Impersonation MFC C++

Question

I want to impersonate other user in Windows. For example: I create a directory with permission only for user A and for the administrators, when logon with user B and run .exe I want to impersonate user A to have permission to edit/remove/insert in that specific directory.

I found this: http://msdn.microsoft.com/en-us/library/aa374731(VS.85).aspx

Answer 1

As a start, check out this article on windows user impersonation:

http://www.codeproject.com/KB/system/UserImpersonation.aspx

It should give you a place to start. If you need more controll you will need to look into Access Tokens.

Answer 2

If you want access to the folders of User A and the folders of User B, then you just need to setup folder permissions in such a way that administrators have permissions to get into all the folders. Normally machine administrators already have those rights. I am assuming here that are talking about normal windows user accounts, and normal machine/domain administrator accounts.

If you want to become User A its means you need User A's active permission to become that person. Impersonation is not simple (from what I have tried), you need to request access through your domain controller and negotiate that you are User B and that you have the rights to impersonate User A, generally that is done by User A and User B sharing and negotiating Credential Handles and Security Contexts. I doubt this is the type of process you're looking to follow.

Some useful functions would include:

To setup the context these are used and data is passed backwards and forwards between User A and User B to negotiate the impersonation

AcquireCredentialsHandle()
InitializeSecurityContext()
AcceptSecurityContext()
CompleteAuthToken()

Once the negotiations are complete and a security context has been created, these are used to start and stop the impersonation.

ImpersonateSecurityContext()
RevertContext()

I don't know of any other way to impersonate a user without the active participation of the user in question, or actively logging on as that user.

Hope this helps in some way.