Accessing mapped drives while impersonating in ASP.NET

Short version: Is it possible to use impersonation in ASP.NET to access mapped drives?

Long version:

I am currently using impersonation in ASP.NET to access network files. This works fine for any network file using a UNC path, but it doesn't have access to any files on the mapped drives defined for the user account I issued.

For example, suppose a file lives on the network at \\machine\folder\file.txt

, and let's also say that the drive is S:

mapped to \\machine\folder

. We need to have access to the full path of the UNC, \\machine\folder\file.txt

, as well as a shorter route to the map S:\file.txt

.

Obviously the standard ASP.NET process cannot access.

Using a console application that runs under a local account with a mapped drive S:

, the call File.Exists(@"\\machine\folder\file.txt")

returns true and File.Exists(@"S:\file.txt")

also returns true.

However, when impersonating in the ASP.NET context with the same local account, it only File.Exists(@"\\machine\folder\file.txt")

returns true. File.Exists(@"S:\file.txt")

returns false.

I am testing with IIS 7 running on my local windows 7 box, but this should work in both IIS 6 and IIS 7.

Impersonation is handled by several classes in C #, which I will include here:

public static class Impersonation
{
    private static WindowsImpersonationContext context;

    public static void ImpersonateUser(string username, string password)
    {
        ImpersonateUser(".", username, password);
    }

    public static void ImpersonateUser(string domain, string username, string password)
    {
        StopImpersonating();

        IntPtr userToken;
        var returnValue = ImpersonationImports.LogonUser(username, domain, password,
                                                  ImpersonationImports.LOGON32_LOGON_INTERACTIVE,
                                                  ImpersonationImports.LOGON32_PROVIDER_DEFAULT,
                                                  out userToken);
        context = WindowsIdentity.Impersonate(userToken);
    }

    public static void StopImpersonating()
    {
        if (context != null)
        {
            context.Undo();
            context = null;
        }
    }
}

public static class ImpersonationImports
{
    public const int LOGON32_LOGON_INTERACTIVE = 2;
    public const int LOGON32_LOGON_NETWORK = 3;
    public const int LOGON32_LOGON_BATCH = 4;
    public const int LOGON32_LOGON_SERVICE = 5;
    public const int LOGON32_LOGON_UNLOCK = 7;
    public const int LOGON32_LOGON_NETWORK_CLEARTEXT = 8;
    public const int LOGON32_LOGON_NEW_CREDENTIALS = 9;
    public const int LOGON32_PROVIDER_DEFAULT = 0;

    [DllImport("advapi32.dll", SetLastError = true)]
    public static extern int LogonUser(
        string lpszUsername,
        string lpszDomain,
        string lpszPassword,
        int dwLogonType,
        int dwLogonProvider,
        out IntPtr phToken
        );
    [DllImport("advapi32.dll", SetLastError = true)]
    public static extern int ImpersonateLoggedOnUser(
        IntPtr hToken
    );

    [DllImport("advapi32.dll", SetLastError = true)]
    public static extern int RevertToSelf();

    [DllImport("kernel32.dll", SetLastError = true)]
    public static extern int CloseHandle(IntPtr hObject);
}

      

Then during Page_Load we basically do something like this:

Impersonation.ImpersonateUser("DOMAIN", "username", "password");

if (!File.Exists(@"S:\file.txt"))
     throw new WeCannotContinueException();

      

I understand that using mapped drives is not best practice, but for old reasons it is desirable for our business. Can I use impersonation in ASP.NET to access mapped drives?

+2


a source to share


3 answers


No, but you can use a symbolic link instead. Mklink /d

will create a directory link.



+1


a source


You can only access mapped drives that have been created by an impersonating user.

So, if you have to impersonate user X, then map a share (for example, via network usage), then that resource will be visible as long as the impersonation is in effect.



You can determine which mapped drives are currently accessible through DriveInfo.GetDrives()

. Drives with Network DriveType are available in the current security context.

0


a source


I tried solution mklink

from Scott
and it doesn't work with ASP.NET.

As for the answer from arnshea: it doesn't work at all; I even pretended to be the domain administrator and all the permissions set for each user, iuser service and network.

So the only solution: when developing your web application, you must decide if you want to save the network share and use the UNC protocol for this.

Mapped network drive does not work with ASP.NET for regular file operations.

0


a source







All Articles