A System.Security.SecurityException exception occurs when you try to impersonate a user from a secondary thread in an ASP.NET Web application

• You enable impersonation in the Web.config file of your application.
• In the <processModel> element of the Machine.config file, the value of the userName attribute is specified as Machine to run the ASP.NET worker process in the security context of the ASPNET local user account.
• You use Integrated Windows authentication for your application.

Back to the top

• Call the RevertToSelf function before you start the secondary thread.
• Assign the Act as part of the operating system user right to the ASPNET user account.
• Change the value of the userName attribute of the <processModel> element in the Machine.config file.

Call the RevertToSelf function before you start the secondary thread

1. Declare a reference to the RevertToSelf function in the Advapi32.dll DLL. To do this, locate the following code:

   public class <WebFormName> : System.Web.UI.Page
   {

   Note <WebFormName> is a placeholder for the name of your Web form.
2. Add the following code after the code that you just located:

   [DllImport("advapi32.dll", CharSet=CharSet.Auto, SetLastError=true)]
   public static extern bool RevertToSelf();

3. Locate the following code:

   <ThreadObject>.Start()

   Note <ThreadObject> is a placeholder for the name of the secondary thread.
4. Add the following code before the code that you just located:

   RevertToSelf();

Grant the Act as part of the operating system user right to the ASPNET user account

1. Open the Local Security Policy snap-in.
2. In the left pane of the Local Security Policy snap-in, expand Local Policies, and then click User Rights Assignment.
3. Add the ASPNET user account.
   
   If you are using Microsoft Windows XP, follow these steps:
   1. In the right pane of the Local Security Settings snap-in, locate the Policy field, and then double-click Act as part of the operating system. The Act as part of the operating system Properties dialog box appears.
   2. Click Add User or Group. The Select Users or Groups dialog box appears.
   3. In the Enter the object names to select box, type ASPNET, and then click OK.
   4. Click OK, and then close the Local Security Settings snap-in.
   If you are using Microsoft Windows 2000, follow these steps:
   1. In the right pane of the Local Security Settings snap-in, locate the Policy field, and then double-click Act as part of the operating system. The Local Security Policy Setting dialog box appears.
   2. Click Add. The Select Users or Groups dialog box appears.
   3. In the Name field, click ASPNET.
   4. Click Add, and then click OK.
   5. Click OK, and then close the Local Security Settings snap-in.

Change the value of the userName attribute of the <processModel> element in the Machine.config file

1. Use a text editor such as Notepad to open the Machine.config file. The Machine.config file is located in the %WINDIR%\Microsoft.NET\Framework\v1.1.4322\Config folder or in the %WINDIR%\Microsoft.NET\Framework\v1.1.3705\Config folder, depending upon the version of the Microsoft .NET Framework that you are using.
2. Locate the following attribute of the <processModel> element:

   userName="Machine"

3. Replace the attribute that you located in step 2 with the following attribute:

   userName="System"

Back to the top

Steps to reproduce the behavior

1. Start Microsoft Visual Studio .NET.
2. Use Microsoft Visual C# .NET to create an ASP.NET Web Application project that is named MyApp. By default, a Web form that is named WebForm1 is created.
3. In Solution Explorer, double-click Web.config to open the Web.config file.
4. Locate the following element in the Web.config file:

   <authentication mode="Windows"
   				/>

5. Add the following element after the element that you located in step 4:

   <identity
   				impersonate="true" userName="UserName"
   				password="Password" />

   Note Replace UserName and Password with the credentials of the user who you want to impersonate.
6. In Solution Explorer, right-click WebForm1.aspx, and then click View Code to open the code view of the WebForm1 Web form.
7. Add the following code at the top of the code window to import the required namespaces:

   using System.Web.Security;
   using System.Security.Principal;
   using System.Runtime.InteropServices;
   using System.Threading;

8. Locate the following code:

   public class WebForm1 : System.Web.UI.Page
   {

9. Add the following code after the code that you located in step 8:

   // Declare a WindowsImpersonationContext object.
   WindowsImpersonationContext ImpersonationContext;

10. Locate the following code:

    // Put user code to initialize the page here.

11. Replace the code that you located in step 10 with the following code:

    Response.Write("In the primary thread<br>");
    Thread oThread = new Thread(new ThreadStart(ThreadMethod));
    // Start the secondary thread.
    oThread.Start();
    Thread.Sleep(10000);

12. Add the following code before the Web Form Designer generated code region:

    public void ThreadMethod()
    {
        try
        {
            Response.Write("In the secondary thread<br>");
            // Try to impersonate a user.
            ImpersonationContext = ((System.Security.Principal.WindowsIdentity)User.Identity).Impersonate();
            Response.Write("Successfully impersonated from a secondary thread");
            ImpersonationContext.Undo(); 
        }
        catch(Exception e)
        {
            Response.Write("Exception : " + e.Message.ToString());
        }
    }

13. Make sure that your application uses Integrated Windows authentication.
14. Build and then run your application. The behavior that is mentioned in the "Symptoms" section may occur.

Back to the top