expiring passwords with impersonated identity

[Anton Sokolovsky]

Hi all !

Imagine ASP.NET application impersonating specific identity with webconfig:
<identity impersonate="true" userName="accountname" password="password" />

When accountname user is specially created to run this application and noone
uses it for interactive logon, there is no standard way to change the
password when it expires. This leads to ASP.NET application failing with
code 500.

There are 2 workarounds in this case that I came up to:
1. Try impersonating the user in the code for each page, and if fails
redirect to the page that gives the ability to change the password.
2. Same as #1 but done only once - in default.aspx

Question is: whith impersonation in default.aspx will the token be
application wide - used for any other subseqent page request within this
application, or it's scope is just a single page. Point is to reach
application-wide impersonation with a piece of code rather than using
webconfig.

Sorry if this question has been asked previously, but I cannot find it.

Thanks,
Anton.

[Anton Sokolovsky]

1. Don't use imersonation in web.config
2. In global.asax implement Application_PreRequestHandlerExecute with the
code to impersonate required user
3. If #2 fails and current loged in user has OS admin rights, redirect the
user to the page where he is allowed to configure the application with new
credentials.


"Anton Sokolovsky" <anton@infopulse.com.ua> wrote in message
news:cll7ks$ar0$1@relay.infopulse.com.ua...

> Hi all !
>
> Imagine ASP.NET application impersonating specific identity with

webconfig:

> <identity impersonate="true" userName="accountname" password="password" />
>
> When accountname user is specially created to run this application and

noone

> uses it for interactive logon, there is no standard way to change the
> password when it expires. This leads to ASP.NET application failing with
> code 500.
>
> There are 2 workarounds in this case that I came up to:
> 1. Try impersonating the user in the code for each page, and if fails
> redirect to the page that gives the ability to change the password.
> 2. Same as #1 but done only once - in default.aspx
>
> Question is: whith impersonation in default.aspx will the token be
> application wide - used for any other subseqent page request within this
> application, or it's scope is just a single page. Point is to reach
> application-wide impersonation with a piece of code rather than using
> webconfig.
>
> Sorry if this question has been asked previously, but I cannot find it.
>
> Thanks,
> Anton.
>
>