Remoting IPCChannel security with Service

[Grant Schenck]

I have a simple remoting sample using IPCChannel. If I run the server code
as a console app my client can connect just fine. However, if I the same
server code runs in a service, the client gets a RemotingException of
"Failed to connect to an IPC Port: Access is denied".

The Access is denied changes if my service isn't running to "The system
cannot find the file specified" so the I think I'm connecting but being
denied due to some type of security issue.

I'm very weak on security, My service runs under Local System and can
potentially service requests from multiple users. This is a low security
situation so what is the simplest way to get the server to allow any client
to connect or code the client so the server will always allow it to connect?

Thanks,

 

[Grant Schenck]

OK, partially answering my own question...

If my service is logged in "Local System" then my client fails attempting to
invoke a method on a remoted object hosted by the service with a
RemotingException of "Failed to connect to an IPC Port: Access is denied".

However, if my service is logged in as the same user name/pw as the user
running the client then it works.

So, the problem IS security.

How do I configure my server so any user running the client can connect? I
really have no clue how security works in this regard...

Thanks!

 

[Martin Carpella]

How do I configure my server so any user running the client can connect? I
really have no clue how security works in this regard...

IpcChannel accepts a dictionary containing properties for setting up the
channel. You can use this to set the user/group which is authorized to
connect to the pipe, e.g.:

IDictionary prop = new Hashtable();
prop["name"] = "Server";
prop["portName"] = pipeName;
prop["tokenImpersonationLevel"] = TokenImpersonationLevel.Impersonation;
prop["includeVersions"] = false;
prop["strictBinding"] = false;
prop["secure"] = true;
prop["authorizedGroup"] = "DOMAIN\\DomainGroup"

IpcChannel channel = new IpcChannel(prop, clientProv, serverProv);
ChannelServices.RegisterChannel(channel, true);


Use the NTAccount class to find the locale-dependant name of a
well-known SID.

Hope this helps,
Martin