Windows Impersonation: A Flaw in the Ointment

前端 未结 3 1578
悲哀的现实
悲哀的现实 2021-02-08 15:41

In my journey to master the nuances of user impersonation in Windows I first had an issue about getting impersonation to a remote database to occur at all (see this SO question)

3条回答
  •  我寻月下人不归
    2021-02-08 16:38

    Thanks to input from Harry Johnston (in comments attached to the question) and Phil Harding (in separate communication) I was able to determine that SQL Server connection pooling was the culprit here. Since pooling is determined by uniqueness of the connection string, by slightly varying the connection string (e.g. reversing order of parameters within, or even just adding a space on the end) I then observed the behaviors I expected.

    ===== TEST WITH SAME CONN STRING: True
    BEGIN impersonation
    Local user: MyDomain\msorens
    DB reports: MyDomain\testuser
    END impersonation
    Local user: MyDomain\msorens
    DB reports: MyDomain\testuser <<<<< still impersonating !!
    
    ===== TEST WITH SAME CONN STRING: False
    BEGIN impersonation
    Local user: MyDomain\msorens
    DB reports: MyDomain\testuser
    END impersonation
    Local user: MyDomain\msorens
    DB reports: MyDomain\msorens  <<<<< this is what I wanted to get
    

提交回复
热议问题