last day (14 days later) » 

12:38 PM
0
Q: Can I impersonate through the whole session?

Tolga EvcimenI have an mvc4 web application where users log in using their roaming profile user accounts. I authenticate them through the Active Directory. And in almost all methods I need to impersonate the logged in user to make some file operations. I use following methods for the impersonations: [DllImp...

 
Are you able to let IIS (assuming you're using it) handle the authentication? We do this with our app, and IIS then also handles the impersonation for you - the whole request is then run in the context of the user
 
Yes I run my website under IIS. But is it possible for IIS to impersonate differently on each login? OR are you talking about the identity of the application pool in IIS?
 
Yes, each user will be impersonated individually. At that point, things are running in their security context rather than that of the app pool
 
Okay, this sounds interesting. So where should I start?
 
Here's a start but specifics on configuring it are a bit beyond the original scope of this question :)
We use it in conjunction with Windows Authentication, and as a fallback if needed, Basic Authentication
 
12:38 PM
okay, let me take a look at it ;)
I have checked the article
but since I lack some knowledge about the IIS I couldnt understand who is the authenticated user that we are talking about
 
how will set the authenticated user that IIS uses?
 
If the users are already logged in to windows within the domain, and they use either internet explorer or chrome (I think firefox is configurable to allow it, not sure), and IIS is set up to use Windows Authentication and Impersonation, the browser will automatically pass the credentials to IIS, which will then impersonate them for the request
a call to GetCurrent will return that user
We use Basic Authentication for situations for when the browser doesn't support this automatic passing of credentials, or for when the user isn't accessing the site from within the domain - in this case the browser will pop up a login box asking for credentials
 
yes actually thats my case, the site wont be accessed from within the domain
 
ok - then Basic Auth is probably the route to go if you want IIS to handle the authentication for you. There are pitfalls in that the credentials are passed in plain text, though I think an https connection will still encrypt them but you'd need to double check that. It does mean that the login process is taken out of your hands and done by the browser, rather than you being able to do a nice UI for it as part of your site
 
12:47 PM
but how will I force the browser to pop that window? or is it even necessary? can't I use my own login page?
 
it happens automatically if the site requires authentication
 
hmm
I already pass the creds in plain text, relying on the https :/ so its fine
 
ok - it's just the loss of custom login UI then - and if the whole site is protected in this way, it'll present the login box in the browser before any content is displayed. You may be able to adjust it to only do certain pages/directories if needed
 
I see now
so what I understand is :
I will enable basic authentication and asp.net impersonation on IIS
then for the controller methods I will probably use some require authentication annotations to enforce the browser to authenticate me
is that right?
 
I think the authentication will be forced before it even gets as far as the .Net code. Don't forget to disable anonymous auth as well.
 
12:54 PM
hmm
in IIS when I enable basic authentication
it asks default domain and realm
I am in the correct direction?
 
ok then. I will dig in
 
see this for a better explanation of Realm than I can type that quickly :) stackoverflow.com/questions/12701085/…
default domain is which windows domain to use by default if the user doesn't specify one
if I set the default domain to ABC
and the user enters the following in the username box:
myname
it will attempt to log them on to user myname within the ABC domain
however, if they enter this:
XYZ\myname
it will attempt to log them on to myname in the XYZ domain
 
hmm
but here there is something crucial missing for me I guess
this is not the server that I authenticate the users from
there is another server(domain controller) in the domain that does the authentication
 
that should be fine - so long as this server is in the domain
 
1:00 PM
I guess you are right
because with rdp I can log in too without specifiying any of that domain controllers ips :)
thanks a lot
I hope I wont be bothering you again any soon :)
btw if you post a related answer I would be happy to accept it as the valid answer.
 
no problems. As a quick test, if you stick this aspx somewhere: pastebin.com/6SMWDvVa
it will print out the current username as far as .net is concerned. Try it with various combinations of the auth and impersonation
 

last day (14 days later) »