ASP.NET to host PowerShell scripts for Active Directory - DC hangs up

Cause

The root cause of this problem is that when using Windows authentication in IIS, the security token is only valid for authenticating the web client machine to the web server machine. The same token is not valid to authenticate the web server machine to any other computer and this is what my application was trying to do:

• The client receives a security token and sends it to the web server.
• IIS asks the DC to validate the token and validate the token. The web client is currently authenticating to the web server.
• IIS validates authenticated identity against application authorization rules.
• The web application impersonates the identity using the token obtained by IIS and runs a script that then inherits the same security token.
• The script tries to use the same token to authenticate to the remote RPC service.
• The domain controller recognizes the authentication attempt as a re-attack (this token is for another service) and disconnects the connection.

It is not entirely correct to call this a "side effect" of Kerberos, but it was not obvious at first, although it seems obvious in retrospect. Hope someone can take advantage of this information.

Decision

The solution to this is an application to create its own security token, which can then be used to authenticate as a website user to services on other machines by calling the LogonUser () API . Your application code will need access to a cleared user password, and this can be made available by only enabling HTTP Basic authentication in IIS. The web server will still apply the same authorization and authorization rules, but both the username and password will be available to your application code. Keep in mind that these credentials are passed to the web server explicitly , so you will need to require SSL before using it in production.

I created a small helper class based on the procedure described here to make this process easier. Here's a short demo:

Login Assistant:

public class IdentityHelper {
  [DllImport("advapi32.dll")]
  private static extern int LogonUserA( String lpszUserName, String lpszDomain, String lpszPassword, int dwLogonType, int dwLogonProvider, ref IntPtr phToken );

  [DllImport("advapi32.dll",
    CharSet = CharSet.Auto,
    SetLastError = true)]
  private static extern int DuplicateToken( IntPtr hToken, int impersonationLevel, ref IntPtr hNewToken );

  [DllImport("kernel32.dll",
    CharSet = CharSet.Auto)]
  private static extern bool CloseHandle( IntPtr handle );

  public const int LOGON32_LOGON_INTERACTIVE = 2;
  public const int LOGON32_PROVIDER_DEFAULT = 0;
  public const int IMPERSONATION_LEVEL_IMPERSONATE = 2;

  public static WindowsIdentity Logon( string username, string password, string domain = "" ) {
    IntPtr token = IntPtr.Zero;
    WindowsIdentity wid = null;

    if( domain == "" ) {
      split_username(username, ref username, ref domain);
    }

    if( LogonUserA(username, domain, password, LOGON32_LOGON_INTERACTIVE, LOGON32_PROVIDER_DEFAULT, ref token) != 0 ) {
      wid = WIDFromToken(token);
    }
    if( token != IntPtr.Zero ) CloseHandle(token);
    return wid;
  }

  public static WindowsIdentity WIDFromToken( IntPtr src ) {
    WindowsIdentity wid = null;
    IntPtr token = IntPtr.Zero;
    if( DuplicateToken(src, IMPERSONATION_LEVEL_IMPERSONATE, ref token) != 0 ) {
      wid = new WindowsIdentity(token);
    }
    if( token != IntPtr.Zero ) CloseHandle(token);
    return wid;
  }

  private static void split_username( string username, ref string username_out, ref string domain_out ) {
    string[] composite_username = username.Split(new char[] { '\\' });
    if( composite_username.Length == 2 ) {
      domain_out = composite_username[0];
      username_out = composite_username[1];
    }
  }
}

      

        
        
        
      

    

Powershell Helper Class:

public class PSHelper {
  public static Runspace new_runspace() {
    InitialSessionState init_state = InitialSessionState.CreateDefault();
    init_state.ThreadOptions = PSThreadOptions.UseCurrentThread;
    init_state.ImportPSModule(new[] { "ActiveDirectory" });
    return RunspaceFactory.CreateRunspace(init_state);
  }
}

      

        
        
        
      

    

ASP.NET Form Handler:

protected void LookupButton_Click( object sender, EventArgs e ) {
  string outp = "";
  WindowsIdentity wid = IdentityHelper.Logon(Request["AUTH_USER"], Request["AUTH_PASSWORD"]);
  using( wid.Impersonate() ) {
    Runspace runspace;
    Pipeline pipe;
    runspace = PSHelper.new_runspace();
    runspace.Open();
    pipe = runspace.CreatePipeline();
    Command cmd = new Command("Get-ADUser");
    cmd.Parameters.Add(new CommandParameter("Identity", text_username.Text));
    pipe.Commands.Add(cmd);
    outp = pipe.Invoke().First().Properties["Name"].Value.ToString();
  }
  output.Text = outp;
}