WCF, IPC Named Pipes, ASP.NET, and

Question

We have a .NET 4.0 Windows Service that is hosting an endpoint over a Named Pipe (using IPC). This service is running under the context of User A.

We have an ASP.NET-hosted client that is requesting the operation that is exposed by the aforementioned service. This client runs under the context of User B (via Anonymous Access ,via <identity impersonate="true" />).

The problem: If we use <identity impersonate="true" /> in our web.config (this cannot be changed), we get "Failed to connect to an IPC Port: Access is denied." exceptions when the client tries to call the hosted operation. If <identity impersonate... /> does not exist (perhaps by virtue of not using ASP.NET, say a client Console Application), we have no issue.

Does anyone out there know how to get this configuration working so we stop receiving Access Denied errors? It has something to do with authentication but we just can't work it out.

You question does not clearly tell if its working impersonation on. can you try running the IIS app pool of you ASP.Net app under USER A? — Dhawalk, Apr 03 '13 at 19:05
I'm starting to think what I'm trying to achieve can't be done: http://stackoverflow.com/questions/3366976/using-wcfs-net-pipe-in-a-website-with-impersonate-true — , Apr 03 '13 at 19:41

score 0 · Answer 1 · answered Apr 04 '13 at 06:56

Recalling from 70-503: net.pipes only works with Windows security. It's obvious because the whole process (WCF) is on the current (Windows) machine only. ASP.NET runs under the credentials of a dedicated ASP.NET-user by default who's rights are strictly limited. I don't aspect the ASP.NET user having access to the current machine, accessing local files, net.pipes etc. It only has access to the folder your website runs from. So, by impersonating that very user is like ensuring having only the rights to run a website.

What you can do is impersonate to a specific Windows account who has the appropriate rights. This can be done using programmatic impersonation. Or use delegation. Read about it here to use the solution who fits best.

The Worker process can run under any User account you like, not necessarily one with limited rights. — , Apr 04 '13 at 16:25

score 0 · Accepted Answer · edited May 23 '17 at 11:57

0

Not possible due to NetWorkService being restricted from seeing or accessing the pipe.

Answer here

edited May 23 '17 at 11:57

Community

1
1

answered Apr 15 '13 at 17:37

WCF, IPC Named Pipes, ASP.NET, and

2 Answers2