOGON32_LOGON_INTERACTIVE, _
LOGON32_PROVIDER_DEFAULT, token) <> 0 Then
If DuplicateToken(token, 2, tokenDuplicate) <> 0 Then
tempWindowsIdentity = New WindowsIdentity(tokenDuplicate)
impersonationContext = tempWindowsIdentity.Impersonate()
If Not impersonationContext Is Nothing Then
impersonateValidUser = True
End If
End If
End If
End If
If Not tokenDuplicate.Equals(IntPtr.Zero) Then
CloseHandle(tokenDuplicate)
End If
If Not token.Equals(IntPtr.Zero) Then
CloseHandle(token)
End If
End Function
Public Sub undoImpersonation()
impersonationContext.Undo()
End Sub
End Module
---------------
Here's the code that I am using to perform my tasks (I have excluded all of the active directory account creation stuff because that all works great)
-----------------
Imports System.DirectoryServices
Imports System.IO
Imports Microsoft.Win32.Security
Imports ActiveDs
If impersonateValidUser(ADLogin, ActiveDirectoryLegacyDomainName, ADPW) Then
(.... a whole bunch of stuff that creates the AD account, exchange mailbox,
sets variables such as the username for the new user, home directory path, etc..not
shown here, avail on request...)
If Not Directory.Exists(m_HomeDirPath) Then
Dim mySecPrincipal As WindowsUser
Dim myProtectedResource As SecuredObject
Directory.CreateDirectory(m_HomeDirPath)
mySecPrincipal = New WindowsUser(m_ADLegacyDomainName & "\" & m_Login)
myProtectedResource = New SecuredObject(m_HomeDirPath, SecuredObjectType.FileObject)
myProtectedResource.Permissions.SetAccess(mySecPrincipal, AccessRights.FileFullControl, AceInheritanceFlags.ContainerInherit Or AceInheritanceFlags.ObjectInherit)
myProtectedResource.Owner = mySecPrincipal
End If
end if
--------------------
As you can see, the program has previously determined the path to the home directory for the user. If that directory doesn't exist, it goes ahead and creates it. It then creates an instance of WindowsUser (mySecPrincipal) and SecuredObject (myProtectedResource). It sets the permissions on the new directory appropriately, however when it gets to
--------------------
myProtectedResource.Owner = mySecPrincipal
--------------------
the owner of the directory is correctly set to the new user (referenced by mySecPrincipal), however, when this command executes, my impersonation context is dropped and the process reverts back to the logged in user (and therefore, any code executing after this line is run under the context of the logged in user instead of the intended impersonated user). I never call undoImpersonation() until way later in the code.
In other words, before setting the .Owner property of myProtectedResource, Environment.Username = "createnewuser" After setting the .Owner property of myProtectedResource, Environment.Username = Logged In User.
I've been racking my brain trying to figure this out, but I can't figure out why setting the owner of a file system object would affect the impersonation context of the process doing it. It doesn't make any sense, unless I'm missing something really crazy.
Thanks for any help!
|
|
|
|
|
I'm writing a VB.Net app that takes the IP address and stores it into a string...
I want to validate the string to see if the first three characters of the IP address match the first octet of the router.
right now i have this function:
Shared Function GetIPAddress() As String
Try
Dim oAddr As System.Net.IPAddress
Dim sAddr As String
With System.Net.Dns.GetHostEntry(System.Net.Dns.GetHostName())
oAddr = New System.Net.IPAddress(.AddressList(0).Address)
sAddr = oAddr.ToString
End With
GetIPAddress = sAddr
Catch ex As Exception
MsgBox("You are not connected to the internet", "Not connected")
End Try
End Function
can't remember how to split the string up...
|
|
|
|
|
this code place your ip in array
<br />
dim mys () as string<br />
dim res as string<br />
<br />
res = GetIPAddress()<br />
<br />
mys= res.split (".")<br />
<br />
|
|
|
|
|
Hi,
I working on a login site. I have a master page and login page, I want to pass the values from login page to master page and display the link button according to the value passed from login page.
Can any one help me on this?
Shrihit
|
|
|
|
|
You can use Session variables.
You could do something like
<code>Session("Username") = Username.Text
Session("Password") = Password.Text ' This one should be encrypted and not plaintext</code>
"Any sort of work in VB6 is bound to provide several WTF moments." - Christian Graus
|
|
|
|
|
Assuming the login page is a content panel in the MasterPage, you can set the MasterPageType in the login page and access in public properties from the masterpage. Most likely you will still want to use a Session variable along with that. So the property in the master page would read and write to a session variable.
Ben
|
|
|
|
|
How do you set the MasterPageType in login page?
|
|
|
|
|
It is a page directive. So in your aspx file where you have your
<%@ Page MasterType="yourmasterpage.aspx"
Ben
|
|
|
|
|
I have an MP3 stored in a database. I need to play the file without dumping it first into a file, but directly play it using the byte array I retrieve from the database. Is it possible to do this? Thanks in advance.
|
|
|
|
|
Hi I am not sure but you can try mcisendstring function ....
best luck
|
|
|
|
|
I am trying to write to an absolute path from classic ASP using VB scripting.
The following works fine (for relative path):
Filepath = Server.MapPath("log_dmj.txt")
I would like to write to an absolute path ("C:\yadda\yadda" does not work as it is not a virtual path.)
DWreck
|
|
|
|
|
If this code is running server-side, then you only have to supply the fully qualified path. BUT!! That will only work if the ASP process has Read permissions to the path being references.
Filepath = "C:\yadda\yadda"
If this code is running client-side, there's nothing you can do except change your design. The web server will NOT give clients access to anything outside of the side directory that the page was served from.
|
|
|
|
|
Thanks for responding...
I am using this in server side code (classic ASP between the sript (<% %>) tags.)
I used the fully qualified path but got the following error:
Error Type:
Server.MapPath(), ASP 0172 (0x80004005)
The Path parameter for the MapPath method must be a virtual path. A physical path was used.
/HFHS/Code/Debugging.asp, line 16
Browser Type:
Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.0.3705; .NET CLR 1.1.4322; .NET CLR 2.0.50727)
-DWreck
|
|
|
|
|
So what's not to understand?? If this is server side code, all you have to do is provide the fully qualified path. You don't have to use Server.MapPath! I already gave you an example of this in my previous post. This is, like I stated in my previous post, subject to the limitations of NTFS Security and the account under which your ASP site is running.
|
|
|
|
|
I populate a combobox as follows:
<code>ComboBox2.Items.Clear()
ComboBox2.Items.AddRange(ScanHistoryList)
ComboBox2.SelectedIndex = 0</code>
ScanHistoryList is a string array.
I want to be able to allow the user to add to/edit the combobox .
How do I do this?
Any help much appreciated - I can't find a property to set
You always pass failure on the way to success.
|
|
|
|
|
I think you need to achive this prgamatilally by traping the events and if the text is changed while drop down event replace the older text with new one and if older text is a blank then add the new Item inthe list.Just try it
|
|
|
|
|
Thanks I'll give that a go 
You always pass failure on the way to success.
|
|
|
|
|
Hmmm... I guess you could put a button next to the ComboBox, called Edit, that gets the current SelectedItem in the ComboBox, and put the text of the item into a small form with a TextBox. That form would have a OK and Cancel button. If OK, then the SelectedItem would be replaced with the new text.
|
|
|
|
|
Thanks Dave and Ciacia,
I've solved it.
First thing I did was turn it into a DropDown rather than DropDownList. This allows the users to edit the data
Then I created the following event handlers:
<code> Private Sub ComboBox2_SelectedTextChange(ByVal sender As System.Object, ByVal e As System.EventArgs) Handles ComboBox2.TextChanged
textChanged = True
End Sub
Private Sub ComboBox2_Leave(ByVal sender As System.Object, ByVal e As System.EventArgs) Handles ComboBox2.Leave
If textChanged Then
ComboBox2.Items.Insert(ComboBox2.Items.Count, ComboBox2.Text)
ComboBox2.SelectedIndex = ComboBox2.Items.Count - 1
End If
End Sub
</code>
Note: textChanged is declared as a boolean variable.
What happens then is that when the user leaves the combobox if they have changed any text: this is added to the end of the combobox array collection and this is then made the current selection.
Thanks for your help guys. It's a shame that something which seems so simple can be so tricky!
You always pass failure on the way to success.
|
|
|
|
|
|
I don't see anything wrong with this approach. Quick and easy
"Any sort of work in VB6 is bound to provide several WTF moments." - Christian Graus
|
|
|
|
|
Hi All,
Being a dot net beginner, i would like to know about biztalk.
What is biztalk? whats it role and how it can be used?
Please explain with an example.
Thanks.
|
|
|
|
|
|
Sharepoint doesn't have anything to do with the .NET Framework. Read up on it here[^].
d_smita wrote: where and How can i implement it ?
Why would you want to do that when you don't know anything about it?
|
|
|
|
|
How can i make a stopwatch ? (Using VB.NET)
|
|
|
|
General 
News 
Suggestion 
Question 
Bug 
Answer 
Joke 
Praise 
Rant 
Admin 
Submit an article or tip
