IServerSecurity::ImpersonateClient

A version of this page is also available for

Windows Embedded CE 6.0 R3

4/8/2010

This method allows a server to impersonate a client for the duration of a call.

Syntax

HRESULT ImpersonateClient( )

Parameters

None.

Return Value

This method supports the standard return value E_FAIL, as well as the following:

• S_OK
  Success.

Remarks

IServerSecurity::ImpersonateClient allows a server to impersonate a client for the duration of a call.

Typically, a method executes on a thread that uses the access token of the process. However, when impersonating a client, the server runs in the client's security context so that the server has access to the resources that the client has access to.

When impersonation is necessary, the server calls the ImpersonateClient method to cause an access token representing the client's credentials to be assigned to the current thread. This thread token is used for access checks. RevertToSelf restores the current thread's access token.

What the server can do on behalf of the client depends on the impersonation level set by the client, which is specified using one of the RPC_C_IMP_LEVEL_XXX constants. The server can impersonate the client on a secure call at identify, impersonate, or delegate level. For information about these levels of impersonation, see Impersonation Levels.

The identity presented to a server called during impersonation depends on the type of cloaking value, if any, that is set by the client. Cloaking is only available for Windows 2000.

At the end of each method call, COM will call IServerSecurity::RevertToSelf if the application does not.

Traditionally, impersonation information is not nested – the last call to any Win32 impersonation mechanism overrides any previous impersonation. However, in the apartment model, impersonation is maintained during nested calls.

Thus if the server A receives a call from B, impersonates, calls C, receives a call from D, impersonates, reverts, and receives the reply from C, the impersonation token will be set back to B, not A.

For information on using impersonation with asynchronous calls, see Impersonation and Asynchronous Calls.

To determine whether the platform supports this interface, see Determining Supported COM APIs.

Requirements

See Also

Reference

CoImpersonateClient