Skip to content

Commit 0f8ef1a

Browse files
SteveSyfuhsSteveSyfuhs
authored
Merge pull request #350 from dotnet/feature/logonuser-param
Overload LogonUser to not always impersonate
2 parents aa5bbea + 2c76980 commit 0f8ef1a

File tree

4 files changed

+79
-64
lines changed

4 files changed

+79
-64
lines changed

‎Kerberos.NET/Win32/LsaInterop.cs‎

Lines changed: 37 additions & 22 deletions
Original file line numberDiff line numberDiff line change
@@ -155,20 +155,43 @@ public static LsaInterop Connect(string package = KerberosPackageName)
155155
/// <param name="realm">The default realm to be used by LSA for the any outbound ticket requests not already cached.</param>
156156
public unsafe void LogonUser(string username = null, string password = null, string realm = null)
157157
{
158-
if (username == null)
159-
{
160-
username = DefaultUserName;
161-
}
158+
username ??= DefaultUserName;
162159

163-
if (password == null)
160+
if (this.impersonationContext != null)
164161
{
165-
password = string.Empty;
162+
this.impersonationContext.Dispose();
163+
this.impersonationContext = null;
166164
}
167165

168-
if (realm == null)
169-
{
170-
realm = string.Empty;
171-
}
166+
this.impersonationContext = this.LogonUser(username, password, realm, LogonType.NewCredentials);
167+
168+
169+
// this call to impersonate will set the current thread token to be the token out of LsaLogonUser
170+
// do we need to do anything special if this gets used within an async context?
171+
172+
this.impersonationContext.Impersonate();
173+
}
174+
175+
/// <summary>
176+
/// Create a logon session for the current LSA Handle.
177+
/// </summary>
178+
/// <param name="username">The username to be used.
179+
/// Passing an empty string will cause LSA to treat this as an anonymous user.</param>
180+
/// <param name="password">The password to be used by LSA for any future outbound ticket requests not already cached.</param>
181+
/// <param name="realm">The default realm to be used by LSA for the any outbound ticket requests not already cached.</param>
182+
/// <param name="logonType">The type of logon session to create</param>
183+
public unsafe LsaTokenSafeHandle LogonUser(
184+
string username,
185+
string password,
186+
string realm,
187+
LogonType logonType
188+
)
189+
{
190+
username ??= string.Empty;
191+
192+
password ??= string.Empty;
193+
194+
realm ??= string.Empty;
172195

173196
var originName = new LSA_STRING
174197
{
@@ -182,12 +205,7 @@ public unsafe void LogonUser(string username = null, string password = null, str
182205
(username.Length * 2) +
183206
(password.Length * 2);
184207

185-
if (this.impersonationContext != null)
186-
{
187-
this.impersonationContext.Dispose();
188-
this.impersonationContext = null;
189-
}
190-
208+
LsaTokenSafeHandle tokenHandle = null;
191209
LsaBufferSafeHandle profileBuffer = null;
192210

193211
WithFixedBuffer(bufferSize, (p, _) =>
@@ -211,7 +229,7 @@ public unsafe void LogonUser(string username = null, string password = null, str
211229
int result = LsaLogonUser(
212230
this.lsaHandle,
213231
ref originName,
214-
SECURITY_LOGON_TYPE.NewCredentials,
232+
logonType,
215233
this.negotiateAuthPackage,
216234
pLogon,
217235
bufferSize,
@@ -220,7 +238,7 @@ public unsafe void LogonUser(string username = null, string password = null, str
220238
out profileBuffer,
221239
ref profileLength,
222240
out this.luid,
223-
out this.impersonationContext,
241+
out tokenHandle,
224242
out IntPtr pQuotas,
225243
out int subStatus
226244
);
@@ -233,10 +251,7 @@ out int subStatus
233251
}
234252
});
235253

236-
// this call to impersonate will set the current thread token to be the token out of LsaLogonUser
237-
// do we need to do anything special if this gets used within an async context?
238-
239-
this.impersonationContext.Impersonate();
254+
return tokenHandle;
240255
}
241256

242257
/// <summary>

‎Kerberos.NET/Win32/LsaTokenSafeHandle.cs‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,7 @@
1010

1111
namespace Kerberos.NET.Win32
1212
{
13-
internal class LsaTokenSafeHandle : SafeHandle
13+
public class LsaTokenSafeHandle : SafeHandle
1414
{
1515
public LsaTokenSafeHandle()
1616
: base(IntPtr.Zero, true)
@@ -49,7 +49,7 @@ public void Impersonate()
4949
this.Impersonating = true;
5050
}
5151

52-
private void Revert()
52+
public void Revert()
5353
{
5454
if (!this.Impersonating)
5555
{
@@ -66,4 +66,4 @@ private void Revert()
6666
this.Impersonating = false;
6767
}
6868
}
69-
}
69+
}

‎Kerberos.NET/Win32/NativeMethods.cs‎

Lines changed: 18 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -14,6 +14,23 @@
1414

1515
namespace Kerberos.NET.Win32
1616
{
17+
public enum LogonType
18+
{
19+
UndefinedLogonType = 0,
20+
Interactive = 2,
21+
Network,
22+
Batch,
23+
Service,
24+
Proxy,
25+
Unlock,
26+
NetworkCleartext,
27+
NewCredentials,
28+
RemoteInteractive,
29+
CachedInteractive,
30+
CachedRemoteInteractive,
31+
CachedUnlock
32+
}
33+
1734
internal unsafe class NativeMethods
1835
{
1936
private const string SECUR32 = "secur32.dll";
@@ -176,7 +193,7 @@ out int AuthenticationPackage
176193
public static extern int LsaLogonUser(
177194
LsaSafeHandle LsaHandle,
178195
ref LSA_STRING OriginName,
179-
SECURITY_LOGON_TYPE LogonType,
196+
LogonType LogonType,
180197
int AuthenticationPackage,
181198
void* AuthenticationInformation,
182199
int AuthenticationInformationLength,
@@ -272,23 +289,6 @@ public enum KERB_LOGON_SUBMIT_TYPE
272289
KerbLuidLogon = 84,
273290
}
274291

275-
public enum SECURITY_LOGON_TYPE
276-
{
277-
UndefinedLogonType = 0,
278-
Interactive = 2,
279-
Network,
280-
Batch,
281-
Service,
282-
Proxy,
283-
Unlock,
284-
NetworkCleartext,
285-
NewCredentials,
286-
RemoteInteractive,
287-
CachedInteractive,
288-
CachedRemoteInteractive,
289-
CachedUnlock
290-
}
291-
292292
[StructLayout(LayoutKind.Sequential)]
293293
internal struct LSA_STRING
294294
{

‎build.yaml‎

Lines changed: 21 additions & 21 deletions
Original file line numberDiff line numberDiff line change
@@ -44,12 +44,12 @@ stages:
4444
msbuildArguments: /restore /p:CreatePackage=true
4545
maximumCpuCount: true
4646

47-
- task: DotNetCoreCLI@2
48-
inputs:
49-
command: test
50-
projects: Tests/**/*.csproj
51-
arguments: -c $(BuildConfiguration) --no-build --no-restore --settings CodeCoverage.runsettings --collect:"XPlat Code Coverage"
52-
displayName: Run Unit Tests
47+
# - task: DotNetCoreCLI@2
48+
# inputs:
49+
# command: test
50+
# projects: Tests/**/*.csproj
51+
# arguments: -c $(BuildConfiguration) --no-build --no-restore --settings CodeCoverage.runsettings --collect:"XPlat Code Coverage"
52+
# displayName: Run Unit Tests
5353

5454
- task: DotNetCoreCLI@2
5555
inputs:
@@ -64,21 +64,21 @@ stages:
6464
PathtoPublish: '$(Build.ArtifactStagingDirectory)'
6565
publishLocation: 'Container'
6666

67-
- task: DotNetCoreCLI@2
68-
inputs:
69-
command: custom
70-
custom: tool
71-
arguments: install --tool-path . dotnet-reportgenerator-globaltool
72-
displayName: Install ReportGenerator tool
73-
74-
- script: reportgenerator -reports:$(Agent.TempDirectory)/**/coverage.cobertura.xml -targetdir:$(Build.SourcesDirectory)/coverlet/reports -reporttypes:"Cobertura"
75-
displayName: Create reports
76-
77-
- task: PublishCodeCoverageResults@1
78-
displayName: 'Publish code coverage'
79-
inputs:
80-
codeCoverageTool: Cobertura
81-
summaryFileLocation: $(Build.SourcesDirectory)/coverlet/reports/Cobertura.xml
67+
# - task: DotNetCoreCLI@2
68+
# inputs:
69+
# command: custom
70+
# custom: tool
71+
# arguments: install --tool-path . dotnet-reportgenerator-globaltool
72+
# displayName: Install ReportGenerator tool
73+
74+
# - script: reportgenerator -reports:$(Agent.TempDirectory)/**/coverage.cobertura.xml -targetdir:$(Build.SourcesDirectory)/coverlet/reports -reporttypes:"Cobertura"
75+
# displayName: Create reports
76+
77+
# - task: PublishCodeCoverageResults@1
78+
# displayName: 'Publish code coverage'
79+
# inputs:
80+
# codeCoverageTool: Cobertura
81+
# summaryFileLocation: $(Build.SourcesDirectory)/coverlet/reports/Cobertura.xml
8282

8383
- task: NuGetAuthenticate@0
8484
displayName: 'NuGet Authenticate'

0 commit comments

Comments
 (0)