使用用户名和密码在 C# 中启动进程会引发“拒绝访问”异常
声明：本页面是StackOverFlow热门问题的中英对照翻译，遵循CC BY-SA 4.0协议，如果您需要使用它，必须同样遵循CC BY-SA许可，注明原文地址和作者信息，同时你必须将它归于原作者（不是我）：StackOverFlow
原文地址: http://stackoverflow.com/questions/121676/
Warning: these are provided under cc-by-sa 4.0 license. You are free to use/share it, But you must attribute it to the original authors (not me):
StackOverFlow
Starting a process in C# with username & password throws "Access is Denied" exception
提问by
Inside a .NET 3.5 web app running impersonation I am trying to execute a process via:
在运行模拟的 .NET 3.5 Web 应用程序中，我试图通过以下方式执行进程：
var process = new Process
{ StartInfo =
{ CreateNoWindow = true,
FileName = "someFileName",
Domain = "someDomain",
Username = "someUserName",
Password = securePassword,
UseShellExecute = false
}
};
process.Start();
-Changing the trust mode to full in web.config did not fix.
- 在 web.config 中将信任模式更改为完全没有修复。
-Note the var securePassword is a secureString set up earlier in the code.
- 请注意 var securePassword 是之前在代码中设置的 secureString。
This throws an exception with 'Access is Denied' as its message. If I remove the username and password information, the exception goes away, but the process starts as aspnet_wp instead of the user I need it to.
这会引发一个异常，并带有“拒绝访问”作为其消息。如果我删除了用户名和密码信息，异常就会消失，但该进程以 aspnet_wp 而不是我需要的用户身份开始。
I've seen this issue in multiple forums and never seen a solution provided. Any ideas?
我在多个论坛中看到过这个问题，但从未见过提供的解决方案。有任何想法吗？
回答by Charles Graham
I ran into the same problem that you did on a project. There shouldbe a way to spawn a process out of your web app with given credentials, but in practice, it's a kludge at best. What I wound up finally doing was just having the app push information to an MSMQ and having a windows service that popped items of the Queue an serviced the requests.
我遇到了你在项目中遇到的同样问题。这里应该是产卵的过程不与给定的凭据你的web应用程序的一种方式，但在实践中，这是一个杂牌组装电脑的最好的。我最终做的只是让应用程序将信息推送到 MSMQ 并拥有一个 Windows 服务，该服务弹出队列的项目并为请求提供服务。
Even when you appliation is impersonating, it still wants to run under theaspnet user account.
即使您的应用程序正在模拟，它仍然希望在 aspnet 用户帐户下运行。
回答by Mike L
You can use ProcessStartInfo which allows you to specify credentials. The trick is that the password is a secure string, so you have to pass it as a byte array.
您可以使用 ProcessStartInfo，它允许您指定凭据。诀窍是密码是一个安全字符串，因此您必须将其作为字节数组传递。
The code might look something like:
代码可能类似于：
Dim startInfo As New ProcessStartInfo(programName)
With startInfo
.Domain = "test.local"
.WorkingDirectory = My.Application.Info.DirectoryPath
.UserName = "testuser"
Dim pwd As New Security.SecureString
For Each c As Char In "password"
pwd.AppendChar(c)
Next
.Password = pwd
'If you provide a value for the Password property, the UseShellExecute property must be false, or an InvalidOperationException will be thrown when the Process..::.Start(ProcessStartInfo) method is called.
.UseShellExecute = False
.WindowStyle = ProcessWindowStyle.Hidden
End With
回答by Adrian Clark
Check the Code Access Securitylevel as Processrequires Full Trust. Your web application may be running in a partial trust setting.
根据流程要求检查代码访问安全级别。您的 Web 应用程序可能在部分信任设置中运行。Full Trust
From the Process MSDN page:
从进程 MSDN 页面：
Permissions
* LinkDemand
for full trust for the immediate caller. This class cannot be used by partially trusted code.
* InheritanceDemand
for full trust for inheritors. This class cannot be inherited by partially trusted code.
权限
* LinkDemand
为直接呼叫者提供完全信任。此类不能由部分受信任的代码使用。
* InheritanceDemand
对继承人的完全信任。此类不能由部分受信任的代码继承。
回答by Adrian Clark
I wanted to mention that I have tried the code at this siteincluding the updated code mentioned in the comments. This code runs the process as the impersonated identity (which is really all I need), but the redirecting of the standard error fails -- so this link could be useful to those not concerned with dealing with the stderr.
我想提一下，我已经在这个站点上尝试过代码， 包括评论中提到的更新代码。这段代码将进程作为模拟身份运行（这正是我所需要的），但是标准错误的重定向失败了——所以这个链接对于那些不关心处理 stderr 的人可能很有用。
回答by Brian ONeil
Not sure if this is it, but I had a related problem and the answer was that the account didn't have permission to impersonate on the machine. This can be changed by adding the account to the Policy "Impersonate a client after authentication" using the local policy manager on the machine.
不确定是不是这样，但我遇到了一个相关问题，答案是该帐户无权在机器上模拟。这可以通过使用机器上的本地策略管理器将帐户添加到策略“身份验证后模拟客户端”来更改。
回答by Brian ONeil
I went a different way and put the whole application in its own app-pool running as the user we were originally impersonating. Now, when asp.net spawns a new process, it spawns under the context of the user instead of aspnet_wp. Not the exact solution to the problem I posted, but it worked for our situation.
我采用了不同的方式，将整个应用程序放在自己的应用程序池中，以我们最初模拟的用户身份运行。现在，当 asp.net 生成一个新进程时，它会在用户上下文而不是 aspnet_wp 下生成。不是我发布的问题的确切解决方案，但它适用于我们的情况。
