what's in Context.User ??



---
Dominick Baier - DevelopMentor
http://www.leastprivilege.com

  nntp://news.microsoft.com/microsoft.public.dotnet.framework.webservices.enhancements/<uyQqG#zmEHA.3812@TK2MSFTNGP10.phx.gbl>

I've read in a number of articles that if you use a UsernameToken with a
plain text password in WSE2, the token will be validated against the Windows
accounts visible to the server and LogonAsUser() called for that user.

Now, it seems to work. My policy is set to mandate a usertoken and the
account is definitely being validated (it gives an exception if I put in a
bad user or password), but there's no sign of the LogonAsUser, since
Environmrnt.UserName called from the webmethod just gives me ASPNET, so it's
not impersonating the user defined in the token correctly.

Is there some other piece of setup I'm missing here? Are the articles
claiming that LogonAsUser is called all wrong? Do I need to do my own
impersonation here? Anyone got any examples?

Clearly, when this is fixed, my next step is to encrypt the user token. Any
good example policy files to do this would be most welcome.

Any good documentation suggestions would also be apreciated, as the bits and
pieces I have googled for so far are very scrappy.

Thanks,

Tim



[microsoft.public.dotnet.framework.webservices.enhancements]