ASP.NET中模拟管理员用户提升权限

约定不等于承诺〃 2022-02-02 07:43 308阅读 0赞

在asp.net的站点中需要调用本地EXCEL的COM组件，由于NetworkService用户的权限不够，在执行Shapes.AddPicture方法（图片大于33K左右）时会长时间无响应，需要用administrator用户来启动Excel进程才行。

上网查了一些资料，发现可以利用advapi32.dll来在asp.net应用中模拟administrator用户来启动Excel的进程，这样执行Shapes.AddPicture方法就正常了。

模拟用户的代码如下：

using System.Runtime.InteropServices;
    using System.Security.Principal;
    using System.Security.Permissions;
    
    
    private const int LOGON_TYPE_INTERACTIVE = 2;
    private const int LOGON_TYPE_PROVIDER_DEFAULT = 0;
    [DllImport("advapi32.dll", CharSet = CharSet.Unicode, SetLastError = true)]
    static public extern bool LogonUser(string userName, string domain, string password, int logonType, int 
    
    logonProvider, ref IntPtr accessToken); 
    
    
    public ExcelExport(string tableName)
    {
        IntPtr accessToken = IntPtr.Zero;
        if (LogonUser("administrator", "domain", "password", LOGON_TYPE_INTERACTIVE, LOGON_TYPE_PROVIDER_DEFAULT, ref 
    
    accessToken))
        {
    
            using (WindowsIdentity identity = new WindowsIdentity(accessToken))
            {
                using (WindowsImpersonationContext context = identity.Impersonate())
                {
                    this.m_tableName = tableName;
                    if (ExcelRS == null)
                    {
                        ExcelRS = new Microsoft.Office.Interop.Excel.ApplicationClass();
                        ExcelRS.Visible = false;
                        ExcelRS.DisplayAlerts = false;
                        ExcelRS.Interactive = false;
                        ExcelRS.DisplayInfoWindow = false;
                    }
                }
            }
        }
    }