os/user: Current fails when the current thread is impersonated

[qmuntal]

Go version

go version go1.22.0 windows/amd64

Output of go env in your module/workspace:

set GO111MODULE=
set GOARCH=amd64
set GOBIN=
set GOCACHE=C:\Users\qmuntaldiaz\AppData\Local\go-build
set GOENV=C:\Users\qmuntaldiaz\AppData\Roaming\go\env
set GOEXE=.exe
set GOEXPERIMENT=
set GOFLAGS=
set GOHOSTARCH=amd64
set GOHOSTOS=windows
set GOINSECURE=
set GOMODCACHE=C:\Users\qmuntaldiaz\go\pkg\mod
set GONOPROXY=github.com/microsoft/*,dev.azure.com/*
set GONOSUMDB=github.com/microsoft/*,dev.azure.com/*
set GOOS=windows
set GOPATH=C:\Users\qmuntaldiaz\go
set GOPRIVATE=github.com/microsoft/*,dev.azure.com/*
set GOPROXY=https://proxy.golang.org,direct
set GOROOT=C:\Program Files\Go
set GOSUMDB=sum.golang.org
set GOTMPDIR=
set GOTOOLCHAIN=auto
set GOTOOLDIR=C:\Program Files\Go\pkg\tool\windows_amd64
set GOVCS=
set GOVERSION=go1.22.0
set GCCGO=gccgo
set GOAMD64=v1
set AR=ar
set CC=gcc
set CXX=g++
set CGO_ENABLED=1
set GOMOD=NUL
set GOWORK=
set CGO_CFLAGS=-O2 -g
set CGO_CPPFLAGS=
set CGO_CXXFLAGS=-O2 -g
set CGO_FFLAGS=-O2 -g
set CGO_LDFLAGS=-O2 -g
set PKG_CONFIG=pkg-config
set GOGCCFLAGS=-m64 -mthreads -Wl,--no-gc-sections -fmessage-length=0 -ffile-prefix-map=C:\Users\QMUNTA~1\AppData\Local\Temp\go-build3241524281=/tmp/go-build -gno-record-gcc-switches

What did you do?

Call user.Current() on an impersonated thread:

func main() {
	runtime.LockOSThread()
	defer runtime.UnlockOSThread()

	err := windows.ImpersonateSelf(windows.SecurityIdentification)
	if err != nil {
		panic(err)
	}
	defer windows.RevertToSelf()

	_, err = user.Current()
	if err != nil {
		panic(err)
	}
}

What did you see happen?

user.Current reports an error instead of returning the current process user. Same happens when using ImpersonateLoggedOnUser to impersonate the thread.

What did you expect to see?

user.Current should be able to return the current process user even if the thread is impersonated.

[qmuntal]

@golang/windows

[gabyhelp]

Related Issues and Documentation

• x/sys/windows: check for admin #28804 (closed)
• os/user: On windows, current() -> t.GetUserProfileDirectory() errors when for RemoteInteractive Logon session on system without user profile #37348
• os/user: user.Current() too slow on Windows #68312
• os/user: Current fails to return user #31949 (closed)
• os/user: godoc for Current does not mention caching #27659 (closed)

_{(Emoji vote if this was helpful or unhelpful; more detailed feedback welcome in this discussion.)}

[gopherbot]

Change https://go.dev/cl/602415 mentions this issue: os/user: support calling Current on impersonated threads

[gopherbot]

Change https://go.dev/cl/604395 mentions this issue: os/user: document Current improvements