CODEWITHSUNDEEP
windowssecuritydeploymentazurecloud
sharptooth
sharptooth

Reputation: 170509

How can I have better priviledges management in Azure roles?

AFAIK when I set up my Azure roles I have only one way to specify how much priviledges the process running role code will have - by using <Runtime executionContext> XML tag.

However this looks coarse grained. If I specify "elevated" my code runs under "Local system" which is unlimited priviledges and if I specify "limited" my code runs under some low priviledges user that doesn't have priviledges my code needs.

Is there some convenient way to run Azure role code under some custom user that has limited priviledges that I myself would control?

Upvotes: 0

Views: 88

Answers (1)

dunnry
dunnry

Reputation: 6868

Right now, your code will already run as a limited user. In fact, there are no users on the VM - it is using a SID injection technique to get a security context at all. From your question, it seems like you need more than a normal user, but less than an admin?

If you really want to have different permissions, you need to create some users (use Startup tasks and net add or DirectoryServices) and set permissions. All of this is scriptable.

The more challenging part comes now to run your code as that user. For this, you need to do what is called impersonation. Your more privileged code (an admin process typically) can obtain a token for a local user and use that to impersonate a user. The code then runs as the user and is restricted. Impersonation is a well covered topic in .NET and other languages.

If you want a clever example of running code as another user, check this post by David Aiken:

http://www.davidaiken.com/2011/01/19/running-azure-startup-tasks-as-a-real-user/

Upvotes: 2

Related Questions