To obtain Web Service security context

[Oleg Boldyrev]

Hello all!

I'd like to to impersonate the domain account a web service runs under. I
need this to do a trusted connection to SQL Server.
The current settings for the ASP.NET app are windows authentication and
impersonation. So if I do a trusted connection to SQL Server it would be
in the context of the current user which I don't want.
I like the approach with no global impersonation setting and manual
impersonation when nessessary, like was advised here, but that I can't
change the current global settings because the project is not mine and far
under way, I'm afraid to break something :-\
I feel I would be happy if I could obtain the WindowsImpersonationContext
for the account which runs the working process. If sombody could tell me how
to do this. In fact, all I want to do is to change the current security
context to that of the worker process, execute a sql query and then revert
to the previous context.
I don't want to explicitly set the credentials of any account. Is it
possible?

[Joe Kaplan \(MVP - ADSI\)]

Did you see the sample that Brock posted here that shows the trick of
impersonating the null token (which results essentially in "revert to self")
and then undoing the impersonation context to start the impersonation back
up? This sounds like what you need.

Joe K.

"Oleg Boldyrev" <olboldie@yandex.ru> wrote in message
news:%23EPBAuCRFHA.1564@TK2MSFTNGP09.phx.gbl...

> Hello all!
>
> I'd like to to impersonate the domain account a web service runs under. I
> need this to do a trusted connection to SQL Server.
> The current settings for the ASP.NET app are windows authentication and
> impersonation. So if I do a trusted connection to SQL Server it would be
> in the context of the current user which I don't want.
> I like the approach with no global impersonation setting and manual
> impersonation when nessessary, like was advised here, but that I can't
> change the current global settings because the project is not mine and
> far under way, I'm afraid to break something :-\
> I feel I would be happy if I could obtain the WindowsImpersonationContext
> for the account which runs the working process. If sombody could tell me
> how to do this. In fact, all I want to do is to change the current
> security context to that of the worker process, execute a sql query and
> then revert to the previous context.
> I don't want to explicitly set the credentials of any account. Is it
> possible?
>
>

[Oleg Boldyrev]

Yes, I did! It's exactly what i need.
Thank you, Joe, thank you, Brock.

"Joe Kaplan (MVP - ADSI)" <joseph.e.kaplan@removethis.accenture.com> wrote
in message news:OWe7eKjRFHA.2252@TK2MSFTNGP15.phx.gbl...

> Did you see the sample that Brock posted here that shows the trick of
> impersonating the null token (which results essentially in "revert to
> self") and then undoing the impersonation context to start the
> impersonation back up? This sounds like what you need.
>
> Joe K.
>
> "Oleg Boldyrev" <olboldie@yandex.ru> wrote in message
> news:%23EPBAuCRFHA.1564@TK2MSFTNGP09.phx.gbl...

>> Hello all!
>>
>> I'd like to to impersonate the domain account a web service runs under. I
>> need this to do a trusted connection to SQL Server.
>> The current settings for the ASP.NET app are windows authentication and
>> impersonation. So if I do a trusted connection to SQL Server it would
>> be in the context of the current user which I don't want.
>> I like the approach with no global impersonation setting and manual
>> impersonation when nessessary, like was advised here, but that I can't
>> change the current global settings because the project is not mine and
>> far under way, I'm afraid to break something :-\
>> I feel I would be happy if I could obtain the WindowsImpersonationContext
>> for the account which runs the working process. If sombody could tell me
>> how to do this. In fact, all I want to do is to change the current
>> security context to that of the worker process, execute a sql query and
>> then revert to the previous context.
>> I don't want to explicitly set the credentials of any account. Is it
>> possible?
>>
>>

>
>