Knowledge Base

A System.Security.SecurityException exception occurs when you try to impersonate a user from a secondary thread in an ASP.NET Web application

Article ID: 842790

Article Last Modified on 4/3/2007

APPLIES TO

Microsoft ASP.NET 1.1, when used with:
- Microsoft Windows XP Embedded
- Microsoft Windows XP Professional
- Microsoft Windows 2000 Service Pack 3
- Microsoft Windows 2000 Service Pack 2
- Microsoft Windows 2000 Service Pack 1
- Microsoft Windows 2000 Standard Edition
Microsoft ASP.NET 1.0, when used with:
- Microsoft Windows XP Embedded
- Microsoft Windows XP Professional
- Microsoft Windows 2000 Service Pack 3
- Microsoft Windows 2000 Service Pack 2
- Microsoft Windows 2000 Service Pack 1
- Microsoft Windows 2000 Standard Edition

SYMPTOMS

In a Microsoft ASP.NET Web application, when you try to impersonate a user from a secondary thread, a System.Security.SecurityException exception may occur. When the System.Security.SecurityException exception occurs, you receive the following error message:

An unhandled exception of type 'System.Security.SecurityException' occurred in Unknown Module.
Additional information: Unable to impersonate user.

This behavior occurs if all the following conditions are true:

You enable impersonation in the Web.config file of your application.
In the <processModel> element of the Machine.config file, the value of the userName attribute is specified as Machine to run the ASP.NET worker process in the security context of the ASPNET local user account.
You use Integrated Windows authentication for your application.

This behavior does not occur in Microsoft Windows Server 2003 or in Microsoft Windows 2000 Service Pack 4 (SP4).

CAUSE

If you enable impersonation in the Web.config file of your ASP.NET Web application, only the primary thread of the application impersonates the user who you have specified. The secondary thread and the other threads that you start in your application use the security context of the ASPNET local user account. However, only the impersonated user account can access the Thread object for the secondary thread. Because the ASPNET user account lacks the rights to access this Thread object, you cannot impersonate a user from the secondary thread.

WORKAROUND

To work around this problem, use one of the following methods:

Call the RevertToSelf function before you start the secondary thread.
Assign the Act as part of the operating system user right to the ASPNET user account.
Change the value of the userName attribute of the <processModel> element in the Machine.config file.

Call the RevertToSelf function before you start the secondary thread

Declare a reference to the RevertToSelf function in the Advapi32.dll DLL. To do this, locate the following code:
```
public class <WebFormName> : System.Web.UI.Page
{
```
Note <WebFormName> is a placeholder for the name of your Web form.

Add the following code after the code that you just located:

[DllImport("advapi32.dll", CharSet=CharSet.Auto, SetLastError=true)]
public static extern bool RevertToSelf();

Locate the following code:
```
<ThreadObject>.Start()
```
Note <ThreadObject> is a placeholder for the name of the secondary thread.
Add the following code before the code that you just located:
```
RevertToSelf();
```

Grant the Act as part of the operating system user right to the ASPNET user account

Open the Local Security Policy snap-in.
In the left pane of the Local Security Policy snap-in, expand Local Policies, and then click User Rights Assignment.
Add the ASPNET user account.

If you are using Microsoft Windows XP, follow these steps:
1. In the right pane of the Local Security Settings snap-in, locate the Policy field, and then double-click Act as part of the operating system. The Act as part of the operating system Properties dialog box appears.
2. Click Add User or Group. The Select Users or Groups dialog box appears.
3. In the Enter the object names to select box, type ASPNET, and then click OK.
4. Click OK, and then close the Local Security Settings snap-in.
If you are using Microsoft Windows 2000, follow these steps:
1. In the right pane of the Local Security Settings snap-in, locate the Policy field, and then double-click Act as part of the operating system. The Local Security Policy Setting dialog box appears.
2. Click Add. The Select Users or Groups dialog box appears.
3. In the Name field, click ASPNET.
4. Click Add, and then click OK.
5. Click OK, and then close the Local Security Settings snap-in.

Change the value of the userName attribute of the <processModel> element in the Machine.config file

Use a text editor such as Notepad to open the Machine.config file. The Machine.config file is located in the %WINDIR%\Microsoft.NET\Framework\v1.1.4322\Config folder or in the %WINDIR%\Microsoft.NET\Framework\v1.1.3705\Config folder, depending upon the version of the Microsoft .NET Framework that you are using.
Locate the following attribute of the <processModel> element:
```
userName="Machine"
```
Replace the attribute that you located in step 2 with the following attribute:
```
userName="System"
```

STATUS

This behavior is by design.

MORE INFORMATION

Steps to reproduce the behavior

Start Microsoft Visual Studio .NET.
Use Microsoft Visual C# .NET to create an ASP.NET Web Application project that is named MyApp. By default, a Web form that is named WebForm1 is created.
In Solution Explorer, double-click Web.config to open the Web.config file.
Locate the following element in the Web.config file:
```
<authentication mode="Windows"
                />
```
Add the following element after the element that you located in step 4:
```
<identity
                impersonate="true" userName="UserName"
                password="Password" />
```
Note Replace UserName and Password with the credentials of the user who you want to impersonate.
In Solution Explorer, right-click WebForm1.aspx, and then click View Code to open the code view of the WebForm1 Web form.

Add the following code at the top of the code window to import the required namespaces:

using System.Web.Security;
using System.Security.Principal;
using System.Runtime.InteropServices;
using System.Threading;

Locate the following code:

public class WebForm1 : System.Web.UI.Page
{

Add the following code after the code that you located in step 8:

// Declare a WindowsImpersonationContext object.
WindowsImpersonationContext ImpersonationContext;

Locate the following code:

// Put user code to initialize the page here.

Replace the code that you located in step 10 with the following code:

Response.Write("In the primary thread<br>");
Thread oThread = new Thread(new ThreadStart(ThreadMethod));
// Start the secondary thread.
oThread.Start();
Thread.Sleep(10000);

Add the following code before the Web Form Designer generated code region:

public void ThreadMethod()
{
    try
    {
        Response.Write("In the secondary thread<br>");
        // Try to impersonate a user.
        ImpersonationContext = ((System.Security.Principal.WindowsIdentity)User.Identity).Impersonate();
        Response.Write("Successfully impersonated from a secondary thread");
        ImpersonationContext.Undo(); 
    }
    catch(Exception e)
    {
        Response.Write("Exception : " + e.Message.ToString());
    }
}

Make sure that your application uses Integrated Windows authentication.
Build and then run your application. The behavior that is mentioned in the "Symptoms" section may occur.

REFERENCES

For additional information, click the following article numbers to view the articles in the Microsoft Knowledge Base:

306158 Implementing impersonation in an ASP.NET application

319615 "Unable to impersonate user" error message when you use WindowsIdentity.Impersonate method

For more information, visit the following Microsoft Developer Network (MSDN) Web sites:

Application Architecture for .NET: Designing Applications and Services
http://msdn2.microsoft.com/en-us/library/ms954595.aspx

Building Secure ASP.NET Applications: Authentication, Authorization, and Secure Communication
http://msdn2.microsoft.com/en-us/library/aa302415.aspx

Keywords: kbinterop kbauthentication kbconfig kbwebforms kbuser kbsecurity kbwebserver kbclient kberrmsg kbprb KB842790

Microsoft KB Archive/842790

Contents