Microsoft KB Archive/842790

= A System.Security.SecurityException exception occurs when you try to impersonate a user from a secondary thread in an ASP.NET Web application =

Article ID: 842790

Article Last Modified on 4/3/2007

-

APPLIES TO

 Microsoft ASP.NET 1.1, when used with:  Microsoft Windows XP Embedded

 Microsoft Windows XP Professional

 Microsoft Windows 2000 Service Pack 3

 Microsoft Windows 2000 Service Pack 2</li></ul>

 Microsoft Windows 2000 Service Pack 1</li></ul>

 Microsoft Windows 2000 Standard Edition</li></ul> </li> Microsoft ASP.NET 1.0, when used with:  Microsoft Windows XP Embedded</li></ul>

 Microsoft Windows XP Professional</li></ul>

 Microsoft Windows 2000 Service Pack 3</li></ul>

 Microsoft Windows 2000 Service Pack 2</li></ul>

 Microsoft Windows 2000 Service Pack 1</li></ul>

 <li>Microsoft Windows 2000 Standard Edition</li></ul> </li></ul>

-

<div class="symptoms_section">

SYMPTOMS
In a Microsoft ASP.NET Web application, when you try to impersonate a user from a secondary thread, a System.Security.SecurityException exception may occur. When the System.Security.SecurityException exception occurs, you receive the following error message:

An unhandled exception of type 'System.Security.SecurityException' occurred in Unknown Module.

Additional information: Unable to impersonate user.

This behavior occurs if all the following conditions are true:
 * You enable impersonation in the Web.config file of your application.
 * In the <processModel> element of the Machine.config file, the value of the userName attribute is specified as Machine to run the ASP.NET worker process in the security context of the ASPNET local user account.
 * You use Integrated Windows authentication for your application.

This behavior does not occur in Microsoft Windows Server 2003 or in Microsoft Windows 2000 Service Pack 4 (SP4).

<div class="cause_section">

CAUSE
If you enable impersonation in the Web.config file of your ASP.NET Web application, only the primary thread of the application impersonates the user who you have specified. The secondary thread and the other threads that you start in your application use the security context of the ASPNET local user account. However, only the impersonated user account can access the Thread object for the secondary thread. Because the ASPNET user account lacks the rights to access this Thread object, you cannot impersonate a user from the secondary thread.

<div class="workaround_section">

WORKAROUND
To work around this problem, use one of the following methods:
 * Call the RevertToSelf function before you start the secondary thread.
 * Assign the Act as part of the operating system user right to the ASPNET user account.
 * Change the value of the userName attribute of the <processModel> element in the Machine.config file.

Call the RevertToSelf function before you start the secondary thread
<ol> <li> Declare a reference to the RevertToSelf function in the Advapi32.dll DLL. To do this, locate the following code: public class <WebFormName> : System.Web.UI.Page { Note  is a placeholder for the name of your Web form. </li> <li> Add the following code after the code that you just located: [DllImport(&quot;advapi32.dll&quot;, CharSet=CharSet.Auto, SetLastError=true)] public static extern bool RevertToSelf; </li> <li> Locate the following code: <ThreadObject>.Start Note is a placeholder for the name of the secondary thread. </li> <li> Add the following code before the code that you just located: RevertToSelf; </li></ol>

Grant the Act as part of the operating system user right to the ASPNET user account
<ol> <li>Open the Local Security Policy snap-in.</li> <li>In the left pane of the Local Security Policy snap-in, expand Local Policies, and then click User Rights Assignment.</li> <li>Add the ASPNET user account.

If you are using Microsoft Windows XP, follow these steps: <ol style="list-style-type: lower-alpha;"> <li>In the right pane of the Local Security Settings snap-in, locate the Policy field, and then double-click Act as part of the operating system. The Act as part of the operating system Properties dialog box appears.</li> <li>Click Add User or Group. The Select Users or Groups dialog box appears.</li> <li>In the Enter the object names to select box, type ASPNET, and then click OK.</li> <li>Click OK, and then close the Local Security Settings snap-in.</li></ol>

If you are using Microsoft Windows 2000, follow these steps: <ol style="list-style-type: lower-alpha;"> <li>In the right pane of the Local Security Settings snap-in, locate the Policy field, and then double-click Act as part of the operating system. The Local Security Policy Setting dialog box appears.</li> <li>Click Add. The Select Users or Groups dialog box appears.</li> <li>In the Name field, click ASPNET.</li> <li>Click Add, and then click OK.</li> <li>Click OK, and then close the Local Security Settings snap-in.</li></ol> </li></ol>

Change the value of the userName attribute of the <processModel> element in the Machine.config file
<ol> <li>Use a text editor such as Notepad to open the Machine.config file. The Machine.config file is located in the %WINDIR%\Microsoft.NET\Framework\v1.1.4322\Config folder or in the %WINDIR%\Microsoft.NET\Framework\v1.1.3705\Config folder, depending upon the version of the Microsoft .NET Framework that you are using.</li> <li> Locate the following attribute of the <processModel> element: userName=&quot;Machine&quot; </li> <li> Replace the attribute that you located in step 2 with the following attribute: userName=&quot;System&quot; </li></ol>

<div class="status_section">

STATUS
This behavior is by design.

<div class="moreinformation_section">

Steps to reproduce the behavior
<ol> <li>Start Microsoft Visual Studio .NET.</li> <li>Use Microsoft Visual C# .NET to create an ASP.NET Web Application project that is named MyApp. By default, a Web form that is named WebForm1 is created.</li> <li>In Solution Explorer, double-click Web.config to open the Web.config file.</li> <li> Locate the following element in the Web.config file: <authentication mode=&quot;Windows&quot; /> </li> <li> Add the following element after the element that you located in step 4: <identity impersonate=&quot;true&quot; userName=&quot;UserName&quot; password=&quot;Password&quot; /> Note Replace  and   with the credentials of the user who you want to impersonate. </li> <li>In Solution Explorer, right-click WebForm1.aspx, and then click View Code to open the code view of the WebForm1 Web form.</li> <li> Add the following code at the top of the code window to import the required namespaces: using System.Web.Security; using System.Security.Principal; using System.Runtime.InteropServices; using System.Threading; </li> <li> Locate the following code: public class WebForm1 : System.Web.UI.Page { </li> <li> Add the following code after the code that you located in step 8: // Declare a WindowsImpersonationContext object. WindowsImpersonationContext ImpersonationContext; </li> <li> Locate the following code: // Put user code to initialize the page here. </li> <li> Replace the code that you located in step 10 with the following code: Response.Write(&quot;In the primary thread &quot;); Thread oThread = new Thread(new ThreadStart(ThreadMethod)); // Start the secondary thread. oThread.Start; Thread.Sleep(10000); </li> <li> Add the following code before the Web Form Designer generated code region: public void ThreadMethod {   try {       Response.Write(&quot;In the secondary thread &quot;); // Try to impersonate a user. ImpersonationContext = ((System.Security.Principal.WindowsIdentity)User.Identity).Impersonate; Response.Write(&quot;Successfully impersonated from a secondary thread&quot;); ImpersonationContext.Undo; }   catch(Exception e)    { Response.Write(&quot;Exception : &quot; + e.Message.ToString); } } </li> <li>Make sure that your application uses Integrated Windows authentication.</li> <li>Build and then run your application. The behavior that is mentioned in the &quot;Symptoms&quot; section may occur.</li></ol>

<div class="references_section">