User privilege issue

Question

Hello everyone My application runs under low privilege account like NetWork Service but in some specific method I need to have high privilege (e.g. to write to registry or access some local file). So I want to change the user privilege of some specific method of a class. Does anyone have any good ideas how to do this in .Net? I have investigated impersonate technologies and it looks good. But two more issues with impersonate technogies. http://www.codeproject.com/KB/cs/zetaimpersonator.aspx - How to manage the password expire issue? (for example in the current domain the policy is for every 6 months password must be changed); - Is it possible to impersonate from a high privilege to a low privilege user without providing password? My concern is to hardcode password in source code. thanks in advance George

George George · Answer

Thanks Ryan! The purpose I want to have is to make the application not be able to access some folder except call the method in a DLL which helps the application to access the folder and it is why I want to impersonate in the specific DLL function. Any comments or ideas to achive this? regards George

Ryan Alford · Answer

sorry to have to break this to you but you can't give one piece your code a higher level of access than the current window's user has. It's either all(using impersonation) or nothing. Think of the security concerns of Microsoft allowing a code set to be able to run with admin privileges even though the current user doesn't have those privileges. Viruses would be even worse than they are now.

George George · Answer

Thanks Bechir 1. Let me clarify and confirm your points. You point is to impersonate we do need the password of the account which we will impersonate to? And your solution is to store password into configuration file? 2. I am wondering which attribute of configuration file (app.config?) is reserved to store password? 3. Store password in clear text in configuration file (I have this confusion because app.config is clear text file)?? regards George

Bechir Bejaoui · Answer

No George you miss understand me in the configuration file there is a tag named identity it could be possible that the administrator stocks some info about password and id because you can't impersonate a user without knowing its password and id except that he lives without loggig out so you can snoof it

George George · Answer

Hi Bechir I am confused why I need to check web.config? My confusion is web.config controls the behevior and configurations for the whole web site. I just want to impersonate in a special method (to access some storage). I think I need to write code to impersonate in the special method I want to make impersonate happen not from the web.config to impact the whole web application. Any comments? regards George

Bechir Bejaoui · Answer

To impersonate a user you do need a password and identity user so try to have a look on the config file the web.config -> identity tag? and tell me if there are useful informations about password and id or any other useful info?