使用WindowsImpersonationContext模拟当前用户访问网络驱动器

我需要从Web App访问远程驱动器。 ASP.NET进程无法访问该驱动器，因此我想模拟当前用户的请求。

我看到了一些使用WindowsImpersonationContext的基本示例，并尝试了以下操作。

WindowsImpersonationContext impersonationContext = null; try { impersonationContext = ((WindowsIdentity)User.Identity).Impersonate(); file.SaveAs(filePath); } finally { if (impersonationContext != null) { impersonationContext.Undo(); } } 

我仍然获得访问被拒绝的例外。

我已经阅读了一些关于LogonUser的东西，但据我所知，你需要一个用户名和密码才能从中获取凭据。 我不打算以不同的特定用户身份登录，只是当前用户（谁应该有权访问文件存储），所以我认为我实际上并不需要LogonUser API。

有谁知道我错过了什么？ 上述代码应该有效吗？

我还要注意包括

不起作用，但包括

在web.config让我进来。我看到一些人问这是为什么，但我没有看到任何解释。 我想知道它是否与我的问题有关。

Answer 1

我写了一个辅助类来完成它：

 public static class ImpersonationUtils { private const int SW_SHOW = 5; private const int TOKEN_QUERY = 0x0008; private const int TOKEN_DUPLICATE = 0x0002; private const int TOKEN_ASSIGN_PRIMARY = 0x0001; private const int STARTF_USESHOWWINDOW = 0x00000001; private const int STARTF_FORCEONFEEDBACK = 0x00000040; private const int CREATE_UNICODE_ENVIRONMENT = 0x00000400; private const int TOKEN_IMPERSONATE = 0x0004; private const int TOKEN_QUERY_SOURCE = 0x0010; private const int TOKEN_ADJUST_PRIVILEGES = 0x0020; private const int TOKEN_ADJUST_GROUPS = 0x0040; private const int TOKEN_ADJUST_DEFAULT = 0x0080; private const int TOKEN_ADJUST_SESSIONID = 0x0100; private const int STANDARD_RIGHTS_REQUIRED = 0x000F0000; private const int TOKEN_ALL_ACCESS = STANDARD_RIGHTS_REQUIRED | TOKEN_ASSIGN_PRIMARY | TOKEN_DUPLICATE | TOKEN_IMPERSONATE | TOKEN_QUERY | TOKEN_QUERY_SOURCE | TOKEN_ADJUST_PRIVILEGES | TOKEN_ADJUST_GROUPS | TOKEN_ADJUST_DEFAULT | TOKEN_ADJUST_SESSIONID; [StructLayout(LayoutKind.Sequential)] private struct PROCESS_INFORMATION { public IntPtr hProcess; public IntPtr hThread; public int dwProcessId; public int dwThreadId; } [StructLayout(LayoutKind.Sequential)] private struct SECURITY_ATTRIBUTES { public int nLength; public IntPtr lpSecurityDescriptor; public bool bInheritHandle; } [StructLayout(LayoutKind.Sequential)] private struct STARTUPINFO { public int cb; public string lpReserved; public string lpDesktop; public string lpTitle; public int dwX; public int dwY; public int dwXSize; public int dwYSize; public int dwXCountChars; public int dwYCountChars; public int dwFillAttribute; public int dwFlags; public short wShowWindow; public short cbReserved2; public IntPtr lpReserved2; public IntPtr hStdInput; public IntPtr hStdOutput; public IntPtr hStdError; } private enum SECURITY_IMPERSONATION_LEVEL { SecurityAnonymous, SecurityIdentification, SecurityImpersonation, SecurityDelegation } private enum TOKEN_TYPE { TokenPrimary = 1, TokenImpersonation } [DllImport("advapi32.dll", SetLastError = true)] private static extern bool CreateProcessAsUser( IntPtr hToken, string lpApplicationName, string lpCommandLine, ref SECURITY_ATTRIBUTES lpProcessAttributes, ref SECURITY_ATTRIBUTES lpThreadAttributes, bool bInheritHandles, int dwCreationFlags, IntPtr lpEnvironment, string lpCurrentDirectory, ref STARTUPINFO lpStartupInfo, out PROCESS_INFORMATION lpProcessInformation); [DllImport("advapi32.dll", SetLastError = true)] private static extern bool DuplicateTokenEx( IntPtr hExistingToken, int dwDesiredAccess, ref SECURITY_ATTRIBUTES lpThreadAttributes, int ImpersonationLevel, int dwTokenType, ref IntPtr phNewToken); [DllImport("advapi32.dll", SetLastError = true)] private static extern bool OpenProcessToken( IntPtr ProcessHandle, int DesiredAccess, ref IntPtr TokenHandle); [DllImport("userenv.dll", SetLastError = true)] private static extern bool CreateEnvironmentBlock( ref IntPtr lpEnvironment, IntPtr hToken, bool bInherit); [DllImport("userenv.dll", SetLastError = true)] private static extern bool DestroyEnvironmentBlock( IntPtr lpEnvironment); [DllImport("kernel32.dll", SetLastError = true)] private static extern bool CloseHandle( IntPtr hObject); private static void LaunchProcessAsUser(string cmdLine, IntPtr token, IntPtr envBlock, int sessionId) { var pi = new PROCESS_INFORMATION(); var saProcess = new SECURITY_ATTRIBUTES(); var saThread = new SECURITY_ATTRIBUTES(); saProcess.nLength = Marshal.SizeOf(saProcess); saThread.nLength = Marshal.SizeOf(saThread); var si = new STARTUPINFO(); si.cb = Marshal.SizeOf(si); si.lpDesktop = @"WinSta0\Default"; si.dwFlags = STARTF_USESHOWWINDOW | STARTF_FORCEONFEEDBACK; si.wShowWindow = SW_SHOW; if (!CreateProcessAsUser( token, null, cmdLine, ref saProcess, ref saThread, false, CREATE_UNICODE_ENVIRONMENT, envBlock, null, ref si, out pi)) { throw new Win32Exception(Marshal.GetLastWin32Error(), "CreateProcessAsUser failed"); } } private static IDisposable Impersonate(IntPtr token) { var identity = new WindowsIdentity(token); return identity.Impersonate(); } private static IntPtr GetPrimaryToken(Process process) { var token = IntPtr.Zero; var primaryToken = IntPtr.Zero; if (OpenProcessToken(process.Handle, TOKEN_DUPLICATE, ref token)) { var sa = new SECURITY_ATTRIBUTES(); sa.nLength = Marshal.SizeOf(sa); if (!DuplicateTokenEx( token, TOKEN_ALL_ACCESS, ref sa, (int)SECURITY_IMPERSONATION_LEVEL.SecurityImpersonation, (int)TOKEN_TYPE.TokenPrimary, ref primaryToken)) { throw new Win32Exception(Marshal.GetLastWin32Error(), "DuplicateTokenEx failed"); } CloseHandle(token); } else { throw new Win32Exception(Marshal.GetLastWin32Error(), "OpenProcessToken failed"); } return primaryToken; } private static IntPtr GetEnvironmentBlock(IntPtr token) { var envBlock = IntPtr.Zero; if (!CreateEnvironmentBlock(ref envBlock, token, false)) { throw new Win32Exception(Marshal.GetLastWin32Error(), "CreateEnvironmentBlock failed"); } return envBlock; } public static void LaunchAsCurrentUser(string cmdLine) { var process = Process.GetProcessesByName("explorer").FirstOrDefault(); if (process != null) { var token = GetPrimaryToken(process); if (token != IntPtr.Zero) { var envBlock = GetEnvironmentBlock(token); if (envBlock != IntPtr.Zero) { LaunchProcessAsUser(cmdLine, token, envBlock, process.SessionId); if (!DestroyEnvironmentBlock(envBlock)) { throw new Win32Exception(Marshal.GetLastWin32Error(), "DestroyEnvironmentBlock failed"); } } CloseHandle(token); } } } public static IDisposable ImpersonateCurrentUser() { var process = Process.GetProcessesByName("explorer").FirstOrDefault(); if (process != null) { var token = GetPrimaryToken(process); if (token != IntPtr.Zero) { return Impersonate(token); } } throw new Exception("Could not find explorer.exe"); } } 

你可以像这样使用它：

 ImpersonationUtils.LaunchAsCurrentUser("notepad"); using (ImpersonationUtils.ImpersonateCurrentUser()) { } 

您可以在此处找到更多解释和示例：

模拟来自SYSTEM的CurrentUser

Answer 2

您可能正在遇到模拟与委派问题。 模拟用户时，您可以以该用户身份访问本地资源，但不能访问远程资源。 使用Delegation，您也可以访问远程资源。 请尝试以下方法：

1. 确保在IIS中启用了Windows身份validation，并且禁用了匿名身份validation（匿名身份validation优先于其他身份validation机制）
2. 在web.config中启用以确保ASP.NET处理Windows身份validation（这应该仅适用于Classic管道模式）。
3. 应该足够了。

您可能需要做的另一件事是确保允许运行AppPool的帐户像委托一样行事。