implement impersonation in an ASP.NET application

Impersonation in .Net allows you to run an application in a particular user account which is determined by you. Usually the account in which the application runs is ASPNET or NETWORK SERVICE depending on the version of IIS you are running in your machine. With IIS 5.0 the ASPNET account is used and it is not possible to override this account in the web.config file. In the IIS 6.0 you can configure this in the web.config file so that you can run the application on a different user account. With the help of impersonation, application can be run by a different user with different permission levels.
We can implement Impersonation in three ways:

1. Impersonate the Microsoft IIS Authenticated Account or User:

To impersonate the IIS authenticating user on every request for every page in an ASP.NET application, we must include an tag in the Web.config file of this application and set the impersonate attribute to true. By default impersonation is disabled and the anonymous user account is used by IIS.

< impersonate="'">

2. Impersonate a Specific User:
To impersonate a specific user for all the requests on all pages of an ASP.NET application, you can specify the userName and password attributes in the tag of the Web.config file for that application.

< impersonate="'" username="AccountName" password="password">

3. Impersonate through the code:
I have a machine A (Server) from where I have to use its resources. That machine is very secure and does not allow accessing its resources to everyone (Client). To accessing its resources I have to implement the Impersonation. Since there are numbers of users who will access those resources, that’s why I have to implement the Impersonation through the code.

Figure-1

As you can see in the Figrue-1, there is a Machine A and I have to read and write a Myfile.xml file, which is located in the file system of the Machine A. Since no any client can read/write that file, so that I have created a Web Service in ASP.NET and apply the impersonation into that web service, and all the clients can access that web service and easily read/write into that file. You can also implement the same scenario to create/delete the file or folders in the server.

Steps:

1. Create a new web service.

2. Change into the web.config file. Add the following tag in the tag.

< key="FilePath" value="D:\Projects\Impersonation\Myfile.xml">
< key="UserName" value="Pankaj">
< key="Pwd" value="password">
< key="DomainName" value="DomainName">

Change the appropriate values according to the authenticated user of that machine.

3. Include the AuthenticateUser class in the web service. This class is used to impersonate your code.

4. Add the following function to the Service.cs class

private void AuthenticateUser()
{
AuthenticateUser obAuthenticateUser = new AuthenticateUser();
try
{
obAuthenticateUser.Authenticate();
}
catch
{
throw;
}
finally
{
obAuthenticateUser = null;
}

4. Call the AuthenticateUser(); method into the every method of the web service. This method should be the called first in the each method, because this method will authenticate your code to run in the context. For example I have to get the Folder Path from the MyFile.xml, then I have created a function GetFolderPath in the service.asmx.cs file and write the code in the following manner

[WebMethod]
public string GetFolderPath()
{

//authenticate the user
AuthenticateUser();
string folderPath = string.Empty;
FileOperation.FileOperation obFileOperation = new FileOperation.FileOperation();
try
{
folderPath = obFileOperation.FolderPath;
}
catch
{
throw;
}
return folderPath;
}

5. Create a Web Application and add the reference of the web service. Now your web application can read and write the xml file which is located to another machine.

Why I have used Web Service: When we have a two or more then two machines (hosting server), and we need to read/write the file from a specified machine (hosting server) and each machine have different authentication, then web service is the best solution. I will create a web service and integrate each web service in each machine with their specified user authentication. Now each machine have same web service with their authentication to read/write file of that machine. Now any user to read/write that file of any machine then it does not need to be authenticated, since web service is already authenticated, it just need to call the web service of that specified machine. To call the specified web service of a machine, we can call by the setting of url of the web service object at run time. For example, suppose I am userA and I need to access the Machine-A web service to read/write the file of Machine-A. There is also another machine Machine-AA where my web application is hosted. Now I need to access the Machine-A file though the hosted web application of Machine-AA. Then I will pass the IP address of the Machine-A and set the url property of the Machine-A's web service object. i.e.

obMachine-AWebService.Url = "http://" + IPAddressOfmachine-A + "WebserviceName" ;

Now we can access the any machine's file/web service only just passing the IP address of that machine with the same web application.

Download: