IIS Impersonation calling powershell thread? - powershell

Question

I am newly learning IIS, and I am trying to use IIS to host an app to impersonate an Administrative user, then execute powershell command as Admin to add users to local groups.
Within in ASP.NET code, I am running the following:
private string RunScript()
{
StringBuilder stringBuilder = new StringBuilder();
PowerShell psExec = PowerShell.Create();
psExec.AddCommand(SCRIPT_LOCATION);
psExec.AddParameter("username",Username.Text);
psExec.AddParameter("computer", Computer.Text);
psExec.AddParameter("group", Group.Text);
Collection<PSObject> results;
stringBuilder.AppendLine(System.Security.Principal.WindowsIdentity.GetCurrent().Name);
results = psExec.Invoke();
//errors = psExec.Streams.Error.ReadAll();
foreach (PSObject result in results)
{
stringBuilder.AppendLine(result.ToString());
}
return stringBuilder.ToString();
}
In my web.config, I have the following added:
<authentication mode="Windows" />
<identity impersonate="True" userName="<My admin user name>" password="<My admin password>"/>
So my GetCurrent().Name seems to return that I am at least running the application as my admin username. But when calling my powershell script:
Write-Output whoami
Returns that I am NT Authority\System.
In my IIS:
Application pool Identity is "LocalSystem"
Authentication setting has ASP.NET Impersonation (where admin user is set as Specific user) is enabled.
Windows Authentication is enabled.
So when I try to add the user to group, I get "Access is denied". Just as a sanity check, I have confirmed that if I run the powershell script separately as Admin, the add works fine.
I am sure it's something basic I am missing, but if anyone would please provide any advice or guidance, I would greatly appreciate it.
Thank you for your time.

Answer 1

As far as I know, the psExec.Invoke() method creates a thread called “Pipeline Execution Thread” and the command/script is executed in this new thread. By default the impersonation token does not flow across threads, so “Pipeline Execution Thread” doesn’t get the impersonation token of the calling thread.
You can configure ASP.Net to flow the impersonation token to newly created threads by using “alwaysFlowImpersonationPolicy” and “legacyImpersonationPolicy” configuration elements in asp.config file like this:
<runtime>
<legacyImpersonationPolicy enabled=”false”/>
<alwaysFlowImpersonationPolicy enabled=”true”/>
</runtime>
More details about how to set it, you could refer to below article:
https://weblogs.asp.net/owscott/setting-an-aspnet-config-file-per-application-pool