|
Hi all,
I am not sure if this is the right place to post this...sorry in advance if it should be elsewhere:
I need a little help...here's the problem:
I am writing a windows service that runs under the localsystem account. In it's startup code it impersonates a domain user in order to gain access to files on another machine in the domain. All that works fine.
Trouble is: I try to create a set of FileSystemWatcher objects to monitor the directories on the remote machine and they fail, saying that the path is invalid. When I run the service under a domain account (not localsystem) the FileSystemWatchers work fine.
So I suspect (maybe) that the FileSystemWatchers are living in a seperate thread(s) that are running under the same login as the process started under, not the impersonated one.
Does this sound (un)reasonable to anyone? Anyone know how to get the FileSystemWatcher object to run under an impersonated identity?
Thanks in advance
Bill
|
|
|
|
|
Maybe a different way of asking the question is in order. If you were to successfully implement the impersonation, how would you (or your client) specify the user name and password for the user to impersonate? Likely, the answer would involve adding to or createing a configurtion UI and encrypting passwords to store in files or registry keys, etc. Since that would only get you to the same place that you already reached by specifying a proper login for the service itself -- are there any reasons you should not require that the service run under a domain account?
John
"You said a whole sentence with no words in it, and I understood you!" -- my wife as she cries about slowly becoming a geek.
|
|
|
|
|
Hi John,
Thanks for the advice. Actually, I have been considering that option too. As I understand it, I need to grant whatever domain user I select the "act as part of the operating system" privilege on the machine running the service, yes? I need to discuss with our network admins. if they have a domain level policy preventing this...don't know yet.
Definitely a good option...but I am not sure it's going to fly in the present setting.
Besides, at this point, I'd REALLY like to know how to make it work the way I am trying it... 
Thanks again,
Bill
|
|
|
|
|
The FileSystemWatcher runs in another thread, yes. How do you think you can set Enabled to true and continue your code?
Before you do set Enabled, you should get the impersonated IIdentity, wrap that in an IPrincipal implementation (such as WindowsPrincipal) and pass that to AppDomain.SetThreadPrincipal in order to set the principal for new threads created in this AppDomain.
Another idea to solve this problem is to - if possible - create an account in your domain specifically for this service, much like many database admins do for SQL Server. Then you can grant this user permission to whatever directories you need watched and exclude it from those that don't (just be sure to handle exceptions properly when access is denied).
Microsoft MVP, Visual C#
My Articles
|
|
|
|
|
Thank you Heath!
Duh! Of course they run in a seperate thread...Sorry my ignorance here runs deep aparently.
I tried to implement what you suggested...the code is below.
<br />
System.Security.Principal.WindowsPrincipal p;<br />
p=new WindowsPrincipal(System.Security.Principal.WindowsIdentity.GetCurrent());<br />
<br />
AppDomain.CurrentDomain.SetThreadPrincipal (p);<br />
I've verified that WindowsIdentity.GetCurrent() is, in fact, the identity I want to use...but it still gives me the same error (at the creation of the FileSystemWatchers...not when I enable them, btw).
What did I mess up? Do I need to create a new AppDomain?
I may follow your other advice and run the service under a special domain user but I'd really like to know how to do it this way too.
Thanks again.
Bill
|
|
|
|
|
Did you use WindowsIdentity.GetCurrent in the handler for any of the FileSystemWatcher events, or just after your service was started?
Microsoft MVP, Visual C#
My Articles
|
|
|
|
|
Heath,
All the Impersonation, WindowsIdentity.GetCurrent, etc. occur in the code of the service itself. It's all part the the OnStart event handler which, subsequently, also creates the FileSystemWatchers.
I do not reference WindowsIdentity.GetCurrent in the FileSystemWatcher event handlers...but I don't think it would matter, since the error occurs when the FileSystemWatcher constructor is called.
Bill
|
|
|
|
|
OK...
I could not get the AppDomain.SetThreadPrincipal to work, so I took another tact.
I created a class ImpersonatingLurker that derives from the System.IO.FileSystemWatcher. The only difference is that the first thing it does in it's constructor is the impersonation. This seems the get the principal set correctly for the thread then handles the FileSystemWatcher. The full class definition is:
public class ImpersonateingLurker :System.IO.FileSystemWatcher
{
public ImpersonateingLurker(string strPath,string strFilter, System.Security.Principal.WindowsPrincipal p)
{
Debug.WriteLine ("Lurker Constructor:"+p.Identity.Name );
WindowsIdentity i = (WindowsIdentity) p.Identity;
i.Impersonate ();
this.Path = strPath;
this.Filter = strFilter;
}
}
Then in the OnStart event handler for the windows service we do:
int iToken;
LogonUser("user","domain","password",3,0,out iToken);
IntPtr token2 = new IntPtr(iToken);
WindowsIdentity wi = new WindowsIdentity(token2);
WindowsPrincipal wp = new WindowsPrincipal (wi);
...
ImpersonateingLurker IL = new ImpersonateingLurker (PathOfInterest,Filter,wp);
And it all seems to work out...Thanks to Heath and John for their advice!
Bill
|
|
|
|
|
I need view combobox in datagrid
please help me
|
|
|
|
|
There are several articles available which teach people how to do this. Look through the articles here on www.codeproject.com[^], first. If you don't find it there, then do a search on www.google.com[^]. You will find a walkthrough, code, and other people's opinions on the article -- much better than a quick response someone may give here.
John
"You said a whole sentence with no words in it, and I understood you!" -- my wife as she cries about slowly becoming a geek.
|
|
|
|
|
I have a conundrum. I have recently been tasked with using a C# program to extract files from an Access Database. The files, Excel 2002, were stored using the following VBA based that I found on MSDN.
ACC: Reading, Storing, & Writing Binary Large Objects (BLOBs)
Further research found the following code which I thought would be the C# equivalent code so that I could extract the Excel spreadsheets back to a file. The aim of the project is that I could then email them as attachments to a central party in my company for review.
Obtaining BLOB Values from a Database
The VBA code extracts the Excel files back to their original state correctly while the C# extracted files are twice the size of the originals and totally unreadable by Excel.
Help????? What am I doing wrong?
Paul Kennedy
Father/Son/Husband/C Programmer
What else could you ask for?
|
|
|
|
|
Hi Paul,
First, I'm assuming that your code matches exactly with that from the links (except for the data source settings).
Second, I'm assuming that the data in the BLOB was generated by your VB code and not some other software.
In my experience, a size difference of exactly 2x normally indicates an ASCII vs. Unicode issue. Looking quickly at the links you provided, the VB code may actually storing a Unicode (2 byte) value in the database for each byte that was loaded into the string. IF that is the case, the VB code handles this when it reverses the loads the Blob that it had stored previously. However, the C# code is being precise by avoiding any translation to or from a string.
Take a hard look at the actual bytes coming back through the C# blob request. If every other byte is a zero, it is very probable that the VB code stored extra data. To solve this, you could either re-write the correct data into the database, or strip the extra byte from the values returned when the C# code gets the BLOB data.
John
"You said a whole sentence with no words in it, and I understood you!" -- my wife as she cries about slowly becoming a geek.
|
|
|
|
|
If this BLOB represents text, you can also use the System.Text.Encoding to translate the bytes to the correct text using the encoding that you specify.
Microsoft MVP, Visual C#
My Articles
|
|
|
|
|
Hi all.
I have the following regular expression pattern that I go t from a book.
^(?=.*\d)(?=.*[a-z])(?=.*[A-Z]).{8,10}$
The book says this is suppose to validate atleast 1 uppercase, 1 lowercase, 1 digit, no special characters and between 8 and 10 characters. So "hello123" is not valid, but "Hello123" is valid. Unfortunately "Hello 123" or "Hello@123" are also valid, but should be invalid. What is the correct regular expression syntax?
Thanks in advance
|
|
|
|
|
Hi,
In my quick testing, this change achived the desired goal (note that the last "." was replaced with "[0-9,a-z,A-Z]". I don't know all the terms used in working with regular expressions, but I suspect that this answer along with the book you are reading will give you an understanding of the situation!
^(?=.*\d)(?=.*[a-z])(?=.*[A-Z])[0-9,a-z,A-Z]{8,10}$
John
"You said a whole sentence with no words in it, and I understood you!" -- my wife as she cries about slowly becoming a geek.
|
|
|
|
|
Thanks John. It worked great.
|
|
|
|
|
Hi All,
How can i convert pdf to txt. Is there any free .NET libraries available.
Mahesh
|
|
|
|
|
There are many libraries available, a couple of which are advertised on CodeProject, like TallPDF. Search the comments in this forum (see the "Search comment" link at the top of the message box) for many previous discussions. There are not many free ones, though, since this isn't just something you throw together in a day.
Microsoft MVP, Visual C#
My Articles
|
|
|
|
|
Heath Stewart wrote:
There are not many free ones, though, since this isn't just something you throw together in a day.
As a sample of this, Linux, Mozilla, Mono, Gnome, KDE, OpenOffice and Bochs were all coded by a single guy who was bored on a single rainny afternoon.
Perl combines all the worst aspects of C and Lisp: a billion different sublanguages in one monolithic executable. It combines the power of C with the readability of PostScript. -- Jamie Zawinski
|
|
|
|
|
See my article, Using XML Digital Signatures for Application Licensing[^] for a conceptual overview of using XML Digital Signatures (though you could just as well use a binary signed file, but then you need to write a parser if you need one) to license your application.
As far as generating the numbers, you should probably come up with some kind of sequence for your serial numbers (hence "serial"). You won't have to come up with an algorithm and unique validation algorithm then. Just start with some number and increment, handing out each iteration as you go.
Microsoft MVP, Visual C#
My Articles
|
|
|
|
|
Why are you worried about the character length of the serial number after signing? Signing doesn't change the content that's signed (although you can envelope the signature, but the digest is not changed). If you sign your serial number, the serial number is not changed. You merely verify that the serial number hasn't changed by checking the signature, which uses a digest.
Microsoft MVP, Visual C#
My Articles
|
|
|
|
|
In order to decrypt the data, you would have to store the private key in the application! You might as well give it to your competition, especially if this is a managed application in which all they have to do is use ildasm.exe to extract absolutely everything. My article mentioned something along these lines.
You private key must remain private. You can't decrypt without it, so you shouldn't include it in your application. This is the concept my article talks about - something pretty common in application licensing - signing a document with personal information keeps it unique to a person or machine. You verify that the file exists, verify the file hasn't changed (hence the digest and signature), then verify that the signed information is correct (like the computer name or MAC address is the same). None of this requires a private key, so your private key is kept secret (as it should be).
Microsoft MVP, Visual C#
My Articles
|
|
|
|
|
We've looked into their product and it is very good. Why not use it?
In any case, they use the same concepts that my article discusses. In this case, however, the serial number is used as the validation key or the IV (initialization vector), not sure exactly which. You still have a private key such that you're the only one that can created signed files.
I recommend you at least download their trial and try it out. As I mentioned before, even signing a serial number isn't enough; you must also collect some sort of identity information to tie that serial number to a particular persona, machine, or domain. Otherwise, nothing is stopping someone from giving just the license file to someone else and it will still work without such identifying information.
Microsoft MVP, Visual C#
My Articles
|
|
|
|
|
Hi All,
.net doesn't has common dialog box for functionality "Open With"
How do I display it in the application if the file type is not registered to open by default with any application?
Can anybody give me any pointers
Thanks & Regards
Shailaja
|
|
|
|
|
Use the ProcessStartInfo and Process classes like so:
ProcessStartInfo info = new ProcessStartInfo("filename");
info.ErrorDialog = true;
info.UseShellExecute = true;
Process.Start(info);
Microsoft MVP, Visual C#
My Articles
|
|
|
|
|
General 
News 
Suggestion 
Question 
Bug 
Answer 
Joke 
Praise 
Rant 
Admin 
Submit an article or tip
