Add asynchronous overload of WindowsIdentity.RunImpersonated

[Tratcher]

https://github.com/dotnet/corefx/issues/9996#issuecomment-307870746
dotnet/aspnetcore#1805 (comment)

ASP.NET Core is getting many requests for users that want to impersonate the authenticated user of the request and perform actions on their behalf. The main problem is that many of these actions are asynchronous, such as database access, but RunImpersonated is synchronous. Users have repeatedly made the mistake of starting an asynchronous operation within RunImpersonated and then returning the Task. Exiting RunImpersonated revokes the impersonation and can cause errors or reverting to the base identity in the Task.

Proposal:
public static Task RunImpersonatedAsync(SafeAccessTokenHandle safeAccessTokenHandle, Func<Task> func)
public static Task<T> RunImpersonatedAsync<T>(SafeAccessTokenHandle safeAccessTokenHandle, Func<Task<T>> func)

@brentschmaltz

[stephentoub]

Note that ExecutionContext in .NET Core does not flow impersonation. The requested functionality could hopefully be achieved with an AsyncLocal and a valueChangedHandler that took care of impersonating and reverting the impersonation, but it would need to be prototyped.
cc: @kouvel

[madrianr]

Is it true that we cannot expect such a feature in a short period of time?
can you give us a timeframe?

robert

[brentschmaltz]

@Tratcher @stephentoub @madrianr are we discussing Integrated Windows Auth (IWA) ?

[Tratcher]

Primarily Kerberos for the delegation capabilities.

[brentschmaltz]

@Tratcher in other runtimes, we set the thread identity and ran the entire call graph under that identity. Then when exiting that call, we reverted the threads identity.
Don't know if that model works in core.

[Tratcher]

How did that flow to the async actions?

[brentschmaltz]

@Tratcher within a process (or appdomain) the new thread has the identity associated with the thread that spawned it. Cross thread or appdomain requires serializing. Cross process shouldn't be used because the NTTOKEN is just a handle and the values are only unique within a process. A windowsIdentity hydrated could point a different user. Very unlikely as the handle would have to be a handle to an nttoken.

[Tratcher]

And threadpool threads? That's where most of this code runs.

[lakeman]

ExecutionContext in dotnet core does seem to flow Impersonation (#25627). ExecutionContext also does not have an explicit lifetime, while token handle's do.

Instead of adding a RunImpersonatedAsync method, I'd like to propose an alternative api;

public IDisposable BeginImpersonation(SafeAccessTokenHandle token)

Which would internally still use an AsyncLocal & ExecutionContext to flow the impersonation across async continuations. While also ensuring that the impersonation cannot outlive the lifetime of the returned IDisposable.

Explicitly documenting that any task that escapes the lifetime of the disposable will still execute, but no longer be impersonating that user.

[stephentoub]

ExecutionContext in dotnet core does seem to flow Impersonation

It doesn't, at least not explicitly, i.e. there's no SecurityContext stored on the ExecutionContext as there is in netfx. But (and I didn't realize this was already done, hence my earlier comment), it appears it's trying to simulate it using AsyncLocal, similar to what I suggested earlier:
https://github.com/dotnet/corefx/blob/9a2e5d8f0e7f816f983bce75f5bba22811df4994/src/System.Security.Principal.Windows/src/System/Security/Principal/WindowsIdentity.cs#L640

[bartonjs]

Is this a "this works on NetFx but is broken on CoreFx", or a "now that async is so easy we see a feature hole"?

[Tratcher]

NetFx had Impersonate() and would flow the impersonated identity across async operations via the ExecutionContext (?). CoreFx doesn't have this API or implicit flow.

[Tratcher]

ping people keep doing this wrong and are set up for failure.
https://github.com/lilpug/ASP.NET-Core-Impersonation/blob/96917b51c578aa7d18c9636a4a58f4571822890f/lib/middleware/pipeline.cs#L46-L49

[wpbrown]

NetFx had Impersonate() and would flow the impersonated identity across async operations via the ExecutionContext (?). CoreFx doesn't have this API or implicit flow.

As @lakeman said, it seems CoreFX is flowing the impersonation. RunImpersonated creates an ExecutionContext and sets that AsyncLocal s_currentImpersonatedToken from within. It then uses the AsyncLocal ThreadContextChanged event to maintain the correct impersonation on the threads the task runs on.

What would an async verions of RunImpersonatedInternal do differently? It could potentially await the Action, but currently nothing happens after the action is called.

Instead of adding a RunImpersonatedAsync method, I'd like to propose an alternative api;

Wouldn't BeginImpersonation essentially just be Impersonate from NetFX? Why wasn't it brought over?

Perhaps @Tratcher's suggestion will provide more implementation flexibility for corefx devs in the future to manage the SafeAccessToken lifetime more appropriately without holding it in an AsyncLocal.

Below is a quick program to demonstrate the impersonation 'flowing' on Tasks returned from RunImpersonated:

using Microsoft.Win32.SafeHandles;
using System;
using System.Diagnostics;
using System.Linq;
using System.Runtime.InteropServices;
using System.Security.Principal;
using System.Threading;
using System.Threading.Tasks;

namespace TestImpersonate
{
    class Program
    {
        [DllImport("advapi32.dll", SetLastError = true, CharSet = CharSet.Unicode)]
        public static extern bool LogonUser(String lpszUsername, String lpszDomain, String lpszPassword,
            int dwLogonType, int dwLogonProvider, out SafeAccessTokenHandle phToken);

        const int LOGON32_PROVIDER_DEFAULT = 0;
        const int LOGON32_LOGON_NETWORK = 3;
        static readonly ThreadLocal<Random> random = new ThreadLocal<Random>(() => new Random(Thread.CurrentThread.ManagedThreadId));

        static void Main(string[] args)
        {
            string user = Environment.UserName;
            LogonUser("test1", "localhost", "test1pass", LOGON32_LOGON_NETWORK, LOGON32_PROVIDER_DEFAULT, out SafeAccessTokenHandle ath1);
            LogonUser("test2", "localhost", "test2pass", LOGON32_LOGON_NETWORK, LOGON32_PROVIDER_DEFAULT, out SafeAccessTokenHandle ath2);
            Console.WriteLine($"Main Begin: {Environment.UserName}");
            var tasks = Enumerable.Range(1, 50).Select(x => {
                var token = x % 2 == 0 ? ath1 : ath2;
                var name = x % 2 == 0 ? "test1" : "test2";
                return WindowsIdentity.RunImpersonated(token, async () => await TestRun(x, name));
            });
            Task.Delay(500).ContinueWith(async t => await TestRun(0, user));
            Task.WaitAll(tasks.ToArray());
            Console.WriteLine($"Main End: {Environment.UserName}");
        }

        static async Task TestRun(int test, string expectUser)
        {
            TestUser(test, expectUser);
            Thread.Sleep(random.Value.Next(5, 50));
            await Task.Delay(random.Value.Next(5,100));
            TestUser(test, expectUser);
            Thread.Sleep(random.Value.Next(5, 50));
            await Task.Delay(random.Value.Next(5,50));
            TestUser(test, expectUser);
        }

        static void TestUser(int test, string expectUser)
        {
            var actualUser = Environment.UserName;
            Console.WriteLine($"[{test}] Actual: {actualUser} Expect: {expectUser} Thread: {Thread.CurrentThread.ManagedThreadId}");
            Trace.Assert(actualUser == expectUser);
        }
    }
}

Program Output

Main Begin: will
[1] Actual: test2 Expect: test2 Thread: 1
[2] Actual: test1 Expect: test1 Thread: 1
[1] Actual: test2 Expect: test2 Thread: 4
[3] Actual: test2 Expect: test2 Thread: 1
[4] Actual: test1 Expect: test1 Thread: 1
[5] Actual: test2 Expect: test2 Thread: 1
[6] Actual: test1 Expect: test1 Thread: 1
[7] Actual: test2 Expect: test2 Thread: 1
[3] Actual: test2 Expect: test2 Thread: 5
[2] Actual: test1 Expect: test1 Thread: 4
[1] Actual: test2 Expect: test2 Thread: 6
[8] Actual: test1 Expect: test1 Thread: 1
[6] Actual: test1 Expect: test1 Thread: 7
[9] Actual: test2 Expect: test2 Thread: 1
[3] Actual: test2 Expect: test2 Thread: 6
[5] Actual: test2 Expect: test2 Thread: 9
[10] Actual: test1 Expect: test1 Thread: 1
[2] Actual: test1 Expect: test1 Thread: 7
[4] Actual: test1 Expect: test1 Thread: 8
[6] Actual: test1 Expect: test1 Thread: 9
[11] Actual: test2 Expect: test2 Thread: 1
[5] Actual: test2 Expect: test2 Thread: 4
[7] Actual: test2 Expect: test2 Thread: 6
[8] Actual: test1 Expect: test1 Thread: 5
[9] Actual: test2 Expect: test2 Thread: 8
[4] Actual: test1 Expect: test1 Thread: 4
[12] Actual: test1 Expect: test1 Thread: 1
[13] Actual: test2 Expect: test2 Thread: 1
[11] Actual: test2 Expect: test2 Thread: 4
[9] Actual: test2 Expect: test2 Thread: 6
[10] Actual: test1 Expect: test1 Thread: 4
[8] Actual: test1 Expect: test1 Thread: 5
[11] Actual: test2 Expect: test2 Thread: 5
[7] Actual: test2 Expect: test2 Thread: 6
[14] Actual: test1 Expect: test1 Thread: 1
[12] Actual: test1 Expect: test1 Thread: 8
[13] Actual: test2 Expect: test2 Thread: 4
[10] Actual: test1 Expect: test1 Thread: 5
[15] Actual: test2 Expect: test2 Thread: 1
[0] Actual: will Expect: will Thread: 6
[12] Actual: test1 Expect: test1 Thread: 8
[16] Actual: test1 Expect: test1 Thread: 1
[14] Actual: test1 Expect: test1 Thread: 9
[13] Actual: test2 Expect: test2 Thread: 8
[17] Actual: test2 Expect: test2 Thread: 1
[14] Actual: test1 Expect: test1 Thread: 5
[18] Actual: test1 Expect: test1 Thread: 1
[17] Actual: test2 Expect: test2 Thread: 5
[0] Actual: will Expect: will Thread: 7
[15] Actual: test2 Expect: test2 Thread: 6
[16] Actual: test1 Expect: test1 Thread: 5
[19] Actual: test2 Expect: test2 Thread: 1
[0] Actual: will Expect: will Thread: 6
[17] Actual: test2 Expect: test2 Thread: 6
[20] Actual: test1 Expect: test1 Thread: 1
[19] Actual: test2 Expect: test2 Thread: 5
[16] Actual: test1 Expect: test1 Thread: 6
[15] Actual: test2 Expect: test2 Thread: 6
[21] Actual: test2 Expect: test2 Thread: 1
[18] Actual: test1 Expect: test1 Thread: 4
[22] Actual: test1 Expect: test1 Thread: 1
[19] Actual: test2 Expect: test2 Thread: 7
[20] Actual: test1 Expect: test1 Thread: 4
[23] Actual: test2 Expect: test2 Thread: 1
[18] Actual: test1 Expect: test1 Thread: 7
[24] Actual: test1 Expect: test1 Thread: 1
[22] Actual: test1 Expect: test1 Thread: 5
[20] Actual: test1 Expect: test1 Thread: 6
[25] Actual: test2 Expect: test2 Thread: 1
[21] Actual: test2 Expect: test2 Thread: 8
[26] Actual: test1 Expect: test1 Thread: 1
[23] Actual: test2 Expect: test2 Thread: 8
[27] Actual: test2 Expect: test2 Thread: 1
[22] Actual: test1 Expect: test1 Thread: 9
[24] Actual: test1 Expect: test1 Thread: 6
[25] Actual: test2 Expect: test2 Thread: 7
[28] Actual: test1 Expect: test1 Thread: 1
[21] Actual: test2 Expect: test2 Thread: 9
[26] Actual: test1 Expect: test1 Thread: 11
[29] Actual: test2 Expect: test2 Thread: 1
[23] Actual: test2 Expect: test2 Thread: 11
[26] Actual: test1 Expect: test1 Thread: 5
[28] Actual: test1 Expect: test1 Thread: 7
[25] Actual: test2 Expect: test2 Thread: 9
[24] Actual: test1 Expect: test1 Thread: 11
[30] Actual: test1 Expect: test1 Thread: 1
[27] Actual: test2 Expect: test2 Thread: 7
[29] Actual: test2 Expect: test2 Thread: 5
[31] Actual: test2 Expect: test2 Thread: 1
[28] Actual: test1 Expect: test1 Thread: 5
[29] Actual: test2 Expect: test2 Thread: 7
[32] Actual: test1 Expect: test1 Thread: 1
[31] Actual: test2 Expect: test2 Thread: 5
[33] Actual: test2 Expect: test2 Thread: 1
[30] Actual: test1 Expect: test1 Thread: 8
[27] Actual: test2 Expect: test2 Thread: 6
[34] Actual: test1 Expect: test1 Thread: 1
[31] Actual: test2 Expect: test2 Thread: 8
[32] Actual: test1 Expect: test1 Thread: 5
[35] Actual: test2 Expect: test2 Thread: 1
[33] Actual: test2 Expect: test2 Thread: 7
[30] Actual: test1 Expect: test1 Thread: 6
[34] Actual: test1 Expect: test1 Thread: 6
[36] Actual: test1 Expect: test1 Thread: 1
[32] Actual: test1 Expect: test1 Thread: 4
[33] Actual: test2 Expect: test2 Thread: 4
[37] Actual: test2 Expect: test2 Thread: 1
[38] Actual: test1 Expect: test1 Thread: 1
[36] Actual: test1 Expect: test1 Thread: 8
[34] Actual: test1 Expect: test1 Thread: 9
[39] Actual: test2 Expect: test2 Thread: 1
[37] Actual: test2 Expect: test2 Thread: 8
[40] Actual: test1 Expect: test1 Thread: 1
[35] Actual: test2 Expect: test2 Thread: 7
[36] Actual: test1 Expect: test1 Thread: 9
[37] Actual: test2 Expect: test2 Thread: 8
[35] Actual: test2 Expect: test2 Thread: 8
[41] Actual: test2 Expect: test2 Thread: 1
[40] Actual: test1 Expect: test1 Thread: 5
[39] Actual: test2 Expect: test2 Thread: 7
[38] Actual: test1 Expect: test1 Thread: 11
[42] Actual: test1 Expect: test1 Thread: 1
[43] Actual: test2 Expect: test2 Thread: 1
[44] Actual: test1 Expect: test1 Thread: 1
[40] Actual: test1 Expect: test1 Thread: 8
[41] Actual: test2 Expect: test2 Thread: 8
[45] Actual: test2 Expect: test2 Thread: 1
[42] Actual: test1 Expect: test1 Thread: 7
[44] Actual: test1 Expect: test1 Thread: 4
[43] Actual: test2 Expect: test2 Thread: 5
[38] Actual: test1 Expect: test1 Thread: 8
[39] Actual: test2 Expect: test2 Thread: 9
[46] Actual: test1 Expect: test1 Thread: 1
[43] Actual: test2 Expect: test2 Thread: 4
[41] Actual: test2 Expect: test2 Thread: 7
[47] Actual: test2 Expect: test2 Thread: 1
[42] Actual: test1 Expect: test1 Thread: 4
[44] Actual: test1 Expect: test1 Thread: 8
[48] Actual: test1 Expect: test1 Thread: 1
[47] Actual: test2 Expect: test2 Thread: 4
[45] Actual: test2 Expect: test2 Thread: 7
[49] Actual: test2 Expect: test2 Thread: 1
[47] Actual: test2 Expect: test2 Thread: 7
[46] Actual: test1 Expect: test1 Thread: 9
[48] Actual: test1 Expect: test1 Thread: 4
[50] Actual: test1 Expect: test1 Thread: 1
[45] Actual: test2 Expect: test2 Thread: 7
[46] Actual: test1 Expect: test1 Thread: 7
[50] Actual: test1 Expect: test1 Thread: 4
[49] Actual: test2 Expect: test2 Thread: 7
[48] Actual: test1 Expect: test1 Thread: 5
[50] Actual: test1 Expect: test1 Thread: 7
[49] Actual: test2 Expect: test2 Thread: 7
Main End: will

[mattjohnsonpint]

FYI, users of my SimpleImpersonation library are also encountering this, as I use WindowsIdentity.RunImpersonated internally (paired with a P/Invoke to LogonUser for the value add, similar to the above code). A recommended workaround would be useful, especially if I could apply it without changing my public API. Thanks.