2

We are building a system on windows where we centrally (server) need to do fopen to either local files or remote smb resources. The idea is to authenticate in the case of remote resources before doing fopen (with unc paths). We need to authenticate with the credentials the user (client application) supplied for this resource on that remote share. We don't want to copy any resources.

Using the Win Net Api this works smoothly since it stores the given credentials so that subsequent fopens in the same or in different processes succeed.

But there is a problem: Many of you probably know the following message from windows when trying to connect to a smb share with different credentials then the ones used for a previous connection: "Multiple connections to a server or shared resource by the same user, using more than one user name, are not allowed. Disconnect all previous connections to the server or shared resource and try again." See http://support.microsoft.com/kb/938120 for the defined limitation and possible "work arounds".

Since we have a central server application running as a service ('Local System' account) we hit this limitation with having already two different users :). Closing the previously established connection to allow for the 2nd one is not an option (ongoing processing).

On the one hand it's great that windows caches authentication information on the other hand it's too limited. Modifying the hosts file for each user does not look very nice. Using smb client libraries (like libsmb++, impacket) doesn't seem to be the solution since we need "over process" authentication. Configuring a "master" smb share user is also not wanted. Maybe passing windows user auth tokens around is a way?

This problem is of general nature (i.e. independent of language) and I'm convinced that there are people out there who solved it (in a more or less elegant way ;)) I hope my explanation is understandable.

Thanks in advance for any hint. felix

felix
  • 21
  • 3
  • Passing access tokens (via `ImpersonateLoggedOnUser` and friends) looks like the way to go here. – Neil Jun 16 '14 at 11:00
  • Note that when it says "the same user" it really means "the same logon session". Each service (for example) will have its own logon session (IIRC) even if multiple services are using the same account. You can also create new logon sessions using `LogonUser` and related functions. – Harry Johnston Jun 17 '14 at 01:46
  • Impersonation is a good idea but won't work if the client and the service do not run on the same machine, right. Creating new logon sessions is very interesting. Thanks! Will have a look at it. – felix Jun 17 '14 at 07:40
  • You can impersonate a logon session that you created yourself, though I'm not sure offhand exactly how impersonation interacts with SMB. If it works it might save you the trouble of having multiple processes. – Harry Johnston Jun 18 '14 at 01:00
  • Possible duplicate of [Log in to a windows network share (SMB) for this process only](http://stackoverflow.com/questions/42634206/log-in-to-a-windows-network-share-smb-for-this-process-only) – Jonathan Allon Apr 24 '17 at 08:13

0 Answers0