B# .NET Blog

using System;

namespace ServiceType
{
   public interface IDemoService
   {
      string GetIdentity();
   }
}

using System;
using ServiceType;
using System.Security.Principal;
using System.Runtime.Remoting.Channels.Tcp;
using System.Runtime.Remoting.Channels;
using System.Runtime.Remoting;
using System.Threading;

namespace Server
{
   class Program
   {
      static void Main(string[] args)
      {
         TcpChannel channel = new TcpChannel(2468);
         ChannelServices.RegisterChannel(channel, true);

         RemotingConfiguration.RegisterWellKnownServiceType(typeof(DemoService), "demoservice", WellKnownObjectMode.SingleCall);

         Console.WriteLine("Service running as {0}...", WindowsIdentity.GetCurrent().Name);
         Console.ReadLine();
      }
   }

   public class DemoService : MarshalByRefObject, IDemoService
   {
      public string GetIdentity()
      {
         WindowsIdentity identity = Thread.CurrentPrincipal.Identity as WindowsIdentity;
         if (identity != null && identity.IsAuthenticated)
            return identity.Name;
         else
            return null;
      }
   }
}

using System;
using ServiceType;
using System.Runtime.Remoting.Channels.Tcp;
using System.Runtime.Remoting.Channels;
using System.Security.Principal;

namespace Client
{
   class Program
   {
      static void Main(string[] args)
      {
         TcpChannel channel = new TcpChannel();
         ChannelServices.RegisterChannel(channel, true);

         IDemoService svc = (IDemoService) Activator.GetObject(typeof(IDemoService), "tcp://localhost:2468/demoservice");

         Console.WriteLine("Client running as {0}...", WindowsIdentity.GetCurrent().Name);
         Console.WriteLine("Thread identity on the server: {0}", svc.GetIdentity());
         Console.ReadLine();
      }
   }
}

Testing it

Start the server executable (server.exe) in one console window:

Start the client executable (client.exe) in another console window:

Nothing special so far. Now run the client executable (client.exe) as another user using the runas command runas client.exe /user:test:

That's exactly what we desired.

The trick?

The trick is simple but a bit underdocumented. First of all, since .NET 2.0 the TcpChannel (as well as the HttpChannel) supports SSPI as mentioned on MSDN. Furthermore there is a new RegisterChannel overload on the ChannelServices class that takes a boolean second parameter called "ensureSecurity". By turning this on (on both client and server) SSPI seems to work fine across the wire. Notice the one-parameter RegisterChannel method is marked as deprecated as of .NET 2.0. The documentation is rather simplistic:

If the ensureSecurity parameter is set to true, the remoting system determines whether the channel implements ISecurableChannel, and if so, enables encryption and digital signatures. An exception is thrown if the channel does not implement ISecurableChannel.

But as you can see, setting the flag does the trick.

Taking it one step further

The application I'm working on requires a little more. As the matter in fact, it's a server with two faces. One face is the management face. Its goal is for users to send commands to the server which are then dispatched to multiple other machines (the second face, aka dispatching interface). In order to be eligible to send such a command, the management face requires end-user authentication and authorizes the user. If the user is permitted to send the command, the dispatching face kicks in and dispatches the command to the target machines. This time, the end user's identity should not be forwarded, but the dispatched command should be running as the service user. Looks a little complex? A little example will help:

Assume that the server (SERVER) is running as BACH\svcuser and is waiting for commands to come in through the management face. Now the following happens:

• Management client PCMGMT runs as BACH\Bart and sends SayHello(new string[] { "PC01", "PC02" }) to SERVER.
• The server has received the SayHello message on the management face. The thread doing the work runs as BACH\Bart (not BACH\svcuser) thanks to SSPI ("impersonation").
  • BACH\Bart is authorized and is confirmed to be eligible to send the SayHello command.
  • The dispatching face of the server sends a Hello message to PC01 acting as BACH\svcuser (not BACH\Bart).
    • PC01 receives the Hello message on a thread running as BACH\svcuser (similar to PCMGMT-to-SERVER as BACH\Bart but now SERVER-to-PC01 as BACH\svcuser).
  • The dispatching face of the server sends a Hello message to PC02 acting as BACH\svcuser (not BACH\Bart).
    • PC02 receives the Hello message on a thread running as BACH\svcuser (similar to PCMGMT-to-SERVER as BACH\Bart but now SERVER-to-PC02 as BACH\svcuser).

To do this, we can use the class WindowsImpersonationContext as shown below:

using (WindowsImpersonationContext ctx = svcUser.Impersonate())
{
   // Do work acting as the service user
}

In this piece of code the svcUser object is of type WindowsIdentity and refers to the original identity the service was started as. Let's show a more complete example (changes indicated in bold).

Service type

using System;

namespace ServiceType
{
   public interface IDemoService
   {
      string GetIdentity();
      void SomeOperation();
   }
}

Server implementation

using System;
using ServiceType;
using System.Security.Principal;
using System.Runtime.Remoting.Channels.Tcp;
using System.Runtime.Remoting.Channels;
using System.Runtime.Remoting;
using System.Threading;

namespace Server
{
   class Program
   {
      public static WindowsIdentity Identity;

      static void Main(string[] args)
      {
         TcpChannel channel = new TcpChannel(2468);
         ChannelServices.RegisterChannel(channel, true);

Client implementation

The client's implementation is also fairly easy for .NET Remoting fans:

The result on the server when running the server.exe as VISTA-9400\Bart and the client.exe as VISTA-9400\test:

Happy coding!