Security for a worker thread

[maa]

How do I adjust the security for a worker thread in asp.net?
Thanks,
maa

 

[Dominick Baier]

could you expand a little bit more on this?

 

[maa]

I have my main asp.net thread which can access the database using
impersonation=
true. I then create worker threads but they don't have rights to the db and
login fails. Is there a way to delegate/transfer the creating thread rights
to the worker thread?
Thanks,
maa

 

[Dominick Baier]

Yes. It depends how you create the threads. There is also a config switch

see here: http://www.leastprivilege.com/WhatIsAspnetconfig.aspx

 

[maa]

Dominick,

This will eventually go on a client site so the config switch is not
accessible. I am using C#/.Net 2.0 so I can possible change the create thread
to allow the rights to flow. Is that possible?
In other words I have access programmatically to set the rights/context for
the new thread.

Thanks,
maa

 

[Dominick Baier]

I am confused. Are you talking about ASP.NET or clients?

In general impersonation information flows to newly created threads by default
since .net 2.0.
ASP.NET is an exception here because it was considered as a breaking change
- thats why there is the config file to opt-in to the new behavior.

How do you create the thread?

 

[Dominick Baier]

ah and btw - the account need the SeImpersonatePrivilege to make impersonation
work.

 

[maa]

I am working in Asp.Net. When I create the threads, the threads can not
access the database. Sorry for the confusion.
Thanks,
maa

 

[maa]

Thread t1 = new Thread(new ParameterizedThreadStart(VAD));
t1.Start(threadArgs);

 

[Dominick Baier]

simply do a

string username = WindowsIdentity.GetCurrent().Name in your thread proc to
see if the impersonation token has been flowed.

or add a watch for $user to the debug watch window