Impersonation

[Esmo2000]

When I execute the following code I don't get the behavious I would expect (i.e. permission denied) :

newUser = this.ImpersonateUser("administrator","", "adminPass");
FileInfo file = new FileInfo("c:/folderBeyondMyPermission/somefile.txt");
file.Delete();

The folder (folderBeyondMyPermission) is not a folder that the user I am signed on can edit or even list in. However, I would expect the impersonation code I used would have given me permission. I did check that my identity is switching, and when i use WindowsIdentity.getCurrent() (I think thats the function name) it DOES say I am administrator. What could be wrong?



The context of this code is a console application. The function code was one I got off codeproject and is listed here:

// obtains user token
[DllImport("advapi32.dll", SetLastError=true)]
public static extern bool LogonUser(string pszUsername, string pszDomain, string pszPassword,
int dwLogonType, int dwLogonProvider, ref IntPtr phToken);

// closes open handes returned by LogonUser
[DllImport("kernel32.dll", CharSet=CharSet.Auto)]
public extern static bool CloseHandle(IntPtr handle);

// creates duplicate token handle
[DllImport("advapi32.dll", CharSet=CharSet.Auto, SetLastError=true)]
public extern static bool DuplicateToken(IntPtr ExistingTokenHandle,
int SECURITY_IMPERSONATION_LEVEL, ref IntPtr DuplicateTokenHandle);

// group type enum
public enum SECURITY_IMPERSONATION_LEVEL : int
{
SecurityAnonymous = 0,
SecurityIdentification = 1,
SecurityImpersonation = 2,
SecurityDelegation = 3
}

private System.Security.Principal.WindowsImpersonationContext newUser;

public WindowsImpersonationContext
ImpersonateUser(string sUsername, string sDomain, string sPassword)
{
// initialize tokens
IntPtr pExistingTokenHandle = new IntPtr(0);
IntPtr pDuplicateTokenHandle = new IntPtr(0);
pExistingTokenHandle = IntPtr.Zero;
pDuplicateTokenHandle = IntPtr.Zero;

// if domain name was blank, assume local machine
if (sDomain == "")
sDomain = System.Environment.MachineName;

try
{
const int LOGON32_PROVIDER_DEFAULT = 0;

// create token
const int LOGON32_LOGON_INTERACTIVE = 2;

// get handle to token
bool bImpersonated = LogonUser(sUsername, sDomain, sPassword,
LOGON32_LOGON_INTERACTIVE, LOGON32_PROVIDER_DEFAULT,
ref pExistingTokenHandle);

// did impersonation fail?
if (false == bImpersonated)
{
int nErrorCode = Marshal.GetLastWin32Error();
throw new System.Exception("LogonUser() failed with error code: " +
nErrorCode + "\r\n");
}

bool bRetVal = DuplicateToken(pExistingTokenHandle,
(int)SECURITY_IMPERSONATION_LEVEL.SecurityImpersonation,
ref pDuplicateTokenHandle);

// did DuplicateToken fail?
if (false == bRetVal)
{
int nErrorCode = Marshal.GetLastWin32Error();
// close existing handle
CloseHandle(pExistingTokenHandle);
throw new System.Exception("DuplicateToken() failed with error code: "
+ nErrorCode + "\r\n");
}
else
{
// create new identity using new primary token
WindowsIdentity newId = new WindowsIdentity
(pDuplicateTokenHandle);
WindowsImpersonationContext impersonatedUser =
newId.Impersonate();

return impersonatedUser;
}
}
catch (Exception ex)
{
throw ex;
}
finally
{
// close handle(s)
if (pExistingTokenHandle != IntPtr.Zero)
CloseHandle(pExistingTokenHandle);
if (pDuplicateTokenHandle != IntPtr.Zero)
CloseHandle(pDuplicateTokenHandle);
}
}