c++ - Calling QueryInterface with custom identity -

issue:

i call cosetproxyblanket on proxy (if that's right term it) , call queryinterface on same proxy, receive result of 0x80070005 ("access denied"). however, if first call coinitializesecurity (which trying avoid) same credentials call succeeds.

question:

how can interface need without having call coinitializesecurity? understand, process can call method once not compatible making dll , can substituted calls cosetproxyblanket.

details:

i experimenting building own opc client can communicate computers running on different domains without matching user accounts.

first, create identity structure domain, username, , password valid on server:

coauthinfo      authinfo; coauthidentity  authidentity;  authidentity.domain             = (unsigned short *) w_domain; authidentity.domainlength       = wcslen( w_domain); authidentity.flags              = sec_winnt_auth_identity_unicode; authidentity.password           = (unsigned short *) w_password; authidentity.passwordlength     = wcslen(w_password); authidentity.user               = (unsigned short *) w_username; authidentity.userlength         = wcslen(w_username);  authinfo.dwauthnlevel           = rpc_c_authn_level_call; authinfo.dwauthnsvc             = rpc_c_authn_winnt; authinfo.dwauthzsvc             = rpc_c_authz_none; authinfo.dwcapabilities         = eoac_none; authinfo.dwimpersonationlevel   = rpc_c_imp_level_impersonate; authinfo.pauthidentitydata      = &authidentity; authinfo.pwszserverprincname    = null;  serverinfo.pauthinfo = &authinfo; 

then able call cocreateinstanceex server info obtain handle (m_iopcserver) opc server (iid_iopcserver).

after obtain handle, i've found necessary once again set more permissions (see how impersonation in dcom work?) call:

hr = cosetproxyblanket(m_iopcserver, rpc_c_authn_winnt, rpc_c_authz_none,           null, rpc_c_authn_level_call, rpc_c_imp_level_impersonate,           &authidentity, eoac_none); 

after able obtain handle opc item group:

hr = m_iopcserver->addgroup(l"", false, requptrate, clienthandle,           null, null, lcid, &m_hservergroup, &reviseduptrate,           iid_iopcitemmgt,(lpunknown*)&m_iopcitemmgt); 

however, when try use code:

hr = m_iopcitemmgt->queryinterface(iid_iopcsyncio, (void**)&m_iopcsyncio); 

the result 0x80070005 ("access denied"). case if call cosetproxyblanket on m_iopcitemmgt. if first call coinitializesecurity, call succeeds.

i believe issue related how impersonation in dcom work? in queryinterface function form of object creation doesn't use same security other method calls addgroup. in microsoft reference queryinterface, under notes implementer, makes sound queryinterface shouldn't checking acls , under return values, access denied not mentioned possibility. don't think issue implementation specific though because have tried code on known commercial opc servers (e.g. matrikon simulation server) opensource lightopc doesn't implement security.

i guessing need find way replicate command

hr = m_iopcitemmgt->queryinterface(iid_iopcsyncio, (void**)&m_iopcsyncio); 

but while supplying authidentity. possible? can done cocreateinstanceex or cogetclassobject or other com call?

without going detail: coinitializesecurity invoked @ least once per process. can done implicitly or explicitly. if code doesn't make explicit call, dcom runtime parameters populated registry. can try tweak appropriate registry values force dcom using values similar used in explicit call. registry key holds values "hkey_local_machine\software\classes\appid{appid_guid}" key described here:https://msdn.microsoft.com/en-us/library/windows/desktop/ms693736(v=vs.85).aspx