Pierre posted an entry bout impersonation in ASP.NET szenarios.

[Pierre]There are several scenario where you have to use the impersonation in ASP.NET. Consider, for example, you have to save and load files from a network share (file server). In that case, if the web site accept anonymous authentications, you have to impersonate a windows user who has enought privileges to access to that resource.

You have three choices (I guess):

1. Elevate the ASP.NET process identity - worse case since you could compromise the whole site security
2. Impersonate a windows user during the single call (http://blogs.msdn.com/shawnfa/archive/2005/03/22/400749.aspx)
3. Demand the task to a COM+ server application

I think that the last is the best since we have more security and maintenance control
[...]

I agree with him that "Demand the task to a COM+ server application" is the best way of the three he listed. But for me impersonation it is still a don't.

By the way i wanted to post this as a comment but "Comments on this post are closed". Yes this is some criticism on weblogs.asp.net ...

So here my opinion as post in my blog:

Avoid impersonation! If you need to "redirect a binary that is located on a different box than the webserver to the client" utilize another IIS on the 2nd machine or write a service that returns the binary data.

After quite an amount of time, work and effort, that it had cost to realize my ideas I'm proud to present together with Stephan Oetzel to you an extra large community event:

Nach einer ganzen Menge Zeit, Arbeit und Anstrengung die es gekostet hat meine Idee zu realisieren bin ich nun stolz zusammen mit Stephan Oetzel eine Community Event der Superlative zu präsentieren:

And here is the lineup:

Christian Weyer [thinktecture], Michael Willers [newtelligence, VfL-NiederRhein member], Jörg M. Freiberger [avanade, VfL-NiederRhein lead], Dirk Primbs [MS], Stephan Oetzel [flowoffice, NET UG Düsseldorf lead] and me Daniel Fisher(lennybacon) [newtelligence, VfL-NiederRhein lead]

And the Agenda:

So what are you waiting for: Sign up!

http://www.event-team.com/events/NETSummitNRW/

At this point it's time to thank a few guys out there Thomas Fickert of Microsoft Gemany and Damir Tomicic of INETA for the support, the speakers who are almost doing their talks for free, Björn Klotz, Sabine Nüser and Christian Chrisu Sudi of E-Team for everything they did for me and last but not least my girlfriend. Thank you all.

Ok, here is another one:

1. I add a login to my database server:

    EXEC sp_addlogin @Username, @Password, @Database;

This works fine!

2. I add a user, to a database by using the stored prcedure sp_adduser:

    Use [MyDB];
    EXEC sp_adduser @Username;

This also works fine!

3. I want to remove the user from the database. Therefor i use the stored prcedure sp_dropuser:

    EXEC sp_dropuser @Username;

This removes the user BUT what you'll see while digging deeper is that sp_adduser has created an SCHEMA and sp_dropuser don't cares a s%#t about that - it's still there after calling sp_dropuser :-(

First of all ... wow, yeah, the IDE of SQL Server 2005 is pretty nice with all those grafics and animations but

• It's more than anoying that i can not paste multiline text into a column of a table opened via right-click | Open Table
• NOTE: It is possible to add multi-line-texts via an insert/update script - but hey, that takes me 10-30 seconds longer ... raise your hands if ya wanna pay me for that.

Via Willem Odendaal I opend the following web site http://www.squarefree.com/bookmarklets/forms.html#frmget. It holds an interesting collection of bookmarklets (Javascript commands that can be saved as bookmarks so they can be applied to every page that is opend in your browser).

For example: "remove MaxLength" ... shows how important it is to use ASP.NET Validation Controls in your Web Applications.

It's happening again. MichaelW and me are back on tour for TornadoCamp Xpress, the .NET 2.0 event of newtelligence. Today we started. We meet MichalK of Microsoft, he's a nice and smart guy, our local contact and I'm doing this post right in the middle of our C# 2.0 HOL.

I miss my familiy @ home - love ya! cu soon.

Cheers to the rest out there.

While re-writing a few WebServices for .NET 2.0 i ran across following:

...
public static void WaitProc(object state, bool timedOut)
{
   MyAsyncResult myAsyncResult = (MyAsyncResult)state;
   myAsyncResult.OriginalCallback.Invoke(myAsyncResult);
}
...

This compiles without any problems in Visual Studio .NET 2003 but makes the compiler scream (Invoke cannot be called directly on a delegate) untill you change the lines to the following:

...
public static void WaitProc(object state, bool timedOut)
{
   MyAsyncResult myAsyncResult = (MyAsyncResult)state;
   myAsyncResult.OriginalCallback(myAsyncResult);
}
...

Mozilla Suite and Firefox "favicons" LINK Code Execution Exploit

[...]a user clicks on a link, this code will create and launch the file c:\trojan.bat (on Windows).
On Linux and Mac OS X this code will create the file ~/trojan or /trojan[...]