Remote call to COM impersonating another user

[JCav]

I need to call a COM object from a remote machine using C#. I also need to
pass on a different userID and password to the call. Has anyone done this?
I've used Java to do this using JIntegra, but the application I'm using
requires .NET.

Any advice?

[JCav]

I call LogonUser just the way you specified and I'm still getting the 1326:

int ret = CoInitializeSec urity(IntPtr.Ze ro,-1,IntPtr.Zero,I ntPtr.Zero,
RpcAuthnLevel.C onnect,RpcImpLe vel.Impersonate , IntPtr.Zero,
(int)EoAuthnCap .DynamicCloakin g, IntPtr.Zero);

ret is zero ...
bool returnValue = LogonUser("UID" , "Domain", "password",
LOGON32_LOGON_I NTERACTIVE, LOGON32_PROVIDE R_DEFAULT, ref tokenHandle);

returns false with a code of 1326

I can connect to the machine in question using these values and mstsc.exe.
The domain I use to log into my machine is different from the domain I use
above. Is this an issue? Is there some kind of administrative flag keeping
me from doing this? Am I calling CoInitializeSec urity with the wrong values?
I'm using the definitions you sent in an earlier post.

"Willy Denoyette [MVP]" <wi************ *@telenet.bewro te in message
news:OB******** ******@TK2MSFTN GP02.phx.gbl...

"JCav" <jc********@cin ci.rr.comwrote in message
news:47******** **************@ roadrunner.com. ..

>These are the calls I'm using. LogonUser is failing with a 1326 - invalid
userID or password, even though these work when I log onto the machine.
So I never get far enough to make the call to the COM object.
int retxxx = CoInitializeSec urity(IntPtr.Ze ro, -1, IntPtr.Zero,
IntPtr.Zero, RpcAuthnLevel.C onnect, RpcImpLevel.Imp ersonate, IntPtr.Zero,
(int)EoAuthnCa p.DynamicCloaki ng, IntPtr.Zero);

const int LOGON32_PROVIDE R_DEFAULT = 0;

const int LOGON32_LOGON_I NTERACTIVE = 2;

const int LOGON32_LOGON_N ETWORK = 3;

IntPtr tokenHandle = new IntPtr(0);

bool returnValue = LogonUser(xxx", "yyy", "zzz",LOGON32_L OGON_NETWORK,
LOGON32_PROVID ER_DEFAULT, ref tokenHandle);

And you function declaration looks like:

[DllImport("adva pi32", CharSet = CharSet.Auto, SetLastError = true)]
[return: MarshalAs(Unman agedType.Bool)]
static extern bool LogonUser(
string lpszUserName,
string lpszDomain,
string lpszPassword,
int dwLogonType,
int dwLogonProvider ,
ref IntPtr hToken);

bool result = LogonUser(name, domain, passwd,
LOGON32_LOGON_I NTERACTIVE ,
LOGON32_PROVIDE R_DEFAULT,
ref tokenHandle);
if (result == false) // If failed
{
}
else // success
{

Note that you should use LOGON32_LOGON_I NTERACTIVE or LOGON32_LOGON_B ATCH
(value 4) as logon type, other types will not return a token that can be
used to impersonate unless you are running in the context of an
administrator (or an account with "SeImpersonateP rivileges" enabled) .
Willy.

[Willy Denoyette [MVP]]

"JCav" <jc********@cin ci.rr.comwrote in message
news:47******** **************@ roadrunner.com. ..

>I call LogonUser just the way you specified and I'm still getting the 1326:

int ret = CoInitializeSec urity(IntPtr.Ze ro,-1,IntPtr.Zero,I ntPtr.Zero,
RpcAuthnLevel.C onnect,RpcImpLe vel.Impersonate , IntPtr.Zero,
(int)EoAuthnCap .DynamicCloakin g, IntPtr.Zero);

ret is zero ...
bool returnValue = LogonUser("UID" , "Domain", "password",
LOGON32_LOGON_I NTERACTIVE, LOGON32_PROVIDE R_DEFAULT, ref tokenHandle);

returns false with a code of 1326

I can connect to the machine in question using these values and mstsc.exe.
The domain I use to log into my machine is different from the domain I use
above. Is this an issue? Is there some kind of administrative flag keeping
me from doing this? Am I calling CoInitializeSec urity with the wrong
values? I'm using the definitions you sent in an earlier post.

You can't use LogonUser to get a token from a non trusted domain, if the
callers domain is trusted by the called domain there shouldn't be a problem.
When there is no domain trust, the caller cannot locate the domain and the
call will fail.
CoInitializeSec urity has nothing to do with this. What happens when you call
LogonUser specifying the credentials of a local account?, or the
credentials of an account on a remote system, hereby specifying the machine
name instead of the domain name(same or other domain).

Willy.