Products

Solutions

Resources

Partners

Community

Blog

About

QA

Ideas Test

New Community Website

Ordinarily, you'd be at the right spot, but we've recently launched a brand new community website... For the community, by the community.

Yay... Take Me to the Community!

Welcome to the DNN Community Forums, your preferred source of online community support for all things related to DNN.
In order to participate you must be a registered DNNizen

HomeHomeDNN Open Source...DNN Open Source...Provider and Extension ForumsProvider and Extension ForumsAuthenticationAuthenticationImpersonation and access to UNC sharesImpersonation and access to UNC shares
Previous
 
Next
New Post
3/11/2013 12:52 PM
 

Hello,
I have a DNN 06.02.05 (24) hosts using Active Directory authentication, one on IIS 6 and one on IIS 7.5, both working good with mixed authentication (AD autologin and possibility to logoff and login with a DNN user, e.g. host).

I am now testing impersonation: I see that if I include <identity impersonate="true" /> I actually can see my domain user as the current windowsidentity (System.Security.Principal.WindowsIdentity.GetCurrent().Name). And I can test filesystem access with code like:

Try
                Dim ent() As String = IO.Directory.GetFileSystemEntries(path)
                DnnLog.Debug("ent=" & ent.GetUpperBound(0))

            Catch ex As Exception
                DnnLog.Error(ex.Message)
            End Try

Such function should just tell me if the folder exists, and if the currently logged-on user has access to it.
The problem is when I test access to an UNC share as the path (e.g. \\server\share\folder), I always get an access denied exception, but I do have access to such a share!

Is this a problem with UNC, with impersonation or both? Is there another way to perform such a check?

Thank you for any help,

al.

 

 

 
New Post
3/11/2013 1:29 PM
 
The user that you're using for impersonation also needs access to the share and possibly some ports open on the network. I'd have to dig through my old projects but I once did a module based off of the core's file management interface to allow read access to one of our network shares. In our case our server was out in the dmz and I had to get our network services group to allow access to the server share from there. What they did I don't know.
 
New Post
3/13/2013 9:08 AM
 

Mike,
thanks for your answer.
I figured out I cannot turn impersonation on, it gives me issues with my mixed authentication scenario (user cannot logout from site, and don't know if this can be solved).
So I probably need to impersonate the user somehow from code, when I perform an access check versus the file shares. BTW you're right about permissions and network access, I have local and remote shares and ports are to be open, but network is not a problem for me - I do have access to all of the shares, I can open and navigate all of them.

I'll try impersonation, and also investigate other API calls to check for access - have seen reports of many people saying DirectoryInfo.Exists() alwasys returns false when checking UNC paths.

Thanks for your help!
Regards,
al.

 
New Post
3/13/2013 10:36 AM
 

You can still use forms authentication with impersonation. You just un-comment that one line. Don't switch your authentication mode over to Windows. It's how I've got our school's website setup and it's a quasi-mixed mode setup. I discuss impersonation in the documentation and below is an example straight out of the school's web.config (though it may not show up).

For example:
<!-- Forms or Windows authentication -->
    <authentication mode="Forms">
      <forms name=".DOTNETNUKE" protection="All" timeout="60" cookieless="UseCookies" />
    </authentication>
    <identity impersonate="true" userName="domain\username" password="password" />
    <!--
   <identity impersonate="true"/>
   <authentication mode="Windows">
   </authentication>
-->

 
Previous
 
Next
HomeHomeDNN Open Source...DNN Open Source...Provider and Extension ForumsProvider and Extension ForumsAuthenticationAuthenticationImpersonation and access to UNC sharesImpersonation and access to UNC shares


These Forums are dedicated to discussion of DNN Platform and Evoq Solutions.

For the benefit of the community and to protect the integrity of the ecosystem, please observe the following posting guidelines:

  1. No Advertising. This includes promotion of commercial and non-commercial products or services which are not directly related to DNN.
  2. No vendor trolling / poaching. If someone posts about a vendor issue, allow the vendor or other customers to respond. Any post that looks like trolling / poaching will be removed.
  3. Discussion or promotion of DNN Platform product releases under a different brand name are strictly prohibited.
  4. No Flaming or Trolling.
  5. No Profanity, Racism, or Prejudice.
  6. Site Moderators have the final word on approving / removing a thread or post or comment.
  7. English language posting only, please.
What is Liquid Content?
Find Out
What is Liquid Content?
Find Out
What is Liquid Content?
Find Out