impersonation

[Tamer_Ahmed]

i heard this word in alot of security topics impersonation but i don't know what it does mean

[jspencer]

Pretending to be someone else. For example, the asp.net user account doesn't have any rights on the server, so you pretend to be the local administrator instead.

 

You can have a look at this for more information:

http://msdn.microsoft.com/library/default.asp?url=/library/en-us/cpguide/html/cpconaspnetimpersonation.asp

[Arch4ngel]

good link.

 

For the lazy... here is a resume (that means you really shall look at the link if your mind is scrambled) :

 

Impersonation is used in ASP.NET app to use another account to do some task. As an exemple of that... If you use ASPNET account... ASPNET won't be able to start any COM object because it don't have the "rights" to do that. You'll have to manually configure your server EVERYWHERE to give the correct right (believe me it's not an easy work). But if you use Impersonate... you create a local user account and you say to ASPNET to use this account to do ALL the task on the server.

 

This give you many plus :

• Every application have their "own" rights if they all use Impersonate. Otherwise... they have an access to everywhere anyway (plus and con if you can catch what are the consequence)
  
• Don't have to reconfigure your server for ASPNET to have the right access everywhere
  

Well... that's the end of my speach... if you want to know more... follow the link of jspencer.

 

If someone knows more pro and cons... don't be shy to say them. It's always good to have an all-around opinion of a function.