Impersonation Level Constants
Specifies an impersonation level, which indicates the amount of authority given to the server when it is impersonating the client.
| Constant/value | Description |
|---|---|
|
DCOM can choose the impersonation level using its normal security blanket negotiation algorithm. For more information, see Security Blanket Negotiation. |
|
The client is anonymous to the server. The server process can impersonate the client, but the impersonation token will not contain any information and cannot be used. |
|
The server can obtain the client's identity. The server can impersonate the client for ACL checking, but it cannot access system objects as the client. |
|
The server process can impersonate the client's security context while acting on behalf of the client. This level of impersonation can be used to access local resources such as files. When impersonating at this level, the impersonation token can only be passed across one machine boundary. The Schannel authentication service only supports this level of impersonation. |
|
The server process can impersonate the client's security context while acting on behalf of the client. The server process can also make outgoing calls to other servers while acting on behalf of the client, using cloaking. The server may use the client's security context on other machines to access local and remote resources as the client. When impersonating at this level, the impersonation token can be passed across any number of computer boundaries. |
Remarks
GetUserName will fail while impersonating at identify level. The workaround is to impersonate, call OpenThreadToken, revert, call GetTokenInformation, and finally, call LookupAccountSid. Using CoSetProxyBlanket, the client sets the impersonation level
Using CoSetProxyBlanket, the client sets the impersonation level and proxy identity that will be available when a server calls CoImpersonateClient. The identity the server will see when impersonating takes place is described in Cloaking. Note that when making a call while impersonating, the callee will normally receive the caller's process token, not the caller's impersonation token. To receive the caller's impersonation token, the caller must enable cloaking.
Requirements
| Requirement | Value |
|---|---|
| Minimum supported client |
Windows 2000 Professional [desktop apps only] |
| Minimum supported server |
Windows 2000 Server [desktop apps only] |
| Header |
|