Accessing a Shared File UNC From a Remote Non-Trusted Domain With Credentials

Question

We ve run into an interesting situation that needs solving  and my searches have turned up nill  I therefore appeal to the SO community for help   The issue is this  we have a need to programmatically access a shared file that is not in our domain  and is not within a trusted external domain via remote file sharing   UNC  Naturally  we need to supply credentials to the remote machine   Typically  one solves this problem in one of two ways     Map the file share as a drive and supply the credentials at that time  This is typically done using the NET USE command or the Win32 functions that duplicate NET USE   Access the file with a UNC path as if the remote computer were on the domain and ensure that the account under which the program runs is duplicated  including password  on the remote machine as a local user  Basically leverage the fact that Windows will automatically supply the current user s credentials when the user attempts to access a shared file   Don t use remote file sharing  Use FTP  or some other means  to transfer the file  work on it locally  then transfer it back     For various and sundry reasons  our security   network architects have rejected the first two approaches  The second approach is obviously a security hole  if the remote computer is compromised  the local computer is now at risk  The first approach is unsatisfactory because the newly mounted drive is a shared resource available to other programs on the local computer during file access by the program  Even though it s quite possible to make this temporary  it s still a hole in their opinion   They re open to the third option  but the remote network admins insist on SFTP rather than FTPS  and FtpWebRequest only supports FTPS  SFTP is the more firewall-friendly option and there are a couple libraries I could use for that approach  but I d prefer to reduce my dependencies if I can    I ve searched MSDN for either a managed or a win32 means of using remote file sharing  but I have failed to come up with anything useful    And so I ask  Is there another way  Did I miss a super-secret win32 function that does what I want  Or must I pursue some variant of option 3

User · Answer

Most SFTP servers support SCP as well which can be a lot easier to find libraries for. You could even just call an existing client from your code like pscp included with PuTTY.

If the type of file you're working with is something simple like a text or XML file, you could even go so far as to write your own client/server implementation to manipulate the file using something like .NET Remoting or web services.

User · Answer

While I don t know myself  I would certainly hope that  2 is incorrect   I d like to think that Windows isn t going to AUTOMATICALLY give out my login information  least of all my password   to any machine  let alone one that isn t part of my trust   Regardless  have you explored the impersonation architecture  Your code is going to look similar to this   using  System Security Principal WindowsImpersonationContext context   System Security Principal WindowsIdentity Impersonate token            Do network operations here      context Undo        In this case  the token variable is an IntPtr  In order to get a value for this variable  you ll have to call the unmanaged LogonUser Windows API function  A quick trip to pinvoke net gives us the following signature    System Runtime InteropServices DllImport  advapi32 dll   SetLastError   true   public static extern bool LogonUser      string lpszUsername      string lpszDomain      string lpszPassword      int dwLogonType      int dwLogonProvider      out IntPtr phToken      Username  domain  and password should seem fairly obvious  Have a look at the various values that can be passed to dwLogonType and dwLogonProvider to determine the one that best suits your needs   This code hasn t been tested  as I don t have a second domain here where I can verify  but this should hopefully put you on the right track

User · Answer

The way to solve your problem is to use a Win32 API called WNetUseConnection  Use this function to connect to a UNC path with authentication  NOT to map a drive   This will allow you to connect to a remote machine  even if it is not on the same domain  and even if it has a different username and password    Once you have used WNetUseConnection you will be able to access the file via a UNC path as if you were on the same domain   The best way is probably through the administrative built in shares  Example    computername c  program files Folder file txt  Here is some sample C  code that uses WNetUseConnection  Note  for the NetResource  you should pass null for the lpLocalName and lpProvider   The dwType should be RESOURCETYPE DISK   The lpRemoteName should be   ComputerName   using System  using System Runtime InteropServices   using System Threading   namespace ExtremeMirror       public class PinvokeWindowsNetworking                region Consts         const int RESOURCE CONNECTED   0x00000001          const int RESOURCE GLOBALNET   0x00000002          const int RESOURCE REMEMBERED   0x00000003           const int RESOURCETYPE ANY   0x00000000          const int RESOURCETYPE DISK   0x00000001          const int RESOURCETYPE PRINT   0x00000002           const int RESOURCEDISPLAYTYPE GENERIC   0x00000000          const int RESOURCEDISPLAYTYPE DOMAIN   0x00000001          const int RESOURCEDISPLAYTYPE SERVER   0x00000002          const int RESOURCEDISPLAYTYPE SHARE   0x00000003          const int RESOURCEDISPLAYTYPE FILE   0x00000004          const int RESOURCEDISPLAYTYPE GROUP   0x00000005           const int RESOURCEUSAGE CONNECTABLE   0x00000001          const int RESOURCEUSAGE CONTAINER   0x00000002            const int CONNECT INTERACTIVE   0x00000008          const int CONNECT PROMPT   0x00000010          const int CONNECT REDIRECT   0x00000080          const int CONNECT UPDATE PROFILE   0x00000001          const int CONNECT COMMANDLINE   0x00000800          const int CONNECT CMD SAVECRED   0x00001000           const int CONNECT LOCALDRIVE   0x00000100           endregion           region Errors         const int NO ERROR   0           const int ERROR ACCESS DENIED   5          const int ERROR ALREADY ASSIGNED   85          const int ERROR BAD DEVICE   1200          const int ERROR BAD NET NAME   67          const int ERROR BAD PROVIDER   1204          const int ERROR CANCELLED   1223          const int ERROR EXTENDED ERROR   1208          const int ERROR INVALID ADDRESS   487          const int ERROR INVALID PARAMETER   87          const int ERROR INVALID PASSWORD   1216          const int ERROR MORE DATA   234          const int ERROR NO MORE ITEMS   259          const int ERROR NO NET OR BAD PATH   1203          const int ERROR NO NETWORK   1222           const int ERROR BAD PROFILE   1206          const int ERROR CANNOT OPEN PROFILE   1205          const int ERROR DEVICE IN USE   2404          const int ERROR NOT CONNECTED   2250          const int ERROR OPEN FILES    2401           private struct ErrorClass                        public int num              public string message              public ErrorClass int num  string message                                 this num   num                  this message   message                                       Created with excel formula               new ErrorClass   amp A1 amp        amp PROPER SUBSTITUTE MID A1 7 LEN A1 -6              amp                 private static ErrorClass   ERROR LIST   new ErrorClass                 new ErrorClass ERROR ACCESS DENIED   Error  Access Denied                 new ErrorClass ERROR ALREADY ASSIGNED   Error  Already Assigned                 new ErrorClass ERROR BAD DEVICE   Error  Bad Device                 new ErrorClass ERROR BAD NET NAME   Error  Bad Net Name                 new ErrorClass ERROR BAD PROVIDER   Error  Bad Provider                 new ErrorClass ERROR CANCELLED   Error  Cancelled                 new ErrorClass ERROR EXTENDED ERROR   Error  Extended Error                 new ErrorClass ERROR INVALID ADDRESS   Error  Invalid Address                 new ErrorClass ERROR INVALID PARAMETER   Error  Invalid Parameter                 new ErrorClass ERROR INVALID PASSWORD   Error  Invalid Password                 new ErrorClass ERROR MORE DATA   Error  More Data                 new ErrorClass ERROR NO MORE ITEMS   Error  No More Items                 new ErrorClass ERROR NO NET OR BAD PATH   Error  No Net Or Bad Path                 new ErrorClass ERROR NO NETWORK   Error  No Network                 new ErrorClass ERROR BAD PROFILE   Error  Bad Profile                 new ErrorClass ERROR CANNOT OPEN PROFILE   Error  Cannot Open Profile                 new ErrorClass ERROR DEVICE IN USE   Error  Device In Use                 new ErrorClass ERROR EXTENDED ERROR   Error  Extended Error                 new ErrorClass ERROR NOT CONNECTED   Error  Not Connected                 new ErrorClass ERROR OPEN FILES   Error  Open Files                         private static string getErrorForNumber int errNum                         foreach  ErrorClass er in ERROR LIST                                 if  er num    errNum  return er message                            return  Error  Unknown      errNum                     endregion           DllImport  Mpr dll    private static extern int WNetUseConnection              IntPtr hwndOwner              NETRESOURCE lpNetResource              string lpPassword              string lpUserID              int dwFlags              string lpAccessName              string lpBufferSize              string lpResult                      DllImport  Mpr dll    private static extern int WNetCancelConnection2              string lpName              int dwFlags              bool fForce                      StructLayout LayoutKind Sequential   private class NETRESOURCE                        public int dwScope   0              public int dwType   0              public int dwDisplayType   0              public int dwUsage   0              public string lpLocalName                   public string lpRemoteName                   public string lpComment                   public string lpProvider                           public static string connectToRemote string remoteUNC  string username  string password                         return connectToRemote remoteUNC  username  password  false                      public static string connectToRemote string remoteUNC  string username  string password  bool promptUser                         NETRESOURCE nr   new NETRESOURCE                nr dwType   RESOURCETYPE DISK              nr lpRemoteName   remoteUNC                          nr lpLocalName    F                 int ret              if  promptUser                   ret   WNetUseConnection IntPtr Zero  nr          CONNECT INTERACTIVE   CONNECT PROMPT  null  null  null               else                  ret   WNetUseConnection IntPtr Zero  nr  password  username  0  null  null  null                if  ret    NO ERROR  return null              return getErrorForNumber ret                      public static string disconnectRemote string remoteUNC                         int ret   WNetCancelConnection2 remoteUNC  CONNECT UPDATE PROFILE  false               if  ret    NO ERROR  return null              return getErrorForNumber ret

User · Answer

im attach my vb net code based on brian reference  Imports System ComponentModel  Imports System Runtime InteropServices  Public Class PinvokeWindowsNetworking  Const NO ERROR As Integer   0    Private Structure ErrorClass      Public num As Integer      Public message As String        Public Sub New ByVal num As Integer  ByVal message As String           Me num   num          Me message   message      End Sub  End Structure    Private Shared ERROR LIST As ErrorClass     New ErrorClass          New ErrorClass 5   Error  Access Denied         New ErrorClass 85   Error  Already Assigned         New ErrorClass 1200   Error  Bad Device         New ErrorClass 67   Error  Bad Net Name         New ErrorClass 1204   Error  Bad Provider         New ErrorClass 1223   Error  Cancelled         New ErrorClass 1208   Error  Extended Error         New ErrorClass 487   Error  Invalid Address         New ErrorClass 87   Error  Invalid Parameter         New ErrorClass 1216   Error  Invalid Password         New ErrorClass 234   Error  More Data         New ErrorClass 259   Error  No More Items         New ErrorClass 1203   Error  No Net Or Bad Path         New ErrorClass 1222   Error  No Network         New ErrorClass 1206   Error  Bad Profile         New ErrorClass 1205   Error  Cannot Open Profile         New ErrorClass 2404   Error  Device In Use         New ErrorClass 2250   Error  Not Connected         New ErrorClass 2401   Error  Open Files       Private Shared Function getErrorForNumber ByVal errNum As Integer  As String      For Each er As ErrorClass In ERROR LIST          If er num   errNum Then Return er message      Next        Try          Throw New Win32Exception errNum       Catch ex As Exception          Return  Error  Unknown     amp  errNum  amp       amp  ex Message      End Try        Return  Error  Unknown     amp  errNum  End Function     lt DllImport  Mpr dll   gt   Private Shared Function WNetUseConnection ByVal hwndOwner As IntPtr  ByVal lpNetResource As NETRESOURCE  ByVal lpPassword As String  ByVal lpUserID As String  ByVal dwFlags As Integer  ByVal lpAccessName As String  ByVal lpBufferSize As String  ByVal lpResult As String  As Integer  End Function     lt DllImport  Mpr dll   gt   Private Shared Function WNetCancelConnection2 ByVal lpName As String  ByVal dwFlags As Integer  ByVal fForce As Boolean  As Integer  End Function     lt StructLayout LayoutKind Sequential  gt   Private Class NETRESOURCE      Public dwScope As Integer   0      Public dwType As Integer   0      Public dwDisplayType As Integer   0      Public dwUsage As Integer   0      Public lpLocalName As String           Public lpRemoteName As String           Public lpComment As String           Public lpProvider As String       End Class    Public Shared Function connectToRemote ByVal remoteUNC As String  ByVal username As String  ByVal password As String  As String      Return connectToRemote remoteUNC  username  password  False   End Function    Public Shared Function connectToRemote ByVal remoteUNC As String  ByVal username As String  ByVal password As String  ByVal promptUser As Boolean  As String      Dim nr As NETRESOURCE   New NETRESOURCE        nr dwType   ResourceTypes Disk      nr lpRemoteName   remoteUNC      Dim ret As Integer        If promptUser Then          ret   WNetUseConnection IntPtr Zero  nr          Connects Interactive Or Connects Prompt  Nothing  Nothing  Nothing       Else          ret   WNetUseConnection IntPtr Zero  nr  password  username  0  Nothing  Nothing  Nothing       End If        If ret   NO ERROR Then Return Nothing      Return getErrorForNumber ret   End Function    Public Shared Function disconnectRemote ByVal remoteUNC As String  As String      Dim ret As Integer   WNetCancelConnection2 remoteUNC  Connects UpdateProfile  False       If ret   NO ERROR Then Return Nothing      Return getErrorForNumber ret   End Function   Enum Resources As Integer      Connected    amp H1      GlobalNet    amp H2      Remembered    amp H3  End Enum   Enum ResourceTypes As Integer      Any    amp H0      Disk    amp H1      Print    amp H2  End Enum   Enum ResourceDisplayTypes As Integer      Generic    amp H0      Domain    amp H1      Server    amp H2      Share    amp H3      File    amp H4      Group    amp H5  End Enum   Enum ResourceUsages As Integer      Connectable    amp H1      Container    amp H2  End Enum   Enum Connects As Integer      Interactive    amp H8      Prompt    amp H10      Redirect    amp H80      UpdateProfile    amp H1      CommandLine    amp H800      CmdSaveCred    amp H1000      LocalDrive    amp H100  End Enum   End Class   how to use it  Dim login   PinvokeWindowsNetworking connectToRemote    ComputerName    ComputerName UserName    Password        If IsNothing login  Then             do your thing on the shared folder           PinvokeWindowsNetworking disconnectRemote    ComputerName        End If

User · Answer

Rather than WNetUseConnection  I would recommend NetUseAdd  WNetUseConnection is a legacy function that s been superceded by WNetUseConnection2 and WNetUseConnection3  but all of those functions create a network device that s visible in Windows Explorer  NetUseAdd is the equivalent of calling net use in a DOS prompt to authenticate on a remote computer   If you call NetUseAdd then subsequent attempts to access the directory should succeed

User · Answer

For people looking for a quick solution  you can use the NetworkShareAccesser I wrote recently  based on this answer  thanks so much      Usage   using  NetworkShareAccesser Access REMOTE COMPUTER NAME  DOMAIN  USER NAME  PASSWORD         File Copy   C  Some File To copy txt       REMOTE-COMPUTER My Shared Target file txt        WARNING  Please make absolutely sure  that Dispose of the NetworkShareAccesser is called  even if you app crashes    otherwise an open connection will remain on Windows  You can see all open connections by opening the cmd prompt and enter net use   The Code        lt summary gt      Provides access to a network share       lt  summary gt  public class NetworkShareAccesser   IDisposable       private string  remoteUncName      private string  remoteComputerName       public string RemoteComputerName               get                       return this  remoteComputerName                    set                       this  remoteComputerName   value              this  remoteUncName           this  remoteComputerName                       public string UserName               get          set            public string Password               get          set              region Consts      private const int RESOURCE CONNECTED   0x00000001      private const int RESOURCE GLOBALNET   0x00000002      private const int RESOURCE REMEMBERED   0x00000003       private const int RESOURCETYPE ANY   0x00000000      private const int RESOURCETYPE DISK   0x00000001      private const int RESOURCETYPE PRINT   0x00000002       private const int RESOURCEDISPLAYTYPE GENERIC   0x00000000      private const int RESOURCEDISPLAYTYPE DOMAIN   0x00000001      private const int RESOURCEDISPLAYTYPE SERVER   0x00000002      private const int RESOURCEDISPLAYTYPE SHARE   0x00000003      private const int RESOURCEDISPLAYTYPE FILE   0x00000004      private const int RESOURCEDISPLAYTYPE GROUP   0x00000005       private const int RESOURCEUSAGE CONNECTABLE   0x00000001      private const int RESOURCEUSAGE CONTAINER   0x00000002        private const int CONNECT INTERACTIVE   0x00000008      private const int CONNECT PROMPT   0x00000010      private const int CONNECT REDIRECT   0x00000080      private const int CONNECT UPDATE PROFILE   0x00000001      private const int CONNECT COMMANDLINE   0x00000800      private const int CONNECT CMD SAVECRED   0x00001000       private const int CONNECT LOCALDRIVE   0x00000100        endregion       region Errors      private const int NO ERROR   0       private const int ERROR ACCESS DENIED   5      private const int ERROR ALREADY ASSIGNED   85      private const int ERROR BAD DEVICE   1200      private const int ERROR BAD NET NAME   67      private const int ERROR BAD PROVIDER   1204      private const int ERROR CANCELLED   1223      private const int ERROR EXTENDED ERROR   1208      private const int ERROR INVALID ADDRESS   487      private const int ERROR INVALID PARAMETER   87      private const int ERROR INVALID PASSWORD   1216      private const int ERROR MORE DATA   234      private const int ERROR NO MORE ITEMS   259      private const int ERROR NO NET OR BAD PATH   1203      private const int ERROR NO NETWORK   1222       private const int ERROR BAD PROFILE   1206      private const int ERROR CANNOT OPEN PROFILE   1205      private const int ERROR DEVICE IN USE   2404      private const int ERROR NOT CONNECTED   2250      private const int ERROR OPEN FILES   2401        endregion       region PInvoke Signatures       DllImport  Mpr dll        private static extern int WNetUseConnection          IntPtr hwndOwner          NETRESOURCE lpNetResource          string lpPassword          string lpUserID          int dwFlags          string lpAccessName          string lpBufferSize          string lpResult                  DllImport  Mpr dll        private static extern int WNetCancelConnection2          string lpName          int dwFlags          bool fForce                  StructLayout LayoutKind Sequential       private class NETRESOURCE               public int dwScope   0          public int dwType   0          public int dwDisplayType   0          public int dwUsage   0          public string lpLocalName               public string lpRemoteName               public string lpComment               public string lpProvider                   endregion           lt summary gt          Creates a NetworkShareAccesser for the given computer name  The user will be promted to enter credentials          lt  summary gt           lt param name  remoteComputerName  gt  lt  param gt           lt returns gt  lt  returns gt      public static NetworkShareAccesser Access string remoteComputerName                return new NetworkShareAccesser remoteComputerName                   lt summary gt          Creates a NetworkShareAccesser for the given computer name using the given domain computer name  username and password          lt  summary gt           lt param name  remoteComputerName  gt  lt  param gt           lt param name  domainOrComuterName  gt  lt  param gt           lt param name  userName  gt  lt  param gt           lt param name  password  gt  lt  param gt      public static NetworkShareAccesser Access string remoteComputerName  string domainOrComuterName  string userName  string password                return new NetworkShareAccesser remoteComputerName                                          domainOrComuterName          userName                                          password                   lt summary gt          Creates a NetworkShareAccesser for the given computer name using the given username  format  domainOrComputername Username  and password          lt  summary gt           lt param name  remoteComputerName  gt  lt  param gt           lt param name  userName  gt  lt  param gt           lt param name  password  gt  lt  param gt      public static NetworkShareAccesser Access string remoteComputerName  string userName  string password                return new NetworkShareAccesser remoteComputerName                                           userName                                          password              private NetworkShareAccesser string remoteComputerName                RemoteComputerName   remoteComputerName                          this ConnectToShare this  remoteUncName  null  null  true              private NetworkShareAccesser string remoteComputerName  string userName  string password                RemoteComputerName   remoteComputerName          UserName   userName          Password   password           this ConnectToShare this  remoteUncName  this UserName  this Password  false              private void ConnectToShare string remoteUnc  string username  string password  bool promptUser                NETRESOURCE nr   new NETRESOURCE                       dwType   RESOURCETYPE DISK              lpRemoteName   remoteUnc                     int result          if  promptUser                        result   WNetUseConnection IntPtr Zero  nr          CONNECT INTERACTIVE   CONNECT PROMPT  null  null  null                     else                       result   WNetUseConnection IntPtr Zero  nr  password  username  0  null  null  null                      if  result    NO ERROR                        throw new Win32Exception result                        private void DisconnectFromShare string remoteUnc                int result   WNetCancelConnection2 remoteUnc  CONNECT UPDATE PROFILE  false           if  result    NO ERROR                        throw new Win32Exception result                             lt summary gt          Performs application-defined tasks associated with freeing  releasing  or resetting unmanaged resources           lt  summary gt           lt filterpriority gt 2 lt  filterpriority gt      public void Dispose                 this DisconnectFromShare this  remoteUncName

User · Answer

AFAIK  you don t need to map the UNC path to a drive letter in order to establish credentials for a server  I regularly used batch scripts like   net use   myserver  user username password     do something with   myserver the file i want xml  net use  delete   my server com   However  any program running on the same account as your program would still be able to access everything that username password has access to  A possible solution could be to isolate your program in its own local user account  the UNC access is local to the account that called NET USE    Note  Using SMB accross domains is not quite a good use of the technology  IMO  If security is that important  the fact that SMB lacks encryption is a bit of a damper all by itself

User · Answer

I looked to MS to find the answers  The first solution assumes the user account running the application process has access to the shared folder or drive  Same domain   Make sure your DNS is resolved or try using IP address  Simply do the following    DirectoryInfo di   new DirectoryInfo PATH    var files   di EnumerateFiles        SearchOption AllDirectories     If you want across different domains  NET 2 0 with credentials follow this model   WebRequest req   FileWebRequest Create new Uri      lt server Name gt  Dir test txt              req Credentials   new NetworkCredential    lt Domain gt   lt User gt      lt Password gt             req PreAuthenticate   true           WebResponse d   req GetResponse            FileStream fs   File Create  test txt                here you can check that the cast was successful if you want           fs   d GetResponseStream   as FileStream          fs Close

User · Answer

Here a minimal POC class w  all the cruft removed  using System  using System ComponentModel  using System Runtime InteropServices   public class UncShareWithCredentials   IDisposable       private string  uncShare       public UncShareWithCredentials string uncShare  string userName  string password                var nr   new Native NETRESOURCE                       dwType   Native RESOURCETYPE DISK              lpRemoteName   uncShare                     int result   Native WNetUseConnection IntPtr Zero  nr  password  userName  0  null  null  null           if  result    Native NO ERROR                        throw new Win32Exception result                      uncShare   uncShare             public void Dispose                 if   string IsNullOrEmpty  uncShare                         Native WNetCancelConnection2  uncShare  Native CONNECT UPDATE PROFILE  false                uncShare   null                       private class Native               public const int RESOURCETYPE DISK   0x00000001          public const int CONNECT UPDATE PROFILE   0x00000001          public const int NO ERROR   0            DllImport  mpr dll            public static extern int WNetUseConnection IntPtr hwndOwner  NETRESOURCE lpNetResource  string lpPassword  string lpUserID              int dwFlags  string lpAccessName  string lpBufferSize  string lpResult             DllImport  mpr dll            public static extern int WNetCancelConnection2 string lpName  int dwFlags  bool fForce             StructLayout LayoutKind Sequential           public class NETRESOURCE                       public int dwScope              public int dwType              public int dwDisplayType              public int dwUsage              public string lpLocalName              public string lpRemoteName              public string lpComment              public string lpProvider                      You can directly use   server share folder w  WNetUseConnection  no need to strip it to   server part only beforehand

[c#] Accessing a Shared File (UNC) From a Remote, Non-Trusted Domain With Credentials

Examples related to c#

Examples related to windows

Examples related to unc

[c#] Accessing a Shared File (UNC) From a Remote, Non-Trusted Domain With Credentials

Examples related to c#

Examples related to windows

Examples related to unc

Examples related to file-sharing