使用模拟创建Windows文件夹

Question

I'm trying to create a folder using credentials of a limited admin account supplied by an encrypted .config file- right now my code is running under the assumption that the user has no access to these directories, so an unauthorizedexception is thrown, when given access the code otherwise works, but i can't do that as it would compromise our security. I know how to get my username / password out of the encrypted file already, i'm just not sure as to what library or syntax i should use to impersonate; this is my code:

//set the cursor

string activeDir = "\\\\department\\shares\\users\\";

//create directory with userID as the folder name

string newPath = System.IO.Path.Combine(activeDir + userID);

System.IO.Directory.CreateDirectory(newPath);

so i need a way to supply credentials but i'm at a loss- i've been using System.DirectoryServices.AccountManagement and the pricipalcontext to supply a username/password for making changes to the active directory... do i need to use a similar library to make changes to the file system? any help would be appreciated, thanks!

Answer 1

I think you could impersonate that user temporarily for the thread performing this action. It seems that this only can be done with P/Invoke. Have a look at this example .

using (var impersonation = new ImpersonatedUser(decryptedUser, decryptedDomain, decryptedPassword))
{
  Directory.CreateDirectory(newPath);
}

For the sake of completeness (if the link stops working some day), find the ImpersonatedUser class below (credits to Jon Cole ):

using System;
using System.ComponentModel;
using System.Runtime.InteropServices;
using System.Security.Principal;

public class ImpersonatedUser : IDisposable
{
    IntPtr userHandle;

    WindowsImpersonationContext impersonationContext;

    public ImpersonatedUser(string user, string domain, string password)
    {
        userHandle = IntPtr.Zero;

        bool loggedOn = LogonUser(
            user,
            domain,
            password,
            LogonType.Interactive,
            LogonProvider.Default,
            out userHandle); 

        if (!loggedOn)
            throw new Win32Exception(Marshal.GetLastWin32Error());

        // Begin impersonating the user
        impersonationContext = WindowsIdentity.Impersonate(userHandle);
    } 

    public void Dispose()
    {
        if (userHandle != IntPtr.Zero)
        {
            CloseHandle(userHandle);

            userHandle = IntPtr.Zero;

            impersonationContext.Undo();
        }
    } 

    [DllImport("advapi32.dll", SetLastError = true)]
    static extern bool LogonUser(

        string lpszUsername,

        string lpszDomain,

        string lpszPassword,

        LogonType dwLogonType,

        LogonProvider dwLogonProvider,

        out IntPtr phToken

        );

    [DllImport("kernel32.dll", SetLastError = true)]
    static extern bool CloseHandle(IntPtr hHandle);

    enum LogonType : int
    {
        Interactive = 2,
        Network = 3,
        Batch = 4,
        Service = 5,
        NetworkCleartext = 8,
        NewCredentials = 9,
    }

    enum LogonProvider : int
    {
        Default = 0,
    }

}

Answer 2

Use Windows networking (WNet) functions. They were supported by Windows 2000 and later. Wrapper:

public class WNet
{
    public static void AddConnection(string resource, string username, string password)
    {
        NETRESOURCE nr = new NETRESOURCE();
        nr.RemoteName = resource;
        uint err = WNetAddConnection2W(ref nr, password, username, 0);
        if (err != 0)
            throw new RemoteDirectoryException(string.Format("WNetAddConnection2 failed with error: #{0}", err));
    }

    private struct NETRESOURCE
    {
        public uint Scope;
        public uint Type;
        public uint DisplayType;
        public uint Usage;
        public string LocalName;
        public string RemoteName;
        public string Comment;
        public string Provider;
    }

    [DllImport("mpr.dll", CharSet = CharSet.Unicode)]
    private extern static uint WNetAddConnection2W(ref NETRESOURCE lpNetResource, string lpPassword, string lpUsername, uint dwFlags);
}

Adding connection to resource and creating directory:

string activeDir = "\\\\department\\shares\\users\\";
string username = "username";
string password = "password";

WNet.AddConnection(activeDir, username, password);

string newPath = System.IO.Path.Combine(activeDir, userID);
System.IO.Directory.CreateDirectory(newPath);