Process.Start with Username hangs

[Kirk]

The following C# web service works fine until you uncomment the lines
setting UserName and Password. Then the process starts as the
specified user, but hangs in a suspended state. In fact, any
executable will exhibit this problem; it is not specific to whoami.exe.
This is with .NET 2.0, of course (1.1 does not support running a
process as a different user). This appears to be a bug. Can anyone
comment?

<%@ WebService Language="C#" Class="Kirk.For kIt" %>

using System;
using System.IO;
using System.Collecti ons;
using System.Security ;
using System.Web.Serv ices;
using System.Diagnost ics;

namespace Kirk
{
public class ForkIt
{

[WebMethod]
public string Main()
{
Process p = new Process();
ProcessStartInf o pInfo = new
ProcessStartInf o(@"c:\windows\ system32\whoami .exe");

SecureString password = new SecureString();
// set value for password here.
password.Append Char('s');
password.Append Char('e');
password.Append Char('c');
password.Append Char('r');
password.Append Char('e');
password.Append Char('t');

pInfo.UserName = "Administrator" ;
pInfo.Password = password;
pInfo.CreateNoW indow = true;
pInfo.UseShellE xecute = false;
pInfo.RedirectS tandardOutput = true;

p.StartInfo = pInfo;
p.Start();

String output = p.StandardOutpu t.ReadToEnd();
p.WaitForExit() ;

return output;
}
}
}

[DKode]

hmmm

maybe try putting the domain/computer name in front of the username:

pInfo.UserName = "MyComputer\Adm inistrator";

not sure, i havent used this feature in 2.0 yet

[Kirk]

Thanks, but your suggestion doesn't help. There is a Domain member for
the ProcessStartInf o class, but setting that to the computer name
doesn't help. Anyway, the authentication is not an issue _in itself_
as I can see that the hung process is running as the specified user
(Administrator in this case). I can get any domain account to run the
process, it's just that the process hangs -- any process.

[Willy Denoyette [MVP]]

What OS are you running this on and Who's the callers identity, that is the
identity of the asp.net process or the impersonating identity if
impersonation is active?

Willy.

"Kirk" <ki***********@ gmail.com> wrote in message
news:11******** **************@ g14g2000cwa.goo glegroups.com.. .
| The following C# web service works fine until you uncomment the lines
| setting UserName and Password. Then the process starts as the
| specified user, but hangs in a suspended state. In fact, any
| executable will exhibit this problem; it is not specific to whoami.exe.
| This is with .NET 2.0, of course (1.1 does not support running a
| process as a different user). This appears to be a bug. Can anyone
| comment?
|
| <%@ WebService Language="C#" Class="Kirk.For kIt" %>
|
| using System;
| using System.IO;
| using System.Collecti ons;
| using System.Security ;
| using System.Web.Serv ices;
| using System.Diagnost ics;
|
| namespace Kirk
| {
| public class ForkIt
| {
|
| [WebMethod]
| public string Main()
| {
| Process p = new Process();
| ProcessStartInf o pInfo = new
| ProcessStartInf o(@"c:\windows\ system32\whoami .exe");
|
| SecureString password = new SecureString();
| // set value for password here.
| password.Append Char('s');
| password.Append Char('e');
| password.Append Char('c');
| password.Append Char('r');
| password.Append Char('e');
| password.Append Char('t');
|
| pInfo.UserName = "Administrator" ;
| pInfo.Password = password;
| pInfo.CreateNoW indow = true;
| pInfo.UseShellE xecute = false;
| pInfo.RedirectS tandardOutput = true;
|
| p.StartInfo = pInfo;
| p.Start();
|
| String output = p.StandardOutpu t.ReadToEnd();
| p.WaitForExit() ;
|
| return output;
| }
| }
| }
|

[Kirk]

OS is Windows 2003 Server. I run IE6 and invoke the Web Service via
the Invoke button from the default generator for .asmx files. The asmx
file is also local to the web server; everything is on the same
machine.

I have impersonate set to true in my
C:\WINDOWS\Micr osoft.NET\Frame work\v2.0.50727 \CONFIG\web.con fig file,
and I am logged in as a domain user (DOMAIN/SOFTINFO, same DOMAIN that
the server is in) with Administrative priviledges. When I invoke the
service, Environment.Dom ainName="SW-WEB"
Environment.Use rName="IUSR_SWD EVL2" (SW-WEB is the name of the machine,
SWDEVL2 was the previous name of the machine).

If I remove impersonation from my web.config, the service throws an
exception...Acc ess is Denied. Environment.Dom ainName="DOMAIN "
Environment.Use rName="SYSTEM". Not sure what SYSTEM really means, but
I suppose it doesn't have permission to create processes. Anyway,
that's why I enabled impersonation in the first place (plus it's how my
old ASP stuff works and I like it for our intranet).

I'm no expert, but my understanding is that impersonation will run my
Web Service thread as the client user, however, when my process forks,
it will run as the IIS user. I'm a bit confused, though, becuase I
would expect UserName to be "SOFTINFO" for the case where I have
impersonation turned on. Perhaps you can clarify this.

The Web Service is inline, and running from an Application Pool with
Identity set to Local System. I also set it to Network Service and
witness the same behavior. If I set it to Local Service I get the
following error when I Invoke the Web Service (this is not a problem
for me, but it might be a clue, I don't know):

System.InvalidO perationExcepti on: Unable to generate a temporary class
(result=1).
error CS2001: Source file 'C:\WINDOWS\TEM P\qa0vmnpy.0.cs ' could not be
found
error CS2008: No inputs specified

at System.Xml.Seri alization.Compi ler.Compile(Ass embly parent, String
ns, CompilerParamet ers parameters, Evidence evidence)
at
System.Xml.Seri alization.TempA ssembly.Generat eAssembly(XmlMa pping[]
xmlMappings, Type[] types, String defaultNamespac e, Evidence evidence,
CompilerParamet ers parameters, Assembly assembly, Hashtable assemblies)
at System.Xml.Seri alization.TempA ssembly..ctor(X mlMapping[]
xmlMappings, Type[] types, String defaultNamespac e, String location,
Evidence evidence)
at System.Xml.Seri alization.XmlSe rializer.FromMa ppings(XmlMappi ng[]
mappings, Evidence evidence)
at
System.Web.Serv ices.Protocols. XmlReturn.GetIn itializers(Logi calMethodInfo[]
methodInfos)
at
System.Web.Serv ices.Protocols. XmlReturnWriter .GetInitializer s(LogicalMethod Info[]
methodInfos)
at System.Web.Serv ices.Protocols. MimeFormatter.G etInitializers( Type
type, LogicalMethodIn fo[] methodInfos)
at System.Web.Serv ices.Protocols. HttpServerType. .ctor(Type type)
at System.Web.Serv ices.Protocols. HttpServerProto col.Initialize( )
at System.Web.Serv ices.Protocols. ServerProtocolF actory.Create(T ype
type, HttpContext context, HttpRequest request, HttpResponse response,
Boolean& abortProcessing )

Thanks,
Kirk

[Willy Denoyette [MVP]]

"Kirk" <ki***********@ gmail.com> wrote in message
news:11******** **************@ f14g2000cwb.goo glegroups.com.. .
| OS is Windows 2003 Server. I run IE6 and invoke the Web Service via
| the Invoke button from the default generator for .asmx files. The asmx
| file is also local to the web server; everything is on the same
| machine.
|
| I have impersonate set to true in my
| C:\WINDOWS\Micr osoft.NET\Frame work\v2.0.50727 \CONFIG\web.con fig file,
| and I am logged in as a domain user (DOMAIN/SOFTINFO, same DOMAIN that
| the server is in) with Administrative priviledges. When I invoke the
| service, Environment.Dom ainName="SW-WEB"
| Environment.Use rName="IUSR_SWD EVL2" (SW-WEB is the name of the machine,
| SWDEVL2 was the previous name of the machine).
|
Environment.Use rName="IUSR_SWD EVL2"
That's an indication that you are impersonating 'the' "anonymous" user.

| If I remove impersonation from my web.config, the service throws an
| exception...Acc ess is Denied. Environment.Dom ainName="DOMAIN "
| Environment.Use rName="SYSTEM". Not sure what SYSTEM really means, but
| I suppose it doesn't have permission to create processes. Anyway,
| that's why I enabled impersonation in the first place (plus it's how my
| old ASP stuff works and I like it for our intranet).
|

That's an indication that you run your asp.net process as localsystem. Note
that you can't create another process using different user credentials (as
you do in your code) from a process that runs as localsystem (W2K3 and XP
SP2).

| I'm no expert, but my understanding is that impersonation will run my
| Web Service thread as the client user, however, when my process forks,
| it will run as the IIS user. I'm a bit confused, though, becuase I
| would expect UserName to be "SOFTINFO" for the case where I have
| impersonation turned on. Perhaps you can clarify this.
|

Yes, taht's because you haven enabled Windows authentication while
impersonating (see you web.config file), so you are impersonating the
default "anonymous" user which has the form IUSR_XXXXX, where XXXXX is the
machine name.

| The Web Service is inline, and running from an Application Pool with
| Identity set to Local System. I also set it to Network Service and
| witness the same behavior. If I set it to Local Service I get the
| following error when I Invoke the Web Service (this is not a problem
| for me, but it might be a clue, I don't know):
|

"Local Service" or (better) "local network" must be granted access rights to
the TEMP folder and a couple of other folder too.
Note that all of these question can better be answered when you post to the
asp or aspnet NG's, this NG is for C# only.
Willy.

[Kirk]

Thanks. Your reply, some sleep, and a fresh pot of coffe have alerted
me to the fact that my virtual directory under IIS was set to allow
anonymous access -- not what I intended. So...I set it to integrated
Windows auth and now I see the DOMAIN user in Environment.Use rName when
I invoke the service (as expected). However, I get an Access is Denied
exception when I try to start the process when I set the
ProcesStartInfo UserName and Password to the local Administrator
account. If I don't set UserName and Password in ProcessStartInf o,
then the service runs fine. In that case, I see UserName is the domain
user I logged in as when challenged from the browser, and whoami.exe
returns "nt authority / system".

I suspect the issue is what you said: "Note that you can't create
another process using different user credentials (as you do in your
code) from a process that runs as localsystem (W2K3 and XP SP2)." I
assume the solution is to use an Application Pool to run the Web
Service in a process owned by a different user. So I set the
Configurable Identity section of the App Pool properties to use Local
Administrator (and added Administrator to the IIS_WPG group, and
granted user rights as specified here:
http://www.microsoft.com/technet/pro.../appisoa.mspx).
Now when I invoke without UserName set, whoami tells me it is the
local Administrator as expected. But if I set UserName, I still get
Access is Denied. What other access do I need to grant local
Administrator to allow it to create this process as a different user?

I will cross-post this to the aspnet NG.

Thanks, again.
Kirk

[Kirk]

Willy, I hope you haven't given up on me. I'm getting no responses
from the other newsgroups. Do you have any further suggestions for me?

Thanks,
Kirk

[Willy Denoyette [MVP]]

"Kirk" <ki***********@ gmail.com> wrote in message
news:11******** **************@ g43g2000cwa.goo glegroups.com.. .
| Thanks. Your reply, some sleep, and a fresh pot of coffe have alerted
| me to the fact that my virtual directory under IIS was set to allow
| anonymous access -- not what I intended. So...I set it to integrated
| Windows auth and now I see the DOMAIN user in Environment.Use rName when
| I invoke the service (as expected). However, I get an Access is Denied
| exception when I try to start the process when I set the
| ProcesStartInfo UserName and Password to the local Administrator
| account. If I don't set UserName and Password in ProcessStartInf o,
| then the service runs fine. In that case, I see UserName is the domain
| user I logged in as when challenged from the browser, and whoami.exe
| returns "nt authority / system".
|
| I suspect the issue is what you said: "Note that you can't create
| another process using different user credentials (as you do in your
| code) from a process that runs as localsystem (W2K3 and XP SP2)." I
| assume the solution is to use an Application Pool to run the Web
| Service in a process owned by a different user. So I set the
| Configurable Identity section of the App Pool properties to use Local
| Administrator (and added Administrator to the IIS_WPG group, and
| granted user rights as specified here:
|
http://www.microsoft.com/technet/pro.../appisoa.mspx).
| Now when I invoke without UserName set, whoami tells me it is the
| local Administrator as expected. But if I set UserName, I still get
| Access is Denied. What other access do I need to grant local
| Administrator to allow it to create this process as a different user?
|
| I will cross-post this to the aspnet NG.
And who's the user you set, is it a local user?
If it's a local user, can he launch the command from the command line (using
runas)
Willy.

[Kirk]

I tried domain users as well as the local (server) administrator
account, which I thought for sure should work since that's what the
pool is running as, but still no luck. I can run "runas
/user:Administra tor "c:\windows\sys tem32\whoami.ex e" no problem. (I
can see that it is in fact running if I runas a batch file that calls
whoami.exe over and over so the cmd box doesn't disappear right away.)
I can also run it as domain users (I tried using a domain account
instead of Administrator to manage the pool, but that didn't help).

A quick recap of my config and stuff just to check sanity:

* Windows Server 2003 with .NET 2.0 SDK installed
* IIS virtual directory for web_services set to integrated Windows
authentication
* web_services use app pool WebServices
* WebServices app pool sets Identity Configurable: local server
Administrator account
* (I also ran aspnet_regiis.e xe -ga on Administrator just in case)
* Impersonate set to true in web.config; authentication Windows
* Browser connects to aspx page as a separate domain user with access
to aspx file

My basic web service to invoke whoami.exe works fine with this config
unless you set UserName and Password on ProcessStartInf o. All
UserNames will fail, but most striking is the local server
Administrator also fails (even though that's what the pool uses). The
result is an Access is Denied exception from Process.Start.

Thanks,
Kirk