Question

I am using LinqToEntitiesDomainService to connect to a SQL Server Database. This requires Windows Authentication, which I have working.

I wrote a web service that uses Activator.CreateInstance(...) to run an executable on the server. I would like this to use Windows Authentication, as well. However, I need the service to have the proper permissions to run the executable.

When I run the service right now, it works fine. My account has the proper roles to authenticate. I also have god-like permissions on the server, which allows me to have the Activator.CreateInstance(...) command work.

While other users who have the proper roles can authenticate, their account doesn’t have permissions on the server, nor should it.

Is there some (preferably, easy) way to run the service as one user, but have all of the authentication done with windows authentication? It would also be best if I could do it all in just one app pool…

Thank You!

Answer 1

Yes you can, take a look at this article. This shows some techniques for impersonating users.

using (WindowsImpersonationContext impersonationContext =
                                 ((WindowsIdentity)User.Identity).Impersonate())
{
    // do something as current user
}

Or in WCF you can also define this declaritively.

public class HelloService : IHelloService
{
    [OperationBehavior(Impersonation = ImpersonationOption.Required)]
    public string Hello(string message)
    {
        return "hello";
    }
}

Note these two techniques impersonate the client (caller).

To impersonate another user explicitly you need some P/Invoke. There’s a project here that wraps it all up for you quite neatly. You can then do this:

using (new Impersonator("myUsername", "myDomainname", "myPassword"))
{
   // do something as myUsername
}