Authentication with the IPC Channel

  • Article

This topic is specific to a legacy technology that is retained for backward compatibility with existing applications and is not recommended for new development. Distributed applications should now be developed using the  Windows Communication Foundation (WCF).

The IPC channel directly supports authentication and impersonation. This topic describes how to configure the client and server channels.

The .NET Framework allows servers of remote objects to authenticate and impersonate callers by setting the properties of the associated IpcServerChannel and IpcClientChannel objects. Unlike the HTTP and TCP channels, the IPC channel performs authentication by default. When an IpcServerChannel is created, an Access Control List (ACL) is created for the channel. By default, the ACL only contains the credentials the server application is running under. To communicate with the channel, the client (and therefore the IpcClientChannel) must run under the same credentials. You can, however, specify a Windows user or User group in the IPC server channel configuration that allows that user or group of users to access the channel.

Server Configuration

If you want the IPC channel to be accessible to users other than the user whose identity the server application is running under, you can specify a user or user group in the authorizedGroup property. The following configuration file allows all users in the Users group to access the IPC channel.

<?xml version="1.0" encoding="utf-8" ?>
<configuration>
    <system.runtime.remoting>
        <application>
            <service>
                <wellknown mode="SingleCall" type="Server.MyRemoteObject, Server" objectUri="MyRemoteObject.rem" />
            </service>
            <channels>
        <channel ref="ipc" portName="MyIpcChannel" authorizedGroup="Users"/>
            </channels>
        </application>
    </system.runtime.remoting>
</configuration>

The IPC channel also supports impersonation. This is controlled on the server by the impersonate property. The following configuration turns impersonation on.

<?xml version="1.0" encoding="utf-8" ?>
<configuration>
    <system.runtime.remoting>
        <application>
            <service>
                <wellknown mode="SingleCall" type="Microsoft.Samples.Implementation.ImplementationClass, Server" objectUri="server.rem" />
            </service>
            <channels>
        <channel ref="ipc" portName="MyIpcChannel" secure="true" impersonate="true" authorizedGroup="Users"/>
            </channels>
        </application>
    </system.runtime.remoting>
</configuration>

Note

When using IPC channel authentication, you must still set the secure property to true when setting the impersonate property to true.

Note

All processes run under a standard user account on Windows Vista. Standard users cannot impersonate an administrator account. If you have a remoting application that must impersonate an administrator account, that application must run under elevated privileges.

The identity of the authenticated client can be accessed by getting the CurrentPrincipal and then accessing its Identity property. The identity of the impersonated client can be accessed by GetCurrent. You can then perform your own authorization, if required.

The IPC channel always uses NTLM authentication. Kerberos is not supported because IPC is limited to calls within a single machine.

Client Configuration

To configure a client IPC channel to use impersonation, set the tokenImpersonationLevel property to impersonation as shown in the following configuration file.

<?xml version="1.0" encoding="utf-8" ?>
<configuration>
    <system.runtime.remoting>
        <application>
            <channels>
              <channel ref="ipc" secure="true" tokenImpersonationLevel="impersonation" />
             </channels>
        </application>
    </system.runtime.remoting>
</configuration>

Note

When using IPC channel authentication, you must still set the secure property to true when setting the tokenImpersonationLevel property to "impersonation". For impersonation to occur, the impersonate property on the server channel must be set true. Notice that on the server the property is called impersonate but on the client, you set tokenImpersonationLevel to impersonation.

Note

All processes run under a standard user account on Windows Vista. Standard users cannot impersonate an administrator account. If you have a remoting application that must impersonate an administrator account, that application must run under elevated privileges.

The tokenImpersonationLevel can be set to one of the values in the following table.

tokenImpersonationLevel setting Description

identification

The server can obtain information about the client, such as security identifiers and privileges, but it cannot impersonate the client.

impersonation

The server can impersonate the client's security context on its local system. The server cannot impersonate the client on remote systems.

delegation

The server can impersonate the client on remote systems.

Note

The IPC channel does not allow you to specify an alternate set of credentials programmatically or through configuration. Therefore the client always sends the credentials it is running under to the server.

Note

The IPC channel only uses NTLM for authentication.

See Also

Concepts

Authentication with the HTTP Channel
Authentication with the TCP Channel
Encryption and Message Integrity