Starting a console application from asp.net using authenticated user credentials

Question

I have the following asynchronous controller actions which allows me to start a console application on a remote server. My issue is with regards to the permissions and authentication. I have tried the following, which in my understanding allows the app.Start(valuationDate) to run as the impersonated user. The reason for this is that the console application needs to access network resources and the user of this web app will have the required access rights. (As a side note, the console app runs as a scheduled task without error)

The issue I suspect is that the console app is still run under the IIS app pool identity which causes network resource "Access Denied" errors. The console application itself starts, but the restricted access of the IIS user account causes the failure.

I have tried changing the AppPool identity to run as an authorised user and the process executes correctly. I am hoping for a solution that does not require me to change the AppPool identity on the server.

How can I do to start the console application using the authenticated users details?

Controller Actions:

[HttpPost]
public void RunAsync(DateTime valuationDate)
{
    AsyncManager.OutstandingOperations.Increment();
    Task.Factory.StartNew(() => RunApp(valuationDate));
}

private void RunApp(DateTime valuationDate)
    {
        ConsoleWrapper app = new ConsoleWrapper();
        WindowsIdentity winId = (WindowsIdentity)HttpContext.User.Identity;           
        WindowsImpersonationContext ctx = null;
        try
        {
            ctx = winId.Impersonate();
            app.Start(valuationDate);
        }
        catch (Exception e)
        {
            throw;
        }
        finally
        {

            if (ctx != null) {ctx.Undo();}

        }
        AsyncManager.Parameters["success"] = app.Success();
        AsyncManager.Parameters["message"] = app.Message();
        AsyncManager.OutstandingOperations.Decrement();
    }

ConsoleWrapper:

public void Start(DateTime valuationDate)
    {
        var appExe = Config.Default.CONSOLE_APP;
        InProgress = true;
        log = String.Empty;
        success = false;
        message = String.Empty;

        try
        {
            var process = new Process();
            process.StartInfo.FileName = appExe;
            process.StartInfo.Arguments = valuationDate.ToString("dd-MMM-yyyy");

            process.EnableRaisingEvents = true;

            process.StartInfo.UseShellExecute = true;
            process.StartInfo.RedirectStandardOutput = true;

            process.Exited += new EventHandler(process_Exited);
            process.OutputDataReceived += new DataReceivedEventHandler(process_OutputDataReceived);
            process.Start();
            process.WaitForExit();

        }
        catch (Exception e){/* snip */}

    }

Darin Dimitrov · Accepted Answer · 2011-04-11T05:52:41.710

1

If you are using Windows Authentication and the application you are trying to run is located on a remote server you need delegation and not impersonation:

To access a network resource, you need to delegate-level token. To get this token type, your server needs to be configured as trusted for delegation in Active Directory.

You may also checkout the following KB. And yet another article on MSDN.

Another possibility is to have some generic account that will be always used for running the console application.

edited Apr 11 '11 at 05:52

answered Mar 09 '11 at 07:30

Darin Dimitrov

1,023,142
271
3,287
2,928

Is there any other way besides delegation? From a programmatic perspective perhaps? – Ahmad Mar 09 '11 at 08:19
@Ahmad, you could do it programatically but you need to know the password of the client which I suppose is not your case. If you don't know the password you need to setup delegation. Another possibility is to have some generic account that will be always used for running the console application. – Darin Dimitrov Mar 09 '11 at 08:30
thanks darin, i thought as much. I may just stick with domain acount / AppPool combination as its seems the simplest for the moment. I will test the delegation options, but fear the IT department may hinder progress. – Ahmad Mar 09 '11 at 08:39
if you update your answer with the second part of your comment, I can mark this as accepted... – Ahmad Apr 11 '11 at 05:16

Starting a console application from asp.net using authenticated user credentials

1 Answers1

Linked