Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I am writing a web application that uses .NET Windows Authentication and relies on a user's group membership to Authorize them to various areas of the website. Right now I'm on a dev machine that IS NOT part of a domain and is not using AD, instead I'm just using local user groups. In general this is working fine as is.

However, as I test the application I need to add and remove roles in my user account to verify things are working. When I add a role it doesn't seem to propagate until I log out of Windows and login again.

Is it possible to force an update to Group membership without having to log off?

share|improve this question
3  
Do you mean log off the station, or the website? –  Dan Nov 30 '11 at 15:25
    
Good point, I updated my question to clarify. I have to log off of my Windows user account (log out of windows) and log in again. –  kingdango Nov 30 '11 at 15:29

3 Answers 3

up vote 7 down vote accepted

This isn't possible. When you log on, you receive a token reflecting your group membership, among other things. The only way to refresh this token is to log in.

share|improve this answer
    
If this is the case that's a bummer, it's going to hamper my testing a bit. Thanks for the insight... I'm hoping another user has a better answer but I'm guessing by your 15k+ rep you know what you're talking about. –  kingdango Nov 30 '11 at 15:32
1  
@kingdango you could always use runas to run the process as a different user than your own and manipulate the group membership of that test user. Every time you close and relaunch the process using runas it should create a new session, which should reflect the changed group membership. I haven't tested this, but in theory it should work this way. –  MDMarra Nov 30 '11 at 15:34
    
That's tough because of my dev environment but it's worth exploring. Thanks for the quick and thoughtful response Mark. –  kingdango Nov 30 '11 at 15:35

I had a similar situation of a website that relied on a user's membership in AD to allow login to the website. One thing to consider doing is having the web server do the authentication/query to the AD server with their supplied credentials; if the web server has access to AD and just queries the server for whether the user is in group XYZ, they'll get a list right from AD, not from the login token of the user which does require logon/logoff to get a new token with proper privileges.

I know your dev machine right now from the description doesn't have that access but it sounded like you mean when you deploy it you need this functionality.

If you rely on the token, you'll have to log off and back in.

share|improve this answer
    
Thank you for the thoughtful response. That is one good way to get at the problem. In normal situations I'm more than happy waiting until the user receives updated access control, even if it means they need to log off and log in to their machine again. It's only the test scenario where this can be a burden but it's really not that big of a deal. Honestly, it's taken me more time to research a shortcut. :-) –  kingdango Nov 30 '11 at 15:44
    
It can come in handy, too, depending on the scenario. If the server is querying the DC directly, that means that changes "migrate" almost immediately, so if someone is getting access cut off or added it doesn't take a client logon/logout cycle. It makes it a little easier for their IT staff. –  Bart Silverstrim Nov 30 '11 at 15:50
  • Open Task Manager
  • Kill Explorer.exe (each one)
  • Click File > New Task (Run...)
  • Type in CMD
  • In the command prompt type "RunAs /user:\ explorer.exe

Done.

share|improve this answer
2  
No, wrong. Please read the question. –  HopelessN00b Sep 27 '12 at 4:39

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.