ASP.NET - Running PowerShell script using pass-through authentication (Windows Authentication) - asp.net

I'm creating MVC3-based intranet application in ASP.NET. The application is really simple:
- asking for input (username)
- running PowerShell script using provided username (fetching some data from remote database)
- piping script output to HTML file
- redirecting to created HTML file.
For security reasons, I'm using Windows Authentication with access only for specified groups of users. This works great for the application itself - I can see current username in the corner, not specified users do not have access.
The problem is PS script itself. It didn't seem to work with user's credentials, so I added whoami line to the script and got result: iis apppool\asp.net v4.0.
This is the code I'm using to run PS script:
var ps = PowerShell.Create();
ps.Commands.AddScript(#"CommandHere");
ps.Invoke();
How can I run it using current user's credentials?

Related

How get core get current user info?

how get current logged user on windows pc in new .net core framework ?
Old namespace
System.DirectoryServices;
System.DirectoryServices.AccountManagement;
not implemented yeat :(
Advise the ported library novell.ldap but I still do not understand how to get information about the user.
I get short name from System.Security.Principal.WindowsIdentity.GetCurrent().Name
how get full name ? Example "Mary Ann"
First, ASP.NET Core can run on Linux and Mac, where you have no "Windows" user at all.
But even if you will run you app on Windows only - what user you mean? If your website is running on server behind IIS - than IIS is started as a service, without any interactive user, and your app also started under some service account.
But if you will run your app only under Windows and only interactively (user will start dotnet run or similar) then easiest way - read environment variables USERDOMAIN and USERNAME. In command prompt run set and you will see all environment variables currently defined in your session. You may read them via Environment class or add to ConfigurationBuilder with AddEnvironmentVariables() in Startup.cs.

Using System.DirectoryServices to create account in IIS did not work

I am using System.DirectoryServices namespace to creating user accounts. when I run my webapp in asp.net and in my system, then code worked good. But when I deploy my webapp in my IIS, this failed.
I tested this way:
created a console application that get arguments from commandline and create user for me. When I run console exe directly, user created, but this exe not run from my web application (of course this code work in asp.net and in my system too).
enabling "World Wide Web Publishing Service" to interact with desktop.
Can someone help me?
The issue is related to the user you are executing the code as. When you are running locally or using the console application, the application is using your credentials for authentication. When run under IIS, the typical user is IUser, which has fewer privileges. You may need to grant the additional privileges to the IUser user in order to create the user accounts.

using Process.Start in an IIS Website

I have created an ASP.NET website using VB.NET. The functionality of the website generates a .bat file and saves it in a location - it then uses Process.Start(filelocation) to run the bat file.
This works fine when in debug mode on my PC - but when I have uploaded the website on to an IIS 7 server, it creates the file (proving that it has access to the area), but seemingly cannot run it?
I am assuming there is a permission issue here - Any ideas what I am missing?
Thanks
Guy
Every webapp in IIS run under a specific user. Check if that user has privileges to run applications, in particular the *.bat (in your output directory) and related *.exe files.
If you do not use impersonation, you can set the user at App pool level.
My suggestion is to create a dedicated Windows user with the right permissions and run the app pool under that user. The app pool should contains only your web application.

Start/Stop Window Service from ASP.NET page

Is there a way to start / stop a windows service of a server in a different network
(not \\<server name>) from an asp.net page?
I tried using ServiceController but it's only work if it's in the same network.
RE: ServiceController How to Start/Stop a Windows Service from an ASP.NET app - Security issues
Anything you can do from command line or powershell can be ran from a page (assuming the app pool user has correct permissions etc)
https://serverfault.com/questions/429426/how-can-i-connect-to-a-windows-server-using-a-command-line-interface-cli
Run Command Prompt Commands
How To: Execute command line in C#, get STD OUT results
Powershell is probably your best bet for managing services on a remote server though this will require the server to allow remote powershell.
Calling Powershell from C# (ASP.NET) - pass custom object?
http://www.codeproject.com/Articles/18229/How-to-run-PowerShell-scripts-from-C
and of course for the topic of powershell resetting/stopping remote services.
http://www.powershellmagazine.com/2012/08/28/pstip-starting-and-stopping-services-on-remote-computers/
How to start/stop a service on a remote server using PowerShell - Windows 2008 & prompt for credentials?
Google is definitely your friend on this one :)

Deployment issue of an web application using MSDeploy command

I have a web application and I am trying to deploy it on a webserver using MSDeploy.exe (Web Deploy 2)
I have tried 4 scenarios:
Through VS2010 Publish method with following settings:
Publish Method: Web Deploy
Service Url: https://MyServerName:8172/MsDeploy.axd
Site/application: MyWebSiteName
Allow untrusted: checked
Username: MyUsername
Password: MyPassword
This method works just fine.
On MyServerName machine I have Web Management Service running; I have a website MyWebSiteName, an application MyWebAppName and MyUserName is an IIS Manager for it.
Through VS2010 Publish method with following settings:
Publish Method: Web Deploy
Service Url: https://MyServerName:8172/MsDeploy.axd
Site/application: MyWebSiteName/MyWebAppName
Allow untrusted: checked
Username: MyUsername
Password: MyPassword
This method works just fine.
Through MSDeploy.exe command line (within a Powershell script)
$Source = "contentPath='...._PublishedWebsites\MyWebApp'"
$Destination = "contentPath=MyWebSiteName,computerName='https://fc-wapps-trial:8172/MsDeploy.axd?Site=WebSiteTest',Username=MyUsername,Password=MyPassword,AuthType=basic"
MSDeploy -verb:sync -source:$Source -dest:$Destination -allowUntrusted
This method also works fine.
Through MSDeploy.exe command line (within a Powershell script)
$Source = "contentPath='...._PublishedWebsites\MyWebApp'"
$Destination = "iisApp=MyWebSiteName/MyWebAppName,computerName='https://fc-wapps-trial:8172/MsDeploy.axd?Site=WebSiteTest/MyWebAppName',Username=MyUsername,Password=MyPassword,AuthType=basic"
MSDeploy -verb:sync -source:$Source -dest:$Destination -allowUntrusted
This method doesn't work. I am getting the following error.
Error Code: ERROR_USER_UNAUTHORIZED
More Information: Connected to the destination computer ("MyServerName") using the Web Management Service, but could not authorize. Make sure that you are using the correct user name and password, that the site you are connecting to exists, and that the credentials represent a user who has permissions to access the site.
Error: The remote server returned an error: (401) Unauthorized.
I was looking at what is the actuall MSDeploy command that the method 2 uses and I got something like:
msdeploy.exe
-source:manifest='...\MyWebApp.SourceManifest.xml'
-dest:auto,ComputerName='https://MyServerName:8172/MsDeploy.axd?site=WebSiteTest',UserName='MyUsername',Password='MyPassword',IncludeAcls='False',AuthType='Basic'
-verb:sync
-disableLink:AppPoolExtension
-disableLink:ContentExtension
-disableLink:CertificateExtension
-skip:objectname='dirPath',absolutepath='...\App_Data$'
-setParam:kind='ProviderPath',scope='IisApp',match='^...\PackageTmp$',value=WebSiteTest/WebAppTest
-setParam:kind='ProviderPath',scope='setAcl',match='^..\PackageTmp$',value=WebSiteTest/WebAppTest
-allowUntrusted
-retryAttempts=2
Now this doesn't seem to be anything close to what I am using in method 4. I tried running it myself without success, but I assume I wasn't able to properly re-create all those parameters.
So my questions are:
- What I am doing wrong in method 4?
- How can I deploy a web application as a website application in IIS7 using MSDeploy.exe command
Thanks in advance for your help
Iulian
I ran into the same issue as you did. I solved it by only use site name in
https://computername:8172/msdeploy.axd?site={websitenameonly}. Then set your webapplication path in the parameter using -setParam IIS Web Application Name= {your web application name here} or use a parameter file. And everything deployed fine.
It seems that the site querystring value is required to authorize the request only. I haven't find any definitive documentation from MS on any other querystring parameters that might solve this. But I actually tested 2 cases. 1) Deploying to a web site in IIS 7.5, this parameter is required. 2) Deploying to a web application under a web site, this parameter is actually optional, but if you want to include it, then it has to be a root site.
You actually answered your own question here just probably didn't realize it.
Please check your Management Service Delegation (if you haven't already). Click on the main site in IIS Manager to bring up all Web Deploy options in the center panel. At the bottom (past ASP.NET, IIS, etc), under Management, you should see several options, including "Management Service Delegation".
Under this configuration is all the Provider contexts you might run into and the paths/types you might use them against (and under what usernames, etc... can get pretty granular).
Make very sure that the provider type you're trying to communicate under (iisApp, contentPath, etc) is not only listed, but has the path/scope you require and that you're operating under permissions that have been cleared.
Remember: you don't have to use an administrator-type user if delegation is set up correctly. AND you've gone to the applicable site's IIS Manager Permissions and added an Allowed User, like Domain\User, or even a custom IIS Manager User.

Resources