CS795.Net Impersonation… why & How? Presented by: Vijay Reddy Mara

CS795 Introduction What is Impersonation? Why Impersonation? How Impersonation? Levels of Impersonation Advantages and Disadvantages

CS795 What is impersonation? Impersonation is the process of assigning a user account to an unknown user. Impersonation is one of the most useful mechanisms in Windows security.

CS795 Mechanism This mechanism allows a server process to run using the security credentials of the client. When the server is impersonating the client, any operations performed by the server are performed using the client's credentials. Impersonation does not allow the server to access remote resources on behalf of the client

CS795 Impersonation

CS795 Why Impersonation? The usual reason for doing this is to avoid dealing with authentication and authorization issues in the ASP.NET application code. Instead, you rely on Microsoft Internet Information Services (IIS) to authenticate the user

CS795 How to configure Impersonation? By default the impersonation is disabled at the machine level A minimal configuration file to enable impersonation is as follows

CS795 Different types of impersonation Impersonate the IIS Authenticated Account or User Impersonate a Specific User for All the Requests of an ASP.NET Application Impersonate the Authenticating User in Code

CS795 Impersonate the IIS Authenticated Account or User Impersonate a Specific User for All the Requests of an ASP.NET Application

CS795 Impersonate the Authenticating User in Code: System.Security.Principal.WindowsImpersonationContext impersonationContext; impersonationContext = ((System.Security.Principal.WindowsIdentity)User.Identity).Impersonate(); //Insert your code that runs under the security context of the authenticating user here. impersonationContext.Undo();

CS795 Impersonating by using LogonUser bool loggedOn = LogonUser( user, domain, password, LogonType.Interactive, LogonProvider.Default, out userHandle); if(!loggedOn) // Begin impersonating the user WindowsImpersonationContext impersonationContext = WindowsIdentity.Imper sonate(userHandle.Token); DoSomeWorkWhileImpersonating(); // Clean up CloseHandle(userHandle); impersonationContext.Undo();

CS795 Impersonating by using the WindowsIdentity Constructor using System.Security.Principal;... WindowsIdentity wi = new WindowsImpersonationContext ctx = null; try { ctx = wi.Impersonate(); // Thread is now impersonating } catch { // Prevent exceptions propagating. } finally { // Ensure impersonation is reverted ctx.Undo(); }

CS795 Levels of Impersonation A Server process can control to what extent a service is able to act as the client by selecting an impersonation level when it connects to the service.

CS795 Four levels of Impersonation Anonymous Identify Impersonate Delegate

CS795 Anonymous The client is anonymous to the service. The service can impersonate the client but the impersonation token does not contain any information about the client. Identify The service can get the identity of the client and use this information in its own security mechanism, but it cannot impersonate the client.

CS795 Impersonate The service can impersonate the client. If the service is on the same computer as the client process, it can access network resources as the client. Delegate The service can impersonate the client not only when it accesses resources on the service's computer but also when it accesses resources on other computers.

CS795 Advantages Auditing Auditing across tiers Granular access controls

CS795 Disadvantages Scalability Increased administration effort

CS795 References

CS795 Questions?