advapi32.dll LogonUser 会影响 ASP.net 中的整个应用程序池吗？

Question

请注意以下文章：

How to implement impersonation in an ASP.NET application

特别是“在代码中模拟特定用户”位。

它利用了 advapi32.dll 的 LogonUserA() 和 DuplicateToken() 方法（Windows API？）。

如果我们在特定的 aspx 文件（函数）中使用此方法来模拟特定任务的“DOMAIN\John Smith” - 我们是否可以肯定地说只有单个 aspx 请求冒充 John，或者整个应用程序池都运行作为 John Smith 直到 undoImpersonation() 在所述函数完成时被调用？

有问题的代码（以防上面的链接变暗）：

Dim LOGON32_LOGON_INTERACTIVE As Integer = 2
Dim LOGON32_PROVIDER_DEFAULT As Integer = 0

Dim impersonationContext As WindowsImpersonationContext

Declare Function LogonUserA Lib "advapi32.dll" (ByVal lpszUsername As String, _
                        ByVal lpszDomain As String, _
                        ByVal lpszPassword As String, _
                        ByVal dwLogonType As Integer, _
                        ByVal dwLogonProvider As Integer, _
                        ByRef phToken As IntPtr) As Integer

Declare Auto Function DuplicateToken Lib "advapi32.dll" ( _
                        ByVal ExistingTokenHandle As IntPtr, _
                        ByVal ImpersonationLevel As Integer, _
                        ByRef DuplicateTokenHandle As IntPtr) As Integer

Declare Auto Function RevertToSelf Lib "advapi32.dll" () As Long
Declare Auto Function CloseHandle Lib "kernel32.dll" (ByVal handle As IntPtr) As Long


Public Sub Page_Load(ByVal s As Object, ByVal e As EventArgs)
    If impersonateValidUser("username", "domain", "password") Then
        'Insert your code that runs under the security context of a specific user here.
        undoImpersonation()
    Else
        'Your impersonation failed. Therefore, include a fail-safe mechanism here.
    End If
End Sub

Private Function impersonateValidUser(ByVal userName As String, _
ByVal domain As String, ByVal password As String) As Boolean

    Dim tempWindowsIdentity As WindowsIdentity
    Dim token As IntPtr = IntPtr.Zero
    Dim tokenDuplicate As IntPtr = IntPtr.Zero
    impersonateValidUser = False

    If RevertToSelf() Then
        If LogonUserA(userName, domain, password, LOGON32_LOGON_INTERACTIVE, 
                     LOGON32_PROVIDER_DEFAULT, token) <> 0 Then
            If DuplicateToken(token, 2, tokenDuplicate) <> 0 Then
                tempWindowsIdentity = New WindowsIdentity(tokenDuplicate)
                impersonationContext = tempWindowsIdentity.Impersonate()
                If Not impersonationContext Is Nothing Then
                    impersonateValidUser = True
                End If
            End If
        End If
    End If
    If Not tokenDuplicate.Equals(IntPtr.Zero) Then
        CloseHandle(tokenDuplicate)
    End If
    If Not token.Equals(IntPtr.Zero) Then
        CloseHandle(token)
    End If
End Function

Private Sub undoImpersonation()
    impersonationContext.Undo()
End Sub

Answer 1

模拟是特定于线程的，而不是针对整个应用程序的。 我修改了您的 page_load 以包含一个简单的逻辑来证明这一事实。

演示

原始用户（应用程序池）和模拟用户都会以不同的时间间隔写入调试控制台。请注意，被模拟的用户正在另一个线程中运行，并将每秒输出一次其用户名，而应用程序池用户（主线程）输出仍保留在主线程上，并每 100 毫秒输出其名称。

Public Sub Page_Load(ByVal s As Object, ByVal e As EventArgs)
    Dim Task As New System.Threading.Tasks.Task(Sub()
                                                    If impersonateValidUser("Username", "Domain", "Password") Then

                                                        Dim Watch As New Diagnostics.Stopwatch()
                                                        Watch.Start()

                                                        While Watch.ElapsedMilliseconds < 10000
                                                            System.Threading.Thread.Sleep(1000)
                                                            Diagnostics.Debug.WriteLine(WindowsIdentity.GetCurrent.Name)
                                                        End While

                                                        'Insert your code that runs under the security context of a specific user here.
                                                        undoImpersonation()
                                                    Else
                                                        'Your impersonation failed. Therefore, include a fail-safe mechanism here.
                                                    End If
                                                End Sub)

    Task.Start()
    While Not Task.IsCompleted
        System.Threading.Thread.Sleep(100)
        Diagnostics.Debug.WriteLine("--" & WindowsIdentity.GetCurrent.Name)
    End While

End Sub