Bug->Doc #27051 [Asn->Opn]: Impersonation with FastCGI does not EXEC process as impersonated user

Edit report at https://bugs.php.net/bug.php?id=27051&edit=1 ID: 27051 Updated by: kalle@php.net Reported by: ghoffer at globalscape dot com Summary: Impersonation with FastCGI does not EXEC process as impersonated user -Status: Assigned +Status: Open -Type: Bug +Type: Documentation Problem Package: CGI/CLI related Operating System: Windows PHP Version: 5.3 -Assigned To: pajoye +Assigned To: Block user comment: N Private report: N Previous Comments: ------------------------------------------------------------------------ [2010-03-25 14:33:04] pajoye@php.net Ah nice, so another useful entry to add to the documentation, thanks for investigating it and report it back! :) ------------------------------------------------------------------------ [2010-03-25 13:08:22] heer2351 at zonnet dot nl Located the problem and have been able to fix it. I am using a special user for my Application Pool (say AppPoolUser), so PHP runs as this user. The new exec function uses CreateProcessAsUser() with impersonation. This means that the AppPoolUser must have the right to change the process level token. You can assign this right to the user in the "Local Security Settings" -> User Rights Assignment. I have granted my AppPoolUser the "Replace a process level token" setting -> fork error has gone. Thought this might be useful information, so access is required to cmd.exe but in addition the "Replace a process level token" setting. ------------------------------------------------------------------------ [2010-03-25 00:45:36] pajoye@php.net I will repeat a last time :) It does work here using IIS6 and the exact same windows version of FastCGI. The other users with issues with that have solved the problem as well using latest 5.3 and the right configuration. There are differences between 5.2 and 5.3, a lot. One of them is a working impersonation (which is not only about exec). ------------------------------------------------------------------------ [2010-03-25 00:40:55] heer2351 at zonnet dot nl Thanks for your help. I think there are still more people with the same problem. I will try to find a solution and will post here if I find one. For now I stick with 5.2.13 I am not convinced it is a config problem. Will dig into SVN and find what the difference is between the two versions. ------------------------------------------------------------------------ [2010-03-25 00:30:20] pajoye@php.net I don't know either and hard to say why it does not work for you but for us (same config). I feel like you actually configure it wrong. impersonation in 5.2 was not fully working and was not doing the right thing (not only for exec&co). I can't help further without more details about how you configure the impersonation or having a remote access to debug. ------------------------------------------------------------------------ The remainder of the comments for this report are too long. To view the rest of the comments, please view the bug report online at https://bugs.php.net/bug.php?id=27051 -- Edit this bug report at https://bugs.php.net/bug.php?id=27051&edit=1