CODEWITHSUNDEEP
asp.netiisimpersonation
coderguy123
coderguy123

Reputation: 1955

asp.net Impersonate User for network resource access

code:

System.Security.Principal.WindowsImpersonationContext impersonationContext;
impersonationContext =
    ((System.Security.Principal.WindowsIdentity)User.Identity).Impersonate();

//access network resources.

impersonationContext.Undo();

web.config:

<authentication mode="Windows">       
</authentication>
<identity impersonate="true"
userName="user"
password="password"></identity>

As clear from web.config file, the app runs in an impersonated mode. I need to impersonate temporarily on top of that to access a network resource. I do that as shown above.

This works fine on server if I browse to the website on the local IE installed on the server but when I access the app from my PC or any other PC, I get a access denied.

Btw, this is all within an enterprise domain environment. so IE in both cases is passing a valid authenticated token.

Any ideas what is going on. thanks.

Upvotes: 3

Views: 2901

Answers (1)

HAL9000
HAL9000

Reputation: 1022

You need to make sure the server will delegate the impersonated security contexts in your application to another server (the network resource you mentioned).

I'm pretty sure it works while you're logged onto your server because it is using the security context of you being logged in directly, and not the impersonated context that exists in the application.

I can't remember specifics on configuration but I do know it is referred to as delegation or "Kerberos Double Hop". "Constrained Delegation" is when you configure such that only one type of delegation is allowed. IE, your app is only allowed to delegate security contexts when talking to Active Directory (port xyz) on this other specific server - otherwise not.

See Understanding Kerberos Double Hop

See DelegConfig - it is helpful in configuring delegation.

Also see: TechNet Article

And: this other article

Upvotes: 3

Related Questions