Threading in ASP.NET

[Adrian Bezzina]

Hi Everyone,

I am having difficulty in starting a new thread in ASP.NET while processing
a page request.

I have an aspx page that runs a whole lot of batch reports. These batch
reports could take up to 5 minutes to run, and then once complete, are
emailed or archived.

The problem that I am encountering is that the batch runs fine when I DON'T
run the program to spawn the batch reports, but as soon as I try and run the
program to spawn the batch reports on a NEW thread, I get permission issues.

The ASP.NET worker thread is using impersonation - set in the WEB.CONFIG
file. I know for a fact that the new thread is not running in the same
'user' context as the ASP.NET worker thread, as the error is some to the
likes of 'permission denied for user ASP.NET'.

How do I get a new thread to run in the same 'user' context as the ASP.NET
worker thread?

Regards,
Adrian.

 

[bruce barker]

when you start a thread, it gets the security context of the process, not
the creating thread. so when you create a thread in asp.net, it runs as the
asp.net account, whatever account aspnet_wp.exe is running under.

using the winnt security api, you can pass the thread security token to the
new thread. see ntapi DuplicateToken, RevertToSelf, and .net WindowsIdentity
class. you will need to giver impersonation permission to the asp.net
account also (see "act as part of os" permission.)

if you know the account and password (or can read from web config), you can
use LogonUser api.

-- bruce (sqlwork.com)



| Hi Everyone,
|
| I am having difficulty in starting a new thread in ASP.NET while
processing
| a page request.
|
| I have an aspx page that runs a whole lot of batch reports. These batch
| reports could take up to 5 minutes to run, and then once complete, are
| emailed or archived.
|
| The problem that I am encountering is that the batch runs fine when I
DON'T
| run the program to spawn the batch reports, but as soon as I try and run
the
| program to spawn the batch reports on a NEW thread, I get permission
issues.
|
| The ASP.NET worker thread is using impersonation - set in the WEB.CONFIG
| file. I know for a fact that the new thread is not running in the same
| 'user' context as the ASP.NET worker thread, as the error is some to the
| likes of 'permission denied for user ASP.NET'.
|
| How do I get a new thread to run in the same 'user' context as the ASP.NET
| worker thread?
|
| Regards,
| Adrian.
|
|

 

[Alvin Bruney [MVP]]

Bruce:

would you mind providing an example of a spawned thread that accepts a token
for another account in order for it to run under an impersonated account?

--
Regards,
Alvin Bruney

Shameless Author plug
The Microsoft Office Web Components Black Book with .NET
http://tinyurl.com/27cok

 

[bruce barker]

simple class to run a background thread under current identity. just inherit
and override Process. note: the asp.net account must be given permission to
impersonate ("act as part of o/s")

class BackgroundThread
{
[DllImport("advapi32")]
private extern static bool RevertToSelf();
WindowsIdentity mImpersonatedIdentity;

public void StartThread()
{
// setup thread
ThreadStart ts = new ThreadStart(Process);
Thread th = new Thread(ts);

// get who i am
mImpersonatedIdentity = WindowsIdentity.GetCurrent();

// revert to process identity
RevertToSelf();

// start thread
th.Start();

// restore to me
mImpersonatedIdentity.Impersonate();
}

private void startup()
{
mImpersonatedIdentity.Impersonate();
Process();
}

// override this class to do work.
public virtual void Process()
{
}
}



"Alvin Bruney [MVP]" <vapor at steaming post office> wrote in message
| Bruce:
|
| would you mind providing an example of a spawned thread that accepts a
token
| for another account in order for it to run under an impersonated account?
|
| --
| Regards,
| Alvin Bruney
|
| Shameless Author plug
| The Microsoft Office Web Components Black Book with .NET
| http://tinyurl.com/27cok
| | > when you start a thread, it gets the security context of the process,
not
| > the creating thread. so when you create a thread in asp.net, it runs as
| > the
| > asp.net account, whatever account aspnet_wp.exe is running under.
| >
| > using the winnt security api, you can pass the thread security token to
| > the
| > new thread. see ntapi DuplicateToken, RevertToSelf, and .net
| > WindowsIdentity
| > class. you will need to giver impersonation permission to the asp.net
| > account also (see "act as part of os" permission.)
| >
| > if you know the account and password (or can read from web config), you
| > can
| > use LogonUser api.
| >
| > -- bruce (sqlwork.com)
| >
| >
| >
| > | > | Hi Everyone,
| > |
| > | I am having difficulty in starting a new thread in ASP.NET while
| > processing
| > | a page request.
| > |
| > | I have an aspx page that runs a whole lot of batch reports. These
batch
| > | reports could take up to 5 minutes to run, and then once complete, are
| > | emailed or archived.
| > |
| > | The problem that I am encountering is that the batch runs fine when I
| > DON'T
| > | run the program to spawn the batch reports, but as soon as I try and
run
| > the
| > | program to spawn the batch reports on a NEW thread, I get permission
| > issues.
| > |
| > | The ASP.NET worker thread is using impersonation - set in the
WEB.CONFIG
| > | file. I know for a fact that the new thread is not running in the
same
| > | 'user' context as the ASP.NET worker thread, as the error is some to
the
| > | likes of 'permission denied for user ASP.NET'.
| > |
| > | How do I get a new thread to run in the same 'user' context as the
| > ASP.NET
| > | worker thread?
| > |
| > | Regards,
| > | Adrian.
| > |
| > |
| >
| >
|
|

 

[Alvin Bruney [MVP]]

I think i misunderstood the intention.

I was hopefully looking for code that would allow me to modify the account
which is used when process.Start() is used to spawn a process. There seems
to be no way to do this because the spawned process always uses the parents
identity. I am told this is repaired in 2.0

--
Regards,
Alvin Bruney

Shameless Author plug
The Microsoft Office Web Components Black Book with .NET
http://tinyurl.com/27cok

simple class to run a background thread under current identity. just
inherit
and override Process. note: the asp.net account must be given permission
to
impersonate ("act as part of o/s")

class BackgroundThread
{
[DllImport("advapi32")]
private extern static bool RevertToSelf();
WindowsIdentity mImpersonatedIdentity;

public void StartThread()
{
// setup thread
ThreadStart ts = new ThreadStart(Process);
Thread th = new Thread(ts);

// get who i am
mImpersonatedIdentity = WindowsIdentity.GetCurrent();

// revert to process identity
RevertToSelf();

// start thread
th.Start();

// restore to me
mImpersonatedIdentity.Impersonate();
}

private void startup()
{
mImpersonatedIdentity.Impersonate();
Process();
}

// override this class to do work.
public virtual void Process()
{
}
}



"Alvin Bruney [MVP]" <vapor at steaming post office> wrote in message
| Bruce:
|
| would you mind providing an example of a spawned thread that accepts a
token
| for another account in order for it to run under an impersonated
account?
|
| --
| Regards,
| Alvin Bruney
|
| Shameless Author plug
| The Microsoft Office Web Components Black Book with .NET
| http://tinyurl.com/27cok
| | > when you start a thread, it gets the security context of the process,
not
| > the creating thread. so when you create a thread in asp.net, it runs
as
| > the
| > asp.net account, whatever account aspnet_wp.exe is running under.
| >
| > using the winnt security api, you can pass the thread security token
to
| > the
| > new thread. see ntapi DuplicateToken, RevertToSelf, and .net
| > WindowsIdentity
| > class. you will need to giver impersonation permission to the asp.net
| > account also (see "act as part of os" permission.)
| >
| > if you know the account and password (or can read from web config),
you
| > can
| > use LogonUser api.
| >
| > -- bruce (sqlwork.com)
| >
| >
| >
| > | > | Hi Everyone,
| > |
| > | I am having difficulty in starting a new thread in ASP.NET while
| > processing
| > | a page request.
| > |
| > | I have an aspx page that runs a whole lot of batch reports. These
batch
| > | reports could take up to 5 minutes to run, and then once complete,
are
| > | emailed or archived.
| > |
| > | The problem that I am encountering is that the batch runs fine when
I
| > DON'T
| > | run the program to spawn the batch reports, but as soon as I try and
run
| > the
| > | program to spawn the batch reports on a NEW thread, I get permission
| > issues.
| > |
| > | The ASP.NET worker thread is using impersonation - set in the
WEB.CONFIG
| > | file. I know for a fact that the new thread is not running in the
same
| > | 'user' context as the ASP.NET worker thread, as the error is some to
the
| > | likes of 'permission denied for user ASP.NET'.
| > |
| > | How do I get a new thread to run in the same 'user' context as the
| > ASP.NET
| > | worker thread?
| > |
| > | Regards,
| > | Adrian.
| > |
| > |
| >
| >
|
|

 

[Adrian Bezzina]

Thanks,

Though I am still having problems - at the moment the thread that I create
is calling a program that runs a batch of SQL Reporting services reports.
Before impersonation, nothing ran with a permission denied error.

Now that I have the impersonation code, the first report runs on the newly
created thread, while the rest fail with an internal server error. They are
called all the same way with a simple loop.

If run in the normal ASP thread (not a new thread) the reports work fine.

Regards,
Adrian.

simple class to run a background thread under current identity. just
inherit
and override Process. note: the asp.net account must be given permission
to
impersonate ("act as part of o/s")

class BackgroundThread
{
[DllImport("advapi32")]
private extern static bool RevertToSelf();
WindowsIdentity mImpersonatedIdentity;

public void StartThread()
{
// setup thread
ThreadStart ts = new ThreadStart(Process);
Thread th = new Thread(ts);

// get who i am
mImpersonatedIdentity = WindowsIdentity.GetCurrent();

// revert to process identity
RevertToSelf();

// start thread
th.Start();

// restore to me
mImpersonatedIdentity.Impersonate();
}

private void startup()
{
mImpersonatedIdentity.Impersonate();
Process();
}

// override this class to do work.
public virtual void Process()
{
}
}



"Alvin Bruney [MVP]" <vapor at steaming post office> wrote in message
| Bruce:
|
| would you mind providing an example of a spawned thread that accepts a
token
| for another account in order for it to run under an impersonated
account?
|
| --
| Regards,
| Alvin Bruney
|
| Shameless Author plug
| The Microsoft Office Web Components Black Book with .NET
| http://tinyurl.com/27cok
| | > when you start a thread, it gets the security context of the process,
not
| > the creating thread. so when you create a thread in asp.net, it runs
as
| > the
| > asp.net account, whatever account aspnet_wp.exe is running under.
| >
| > using the winnt security api, you can pass the thread security token
to
| > the
| > new thread. see ntapi DuplicateToken, RevertToSelf, and .net
| > WindowsIdentity
| > class. you will need to giver impersonation permission to the asp.net
| > account also (see "act as part of os" permission.)
| >
| > if you know the account and password (or can read from web config),
you
| > can
| > use LogonUser api.
| >
| > -- bruce (sqlwork.com)
| >
| >
| >
| > | > | Hi Everyone,
| > |
| > | I am having difficulty in starting a new thread in ASP.NET while
| > processing
| > | a page request.
| > |
| > | I have an aspx page that runs a whole lot of batch reports. These
batch
| > | reports could take up to 5 minutes to run, and then once complete,
are
| > | emailed or archived.
| > |
| > | The problem that I am encountering is that the batch runs fine when
I
| > DON'T
| > | run the program to spawn the batch reports, but as soon as I try and
run
| > the
| > | program to spawn the batch reports on a NEW thread, I get permission
| > issues.
| > |
| > | The ASP.NET worker thread is using impersonation - set in the
WEB.CONFIG
| > | file. I know for a fact that the new thread is not running in the
same
| > | 'user' context as the ASP.NET worker thread, as the error is some to
the
| > | likes of 'permission denied for user ASP.NET'.
| > |
| > | How do I get a new thread to run in the same 'user' context as the
| > ASP.NET
| > | worker thread?
| > |
| > | Regards,
| > | Adrian.
| > |
| > |
| >
| >
|
|