Understanding Process Tokens

When looking at how access controls work, it's useful to think of a lock and key. The lock is the ACL, which we examined in detail in a previous column, "Setting Security," and the key is the information within the process token, which defines the security information for a thread or process. The combination of a process token and an object's ACL determines whether the OS will grant the process the requested access to the object.

This week, I'll introduce you to process tokens and show you how to get at a process token's contents. I'll use this discussion to lay the groundwork for future articles where you'll need to have an understanding of what process tokens are and how they work.

DumpTokenInfo
Understanding what information is in a process token can help you debug your code and is particularly useful when dealing with Web-based applications and Distributed COM (DCOM) objects. Both Web-based applications and DCOM objects can run under more than one user context, or could be impersonating the client. Determining why a particular operation failed can be confusing, and knowing the details about the user trying to perform the operation can help. Systems administrators can also use process token information to determine why users can access a resource they shouldn’t have access to or can’t get to a resource users should have access to. . . .