Impersonate is true and user can access unauthhorised files

[chuair]

Hi. Can please help?

- identity impersonate is set to "true"
- user can access to unauthorised files and folders.
- one of my page which will get username and display them in the page is working fine.

- identity impersonate is set to "false"
- only authorised user will be able to access files and folders.
- page that get username and display them displays "ASPNET" instead of username.

I am using "System.Environment.UserName" to get the username. What I am trying to do is to be able to control which user is authorised to access which page and who isn't. And also to be able to display the username and store it into my database.

What's wrong?

Thanks.

 

[vbkris]

>>And also to be able to display the username and store it into my database.


try using HttpContext.Current.User.Identity.

it looks like System.Environment.UserName is getting the account name under which the ASP.NET process is executing (which is ASPNET by default)...


Known is handfull, Unknown is worldfull

 

[chuair]

Yoz. Thanks for the prompt reply. Yeah. It works. Thanks. But just don't understand. Thought when we use impersonate, ASPNET will assume the identity of the user. And with that, aren't we suppose to set security based on the user id?

 

[vbkris]

>>when we use impersonate, ASPNET will assume the identity of the user.

correct

>>And with that, aren't we suppose to set security based on the user id?

You are comparing authentication users with processmodel user. Both are different. While the first decides who can access the situation, the second decides under whose account .NET will execute the aspx file...

Known is handfull, Unknown is worldfull

 

[chuair]

Wow. Meaning it's better to turn off impersonate?

When you said, authenticating users will decides who can access the situation, do you mean it's the same as setting security at the files or folders?

"Procesmodel user" decides whose account .NET will execute the aspx files.... Thought we are using ASPNET to access the aspx files???

 

[vbkris]

>>When you said, authenticating users will decides who can access the situation, do you mean it's the same as setting security at the files or folders?

sorry, i meant solution not situation, solution meaning your project.

the impersonate tag decides under whose account the .NET runtime will execute the ASPX file...

Known is handfull, Unknown is worldfull

 

[chuair]

Thanks for the prompt reply. Thanks...

 

[vbkris]

welcome...

Known is handfull, Unknown is worldfull