Here is my httpmodule that I have running before GleamTech.Web.FileTransfer.UploadHttpModule.
Imports System
Imports System.Web
Imports System.Web.Security
Imports System.Security.Principal
Imports System.Web.SessionState
Imports System.Diagnostics
Imports System.Runtime.InteropServices
Imports Microsoft.VisualBasic
Imports System.IO
Imports System.Configuration.ConfigurationManager
Public Class FixPermissions
Implements IHttpModule
Dim LOGON32_LOGON_INTERACTIVE As Integer = 2
Dim LOGON32_PROVIDER_DEFAULT As Integer = 0
Dim impersonationContext As WindowsImpersonationContext
Declare Function LogonUserA Lib "advapi32.dll" (ByVal lpszUsername As String, _
ByVal lpszDomain As String, _
ByVal lpszPassword As String, _
ByVal dwLogonType As Integer, _
ByVal dwLogonProvider As Integer, _
ByRef phToken As IntPtr) As Integer
Declare Auto Function DuplicateToken Lib "advapi32.dll" ( _
ByVal ExistingTokenHandle As IntPtr, _
ByVal ImpersonationLevel As Integer, _
ByRef DuplicateTokenHandle As IntPtr) As Integer
Declare Auto Function RevertToSelf Lib "advapi32.dll" () As Long
Declare Auto Function CloseHandle Lib "kernel32.dll" (ByVal handle As IntPtr) As Long
' In the Init function, register for HttpApplication
' events by adding your handlers.
Public Sub Init(ByVal application As HttpApplication) Implements IHttpModule.Init
AddHandler application.PostAcquireRequestState, AddressOf Me.Application_PostAcquireRequestState
AddHandler application.PostMapRequestHandler, AddressOf Me.Application_PostMapRequestHandler
AddHandler application.PreRequestHandlerExecute, AddressOf Me.LoadUser
End Sub
Public Sub Application_PostMapRequestHandler(ByVal source As Object, ByVal e As EventArgs)
Dim app As HttpApplication = CType(source, HttpApplication)
If TypeOf app.Context.Handler Is IReadOnlySessionState Or TypeOf app.Context.Handler Is IRequiresSessionState Then
'no need to replace current handler
Else
'swap current handler
app.Context.Handler = New MyHttpHandler(app.Context.Handler)
End If
'app.Response.Cookies.Add(New HttpCookie("testLogin", "works here 1"))
LoadUser(source, e)
End Sub
Public Sub Application_PostAcquireRequestState(ByVal source As Object, ByVal e As EventArgs)
Dim app As HttpApplication = CType(source, HttpApplication)
Dim resourceHttpHandler As New MyHttpHandler(HttpContext.Current.Handler) ' = CType(HttpContext.Current.Handler, MyHttpHandler)
Dim context As HttpContext = app.Context
If Not (resourceHttpHandler Is Nothing) Then
'set the original handler back
HttpContext.Current.Handler = resourceHttpHandler.OriginalHandler
End If
'session state should be availalbe now
'Debug.Assert(Not (app.Session Is Nothing), "it did not work")
'context.Response.Write("<h1>This is a test </h1>")
End Sub
Public Sub LoadUser(ByVal source As Object, ByVal e As EventArgs)
Dim app As HttpApplication = CType(source, HttpApplication)
Dim context As HttpContext = app.Context
'Dim session As HttpSessionState = context.Session
Dim cookie As HttpCookie
Dim sr As StreamReader
Dim sID As String
Dim TDES As cTripleDES
Dim mKEY(23) As Byte
Dim mIV(7) As Byte
Dim sKeys() As String
Dim sVectors() As String
Dim sAuth() As String
Dim temp As String
'cookie = New HttpCookie("testLogin", "Works here 2 ")
'cookie.Expires = DateTime.Now.AddMinutes("5")
'app.Response.Cookies.Add(cookie)
' If File.Exists(app.Server.MapPath(Path.Combine("junk", sID & ".txt"))) Then
'read and decrypt file
'sKeys = Split(AppSettings("encKey").ToString, ",")
'For i As Integer = 0 To 23
' mKEY(i) = sKeys(i)
'Next
'sKeys = Nothing
'sVectors = Split(AppSettings("vector").ToString, ",")
'For i As Integer = 0 To 7
' mIV(i) = sVectors(i)
'Next
'sVectors = Nothing
'TDES = New cTripleDES(mKEY, mIV)
'sr = New StreamReader(app.Server.MapPath(Path.Combine("junk", sID & ".txt")))
'temp = sr.ReadToEnd
'If Not (app.Response.Cookies("username").Value Is Nothing) And Not (app.Response.Cookies("password").Value Is Nothing) Then
If Not String.IsNullOrEmpty(app.Context.Request.QueryString("id")) Then
sID = app.Context.Request.QueryString("id")
sAuth = Split(sID, "||")
'sr.Close()
'file decrypted, delete file
'File.Delete(app.Server.MapPath(Path.Combine("junk", sID & ".txt")))
If impersonateValidUser(sAuth(0), "RWC_NET", sAuth(1)) Then
'Insert your code that runs under the security context of a specific user here.
'undoImpersonation()
'context.Response.Cookies.Remove("username")
'context.Response.Cookies.Remove("password")
cookie = New HttpCookie("testLogin", "Works here 2 || " & app.Context.Request.QueryString("id"))
cookie.Expires = DateTime.Now.AddMinutes("5")
app.Response.Cookies.Add(cookie)
'context.Response.Cookies.Add(cookie)
Else
cookie = New HttpCookie("testLogin", "works here 5 ~" & sAuth(0) & "||" & sAuth(1))
cookie.Expires = DateTime.Now.AddMinutes("5")
app.Response.Cookies.Add(cookie)
'AccessDenied(app)
'Your impersonation failed. Therefore, include a fail-safe mechanism here.
'cookie = New HttpCookie("testLogin", "failed")
'cookie.Expires = DateTime.Now.AddMinutes("5")
'app.Response.Cookies.Add(cookie)
'context.Response.Cookies.Add(cookie)
End If
' Else
''guid file doesn't exist, redirect back to login or access denied
'AccessDenied(app)
' End If
End If
End Sub
Public Sub Dispose() Implements IHttpModule.Dispose
End Sub
Public Function impersonateValidUser(ByVal userName As String, ByVal domain As String, ByVal password As String) As Boolean
Dim tempWindowsIdentity As WindowsIdentity
Dim token As IntPtr = IntPtr.Zero
Dim tokenDuplicate As IntPtr = IntPtr.Zero
impersonateValidUser = False
If RevertToSelf() Then
If LogonUserA(userName, domain, password, LOGON32_LOGON_INTERACTIVE, LOGON32_PROVIDER_DEFAULT, token) <> 0 Then
If DuplicateToken(token, 2, tokenDuplicate) <> 0 Then
tempWindowsIdentity = New WindowsIdentity(tokenDuplicate)
impersonationContext = tempWindowsIdentity.Impersonate()
If Not impersonationContext Is Nothing Then
impersonateValidUser = True
End If
End If
End If
End If
If Not tokenDuplicate.Equals(IntPtr.Zero) Then
CloseHandle(tokenDuplicate)
End If
If Not token.Equals(IntPtr.Zero) Then
CloseHandle(token)
End If
End Function
Private Sub undoImpersonation()
impersonationContext.Undo()
End Sub
Private Sub AccessDenied(ByVal app As HttpApplication)
'http://blogs.x2line.com/al/articles/146.aspx
app.Response.StatusCode = 401
app.Response.StatusDescription = "Access Denied"
app.Response.Write("<html><head></head><body>401 Access Denied <br /> <br /> <a href=""default.aspx"">click here to login</a></body></html>")
app.CompleteRequest()
End Sub
Public Class MyHttpHandler
'Implements IRequiresSessionState
Implements IHttpHandler
Friend ReadOnly OriginalHandler As IHttpHandler
Public Sub New(ByVal origHandler As IHttpHandler)
Me.OriginalHandler = origHandler
End Sub
Public Sub ProcessRequest(ByVal context As HttpContext) Implements System.Web.IHttpHandler.ProcessRequest
Throw New InvalidOperationException("MyHttpHandler cannot process requests.")
End Sub
Public ReadOnly Property IsReusable() As Boolean Implements System.Web.IHttpHandler.IsReusable
Get
Return False
End Get
End Property
End Class
End Class
The only way that I have gotten this work is if in the sub "LoadUser" I hard code the username and password. For example: sID = "username||password". When I do that it works. If I try reading from a file, reading a cookie, or getting the posted value it doesn't work. However, I find it funny that in the case of reading from a file or posted value I can create a cookie called "testLogin", set its value to the passed in username and password, write it out on the receiving asp.net page and see that it has the correct values.