Remote call to COM impersonating another user

[JCav]

I need to call a COM object from a remote machine using C#. I also need to
pass on a different userID and password to the call. Has anyone done this?
I've used Java to do this using JIntegra, but the application I'm using
requires .NET.

Any advice?

[Nicholas Paldino [.NET/C# MVP]]

Well, you are more than likely going to have to call through DCOM/COM+.
Assuming you have it set up correctly on the other machine, and you have an
interface definition for the COM object you want to call, you can call the
GetTypeFromProg ID (or GetTypeFromCLSI D), using the overload which will take
a remote machine name. You would then create an instance of that type
through a call to CreateInstance on the Activator class, and cast to your
interface type.

Mind you, the semantics of making a remote call are different than just
making a regular COM call (activation contexts, instancing, and the like).

Do you already have the object set up for remote calls?

--
- Nicholas Paldino [.NET/C# MVP]
- mv*@spam.guard. caspershouse.co m

"JCav" <jc********@cin ci.rr.comwrote in message
news:47******** **************@ roadrunner.com. ..

>I need to call a COM object from a remote machine using C#. I also need to
pass on a different userID and password to the call. Has anyone done this?
I've used Java to do this using JIntegra, but the application I'm using
requires .NET.

Any advice?

[JCav]

It's set up for remote calls - I am able to make these calls remotely using
JIntegra. I guess what I need is to duplicate what JIntegra does. I get
authentication errors which leads me to believe that I need the mechanism
that sets up the call with credentials - in this case userID, password.


"Nicholas Paldino [.NET/C# MVP]" <mv*@spam.guard .caspershouse.c omwrote in
message news:%2******** *******@TK2MSFT NGP03.phx.gbl.. .

Well, you are more than likely going to have to call through DCOM/COM+.
Assuming you have it set up correctly on the other machine, and you have
an interface definition for the COM object you want to call, you can call
the GetTypeFromProg ID (or GetTypeFromCLSI D), using the overload which will
take a remote machine name. You would then create an instance of that
type through a call to CreateInstance on the Activator class, and cast to
your interface type.

Mind you, the semantics of making a remote call are different than just
making a regular COM call (activation contexts, instancing, and the like).

Do you already have the object set up for remote calls?

--
- Nicholas Paldino [.NET/C# MVP]
- mv*@spam.guard. caspershouse.co m

"JCav" <jc********@cin ci.rr.comwrote in message
news:47******** **************@ roadrunner.com. ..

>>I need to call a COM object from a remote machine using C#. I also need to
pass on a different userID and password to the call. Has anyone done this?
I've used Java to do this using JIntegra, but the application I'm using
requires .NET.

Any advice?

[Nicholas Paldino [.NET/C# MVP]]

Well, you can always impersonate that caller on the client thread, and
then call the CoImpersonateCl ient API function through the P/Invoke layer
(make sure to call CoRevertToSelf) .

--
- Nicholas Paldino [.NET/C# MVP]
- mv*@spam.guard. caspershouse.co m

"JCav" <jc********@cin ci.rr.comwrote in message
news:47******** **************@ roadrunner.com. ..

It's set up for remote calls - I am able to make these calls remotely
using JIntegra. I guess what I need is to duplicate what JIntegra does. I
get authentication errors which leads me to believe that I need the
mechanism that sets up the call with credentials - in this case userID,
password.


"Nicholas Paldino [.NET/C# MVP]" <mv*@spam.guard .caspershouse.c omwrote
in message news:%2******** *******@TK2MSFT NGP03.phx.gbl.. .

> Well, you are more than likely going to have to call through
DCOM/COM+. Assuming you have it set up correctly on the other machine,
and you have an interface definition for the COM object you want to call,
you can call the GetTypeFromProg ID (or GetTypeFromCLSI D), using the
overload which will take a remote machine name. You would then create an
instance of that type through a call to CreateInstance on the Activator
class, and cast to your interface type.

Mind you, the semantics of making a remote call are different than
just making a regular COM call (activation contexts, instancing, and the
like).

Do you already have the object set up for remote calls?

--
- Nicholas Paldino [.NET/C# MVP]
- mv*@spam.guard. caspershouse.co m

"JCav" <jc********@cin ci.rr.comwrote in message
news:47******* *************** @roadrunner.com ...

>>>I need to call a COM object from a remote machine using C#. I also need
to pass on a different userID and password to the call. Has anyone done
this? I've used Java to do this using JIntegra, but the application I'm
using requires .NET.

Any advice?

[JCav]

My situation is I'm the C# client. I don't have access to the server code. I
know the credentials I need to access the COM server. When my client calls
the COM object it gets rejected. When I use JIntegra, I set the credentials
before I make the call, and the COM server is happy. CoImpersonateCl ient
seems to be something the server calls.

Since JIntegra can do it, there's obviously a way. I just don't know what
calls they make to do it, and they're not telling.

"Nicholas Paldino [.NET/C# MVP]" <mv*@spam.guard .caspershouse.c omwrote in
message news:eQ******** ******@TK2MSFTN GP06.phx.gbl...

Well, you can always impersonate that caller on the client thread, and
then call the CoImpersonateCl ient API function through the P/Invoke layer
(make sure to call CoRevertToSelf) .

--
- Nicholas Paldino [.NET/C# MVP]
- mv*@spam.guard. caspershouse.co m

"JCav" <jc********@cin ci.rr.comwrote in message
news:47******** **************@ roadrunner.com. ..

>It's set up for remote calls - I am able to make these calls remotely
using JIntegra. I guess what I need is to duplicate what JIntegra does. I
get authentication errors which leads me to believe that I need the
mechanism that sets up the call with credentials - in this case userID,
password.


"Nicholas Paldino [.NET/C# MVP]" <mv*@spam.guard .caspershouse.c omwrote
in message news:%2******** *******@TK2MSFT NGP03.phx.gbl.. .

>> Well, you are more than likely going to have to call through
DCOM/COM+. Assuming you have it set up correctly on the other machine,
and you have an interface definition for the COM object you want to
call, you can call the GetTypeFromProg ID (or GetTypeFromCLSI D), using
the overload which will take a remote machine name. You would then
create an instance of that type through a call to CreateInstance on the
Activator class, and cast to your interface type.

Mind you, the semantics of making a remote call are different than
just making a regular COM call (activation contexts, instancing, and the
like).

Do you already have the object set up for remote calls?

--
- Nicholas Paldino [.NET/C# MVP]
- mv*@spam.guard. caspershouse.co m

"JCav" <jc********@cin ci.rr.comwrote in message
news:47****** *************** *@roadrunner.co m...
I need to call a COM object from a remote machine using C#. I also need
to pass on a different userID and password to the call. Has anyone done
this? I've used Java to do this using JIntegra, but the application I'm
using requires .NET.

Any advice?

[Nicholas Paldino [.NET/C# MVP]]

JCav,

You are right. Willy actually posted the correct answer just below.
--
- Nicholas Paldino [.NET/C# MVP]
- mv*@spam.guard. caspershouse.co m

"JCav" <jc********@cin ci.rr.comwrote in message
news:47******** *************** @roadrunner.com ...

My situation is I'm the C# client. I don't have access to the server code.
I know the credentials I need to access the COM server. When my client
calls the COM object it gets rejected. When I use JIntegra, I set the
credentials before I make the call, and the COM server is happy.
CoImpersonateCl ient seems to be something the server calls.

Since JIntegra can do it, there's obviously a way. I just don't know what
calls they make to do it, and they're not telling.

"Nicholas Paldino [.NET/C# MVP]" <mv*@spam.guard .caspershouse.c omwrote
in message news:eQ******** ******@TK2MSFTN GP06.phx.gbl...

> Well, you can always impersonate that caller on the client thread, and
then call the CoImpersonateCl ient API function through the P/Invoke layer
(make sure to call CoRevertToSelf) .

--
- Nicholas Paldino [.NET/C# MVP]
- mv*@spam.guard. caspershouse.co m

"JCav" <jc********@cin ci.rr.comwrote in message
news:47******* *************** @roadrunner.com ...

>>It's set up for remote calls - I am able to make these calls remotely
using JIntegra. I guess what I need is to duplicate what JIntegra does.
I get authentication errors which leads me to believe that I need the
mechanism that sets up the call with credentials - in this case userID,
password.


"Nicholas Paldino [.NET/C# MVP]" <mv*@spam.guard .caspershouse.c omwrote
in message news:%2******** *******@TK2MSFT NGP03.phx.gbl.. .
Well, you are more than likely going to have to call through
DCOM/COM+. Assuming you have it set up correctly on the other machine,
and you have an interface definition for the COM object you want to
call, you can call the GetTypeFromProg ID (or GetTypeFromCLSI D), using
the overload which will take a remote machine name. You would then
create an instance of that type through a call to CreateInstance on the
Activator class, and cast to your interface type.

Mind you, the semantics of making a remote call are different than
just making a regular COM call (activation contexts, instancing, and
the like).

Do you already have the object set up for remote calls?

--
- Nicholas Paldino [.NET/C# MVP]
- mv*@spam.guard. caspershouse.co m

"JCav" <jc********@cin ci.rr.comwrote in message
news:47***** *************** **@roadrunner.c om...
>I need to call a COM object from a remote machine using C#. I also need
>to pass on a different userID and password to the call. Has anyone done
>this? I've used Java to do this using JIntegra, but the application I'm
>using requires .NET.
>
Any advice?
>

[Willy Denoyette [MVP]]

"JCav" <jc********@cin ci.rr.comwrote in message
news:47******** *************** @roadrunner.com ...

My situation is I'm the C# client. I don't have access to the server code.
I know the credentials I need to access the COM server. When my client
calls the COM object it gets rejected. When I use JIntegra, I set the
credentials before I make the call, and the COM server is happy.
CoImpersonateCl ient seems to be something the server calls.

Since JIntegra can do it, there's obviously a way. I just don't know what
calls they make to do it, and they're not telling.

I told you what you need to do, see my other reply.

Willy.

[Willy Denoyette [MVP]]

"JCav" <jc********@cin ci.rr.comwrote in message
news:47******** *************** @roadrunner.com ...

I'm new to this, so bear with me. I seem to be missing something.

When I call LogonUser, it fails, I think because the domain I need to log
into is not available from the machine I run this from. When I use
the local domain it works fine - I become the other user when I
impersonate him. This is how far I got before the original post. Is there
a call
that sends this information to the server and tells it to do this? As I
said, this works with whatever JIntegra does it.

You don't have to send this information to the server, it's the role of COM
to authenticate the client and pass the security context to the server.
When you call CoInitializeSec urity, specifying DynamicCloaking (or
StaticCloacking ) very early in the process, COM will automatically pass the
impersonation token of the client to the server, the server will use this
token when impersonating (the server needs to call CoImpersonateCl ient for
this).
What you need to take care of is that the token passed is an impersonating
token, so be carefull when calling LogonUser, the token sent must be an
impersonation token not a direct token.
That means that you'll have to specify a "batch" or "interactiv e" logon type
when calling LogonUser, before calling Impersonate. Another option is to use
a "network" logon type and call "DuplicateToken " before using the duplicated
token in the Impersonate call.


Willy.

[JCav]

These are the calls I'm using. LogonUser is failing with a 1326 - invalid
userID or password, even though these work when I log onto the machine. So I
never get far enough to make the call to the COM object.
int retxxx = CoInitializeSec urity(IntPtr.Ze ro, -1, IntPtr.Zero, IntPtr.Zero,
RpcAuthnLevel.C onnect, RpcImpLevel.Imp ersonate, IntPtr.Zero,
(int)EoAuthnCap .DynamicCloakin g, IntPtr.Zero);

const int LOGON32_PROVIDE R_DEFAULT = 0;

const int LOGON32_LOGON_I NTERACTIVE = 2;

const int LOGON32_LOGON_N ETWORK = 3;

IntPtr tokenHandle = new IntPtr(0);

bool returnValue = LogonUser(xxx", "yyy", "zzz",LOGON32_L OGON_NETWORK,
LOGON32_PROVIDE R_DEFAULT, ref tokenHandle);

"Willy Denoyette [MVP]" <wi************ *@telenet.bewro te in message
news:ub******** ********@TK2MSF TNGP06.phx.gbl. ..

"JCav" <jc********@cin ci.rr.comwrote in message
news:47******** *************** @roadrunner.com ...

>I'm new to this, so bear with me. I seem to be missing something.

When I call LogonUser, it fails, I think because the domain I need to log
into is not available from the machine I run this from. When I use
the local domain it works fine - I become the other user when I
impersonate him. This is how far I got before the original post. Is there
a call
that sends this information to the server and tells it to do this? As I
said, this works with whatever JIntegra does it.

You don't have to send this information to the server, it's the role of
COM to authenticate the client and pass the security context to the
server.
When you call CoInitializeSec urity, specifying DynamicCloaking (or
StaticCloacking ) very early in the process, COM will automatically pass
the impersonation token of the client to the server, the server will use
this token when impersonating (the server needs to call
CoImpersonateCl ient for this).
What you need to take care of is that the token passed is an impersonating
token, so be carefull when calling LogonUser, the token sent must be an
impersonation token not a direct token.
That means that you'll have to specify a "batch" or "interactiv e" logon
type when calling LogonUser, before calling Impersonate. Another option is
to use a "network" logon type and call "DuplicateToken " before using the
duplicated token in the Impersonate call.


Willy.

[Willy Denoyette [MVP]]

"JCav" <jc********@cin ci.rr.comwrote in message
news:47******** **************@ roadrunner.com. ..

These are the calls I'm using. LogonUser is failing with a 1326 - invalid
userID or password, even though these work when I log onto the machine. So
I never get far enough to make the call to the COM object.
int retxxx = CoInitializeSec urity(IntPtr.Ze ro, -1, IntPtr.Zero,
IntPtr.Zero, RpcAuthnLevel.C onnect, RpcImpLevel.Imp ersonate, IntPtr.Zero,
(int)EoAuthnCap .DynamicCloakin g, IntPtr.Zero);

const int LOGON32_PROVIDE R_DEFAULT = 0;

const int LOGON32_LOGON_I NTERACTIVE = 2;

const int LOGON32_LOGON_N ETWORK = 3;

IntPtr tokenHandle = new IntPtr(0);

bool returnValue = LogonUser(xxx", "yyy", "zzz",LOGON32_L OGON_NETWORK,
LOGON32_PROVIDE R_DEFAULT, ref tokenHandle);

And you function declaration looks like:

[DllImport("adva pi32", CharSet = CharSet.Auto, SetLastError = true)]
[return: MarshalAs(Unman agedType.Bool)]
static extern bool LogonUser(
string lpszUserName,
string lpszDomain,
string lpszPassword,
int dwLogonType,
int dwLogonProvider ,
ref IntPtr hToken);

bool result = LogonUser(name, domain, passwd,
LOGON32_LOGON_I NTERACTIVE ,
LOGON32_PROVIDE R_DEFAULT,
ref tokenHandle);
if (result == false) // If failed
{
}
else // success
{

Note that you should use LOGON32_LOGON_I NTERACTIVE or LOGON32_LOGON_B ATCH
(value 4) as logon type, other types will not return a token that can be
used to impersonate unless you are running in the context of an
administrator (or an account with "SeImpersonateP rivileges" enabled) .
Willy.