Starting a process from ASP.NET - Why does the process immediately die?

Question

I'm attempting to start a Process from an ASP.NET C# application. My application communicates with this process via the process' own API (this is a third-party program). I only need to run this process under certain circumstances, so I see no need in having it running on the server constantly, hence the need to start the process from my application.

The process I'm using is set to run in a "faceless" mode via command line arguments, and so doesn't need a GUI to appear anywhere. Without giving too much away, it performs complex calculations on specific data (the data is pulled from an external source from within the process, and this data is updated constantly) and exposes the results via an API. My application communicates with this API by passing xml formatted queries and receiving similarly formatted responses.

The problem I am having is that starting the process works fine, but it runs the process as the SYSTEM user. This is a problem because the process I'm starting is registered to a specific user, and runs in a limited "trial version" mode when running as SYSTEM and the API I need does not work as desired. So instead I intend to run as the specific user the program was registered under. When I add the logon information for the correct user however, the process starts and immediately exits...
Is there some specific way I should be doing this?

Here's the code I have that is not working properly:

public static bool ProcessActive() {
    return Process.GetProcesses().Any(p => p.ProcessName.Equals("Process", StringComparison.InvariantCultureIgnoreCase));
}

public static void  StopProcess() {
    List<Process> processExists = Process.GetProcesses().Where(p => p.ProcessName.Equals("Process", StringComparison.InvariantCultureIgnoreCase)).ToList();

    foreach (Process p in processExists) {
        p.Kill();
    }
}

public static bool StartProcess(bool stopIfStarted = false) {
    bool retVal = false;
    using (System.Security.SecureString password = new System.Security.SecureString()) {

        // Set up the variables required to run the process
        ProcessStartInfo pInfo = new ProcessStartInfo(@"C:\Program Files\Program\Program.exe");
        pInfo.Arguments = @"-arg1 -arg2";
        pInfo.WorkingDirectory = @"C:\Program Files\Program";
        pInfo.UserName = "username";
        pInfo.Domain = "DOMAIN";
        password.AppendChar('p');
        /* repeat for other password chars */
        pInfo.Password = password;
        pInfo.UseShellExecute = false;

        if (System.IO.File.Exists(pInfo.FileName)) {

            //Check if the process is already running
            bool processExists = ProcessActive();
            if (stopIfStarted && processExists) {
                StopProcess();
                processExists = ProcessActive();
            }

            //if not, start it.
            if (!processExists) {
                StatusHelper.Log("Process isn't running. Starting process...");
                using (Process realProcess = Process.Start(pInfo)) {
                    processExists = ProcessActive();
                    System.Threading.Thread.Sleep(1000);
                    processExists = ProcessActive();
                    if (realProcess.HasExited) {
                        // Always gets here
                    }
                    retVal = processExists;
                }
            }
        }
    }
    return retVal;
}

Answer 1

My way to start a process from ASP .Net 4.0:
1. A remoted class which actually starts the process ( it starts Adobe Reader in command line to print a PDF)
2. A systray application as the host for the remote object
3. An webservice which runs under .Net 2.0 and under a specific user, as a client for the remote object
4. The ASP .Net 4.0 website calls the webservice method

When a process is started from ASP .Net it "hangs". I can see it in Task Manager, but it does nothing, so this was the only solution I found. You can host the remote object in a console application or an windows service. WCF would be another good option to remoting, but I didn't try it, yet.

Answer 2

It may not answer your question, but a fairly robust way of doing that sort of thing is e.g. having a Windows Service installed that runs with correct credentials and do some communication between web server and service e.g. via private message queue or even some Web API.

This way you don't put yourself into a situation where you compromise your machine by giving the web process more rights than it really needs.

You can imagine that if that what you do is possible in a web process an attack has a lot of possibilities to get elevated rights on the machine.

Answer 3

I don't know of any specific way to set the process user rights, but you can see if the reason for immediate exit is within the process itself, say throwing exception due to limited rights.

Use StartInfo to get the process output streams:

pInfo.StartInfo.RedirectStandardInput = true;
pInfo.StartInfo.RedirectStandardOutput = true;
pInfo.StartInfo.RedirectStandardError = true;
pInfo.StartInfo.ErrorDialog = false;

After starting the process you can read it like this:

StreamReader sOut = pInfo.StandardOutput;
StreamReader sError = pInfo.StandardError;
string standardResult = sOut.ReadToEnd();
string standardError = sError.ReadToEnd();