asp.net create powershell as logged in user

Question

Hi,

I am trying to start a powershell session from an asp.net web application. This works only with the service user stored in the application pool.

However, I need to run the powershell session in the user context.

Windows authentication is set and with

User.Identity.Name

I get back the username of the currently logged in user.

First I assemble the PowerShell command:

script = ("c:\\exchscripts\\WebApp-Scripte\\SomeScripts.ps1");

I start the shell as follows:

var shell = PowerShell.Create();
shell.Commands.AddScript("$Session = New-PSSession -ConfigurationName Microsoft.Exchange -ConnectionUri " + connectionuri + " ; Import-PSSession -Session $Session");

shell.Commands.AddScript(script);
// Execute the script
var results = shell.Invoke();

Using

start-transcript

I see that the executing PowerShell user is the service user stored in the application pool.

But it should be the logged in user (via User.Identity.Name).

How do I get this right?

Answer 1

Did you set identity impersonate="true"?

https://learn.microsoft.com/en-us/troubleshoot/developer/webapps/aspnet/development/implement-impersonation

Answer 2

You need to crate a process with the users token. See this example

https://learn.microsoft.com/en-us/troubleshoot/developer/webapps/aspnet/development/spawn-process-under-impersonated-user

with asp.net core, you use the impersonation context to get the token handle

https://learn.microsoft.com/en-us/dotnet/api/system.security.principal.windowsimpersonationcontext?view=netframework-4.8.1

Answer 3

I forgot to mention that it works under IIS Express directly from Visual Studio. Without any code changes.

The user who authenticates to the IIS Express site using Kerberos then also runs the script.

Only with IIS it does not work.

Answer 4

The first link that @Bruce (SqlWork.com) provided sounds like it addresses your issue. I also found this which might work better.

https://learn.microsoft.com/en-us/troubleshoot/developer/webapps/aspnet/development/implement-impersonation

Put your script call where the example has "//Insert your code that runs under the security context of the authenticating user here."

Before you go too far though, are you aware of the "double hop" issue? I see where you included "Microsoft.Exchange", so it looks like your site is going to connect to Exchange and do something on behalf of the client. You will need to set up Kerberos delegation for that to work.

Delegconfig is an old tool that I used to test with. This page explains the issue.

https://blogs.iis.net/bretb/How-to-Use-DelegConfig

This appears to be the last (current?) version of the test tool. I don't know what it will take to get it working on current IIS installs. Sorry, I'm retired now, and no longer have access to an AD environment and all of my old test sites.

https://www.iis.net/downloads/community/2009/06/delegconfig-v2-beta-delegation-kerberos-configuration-tool

I also found this which appears to be an updated Kerberos test tool. I have not tested this. I think that I would try this tool first.

https://github.com/SurajDixit/KerberosConfigMgrIIS

See "Configuration for double hop".

https://techcommunity.microsoft.com/t5/iis-support-blog/setting-up-kerberos-authentication-for-a-website-in-iis/ba-p/347882

You might find that it is easier to prompt the user for their password and launch a Powershell.exe process using the user's credentials. That will insure that you can connect to Exchange.