jperezduerto.info
Security in depth · Unit 22 · Lesson 34 of 44
Impersonation is scoped responsibility
Read a supplied request trace and distinguish client context from the service process identity.
Helpful before thisWindows privilege escalation
After this lesson you can
- Identify the evidence needed to verify context handling between two requests.
A service can represent a client
Client impersonation lets a server thread perform an allowed operation in an authenticated client’s security context. The process still has its own primary identity. Consequently, a process-account label does not necessarily identify the effective context used by every thread operation.
The design must establish which client is authenticated, what impersonation level is permitted, which operation is authorized, and when the intended context is restored. Local impersonation does not automatically imply permission to represent the client on every remote system; delegation is a separate concern.
Supplied document-service trace
Assume an approved design with one client-specific document check per request. These are fictional observations, not a procedure:
- Stage 1: process identity is DocumentService; client A is authenticated.
- Stage 2: the document check records A’s effective thread context and an allowed result.
- Stage 3: client B’s request begins; the trace omits effective thread context.
Stage 2 supports the stated observation for A. Stage 3 does not prove either correct restoration or a context leak. The reviewer should ask for the missing transition and operation-context evidence rather than invent an outcome. A changed username in an application message alone would not establish the operating-system context.
Specify the next acceptance evidence
Request results showing that each client-specific operation uses its intended context, that authorized work succeeds, and that the next request does not retain unintended authority from the previous one. Include error paths, because successful requests alone may omit a cleanup failure. Keep the conclusion within the observed operations; legitimate impersonation is not evidence of compromise, and one correct request does not verify the entire service.
Terms you met
Check yourself
No timer. No penalties. Read the explanation and try again whenever you like.
This lesson’s questions have changed. Your reading progress is saved; review the updated questions.
-
The trace confirms client A's context during A's document check, but records no effective context for client B's next request. What is supported?
Show the answer
Correct answer: The first scoped operation is evidenced; isolation of the next request remains unverified. A process account name alone cannot fill the missing thread-context observation.
Try it
- WriteWrite the intended context at each of the three recorded stages, identify the missing observation, and specify an acceptance result for a second client without performing any operation.