CODEWITHSUNDEEP
httpclientwebclientkerberosimpersonationdelegation
Gunman7840
Gunman7840

Reputation: 129

ASP double hop request in kerberos delegation scenario

Please help! I need my asp application to request remote systems with credentials of impersonated user. But always get 401 Unauthorized errors. I made all configurations from here: https://support.microsoft.com/en-us/help/810572/how-to-configure-an-asp-net-application-for-a-delegation-scenario Kerberos is configured and working in my app and my test remote app(i see kerberos tickets in fiddler). Delegation, spns and everything is configured.

Thats my code usnig System.Net.Http.httpclient:

    HttpClientHandler handler = new HttpClientHandler()
{
    UseDefaultCredentials = true,
    PreAuthenticate = true
};

using (HttpClient client = new HttpClient(handler))
{
    client.DefaultRequestHeaders.Accept.Clear();
    var method = new HttpMethod("GET");
    var request = new HttpRequestMessage(method, "http://testdelegationapp.avp.ru/");
    var response = client.SendAsync(request).Result;
}

In fact http request is made by Apppool account (I get 401 error when restricting access to Apppool account in remote app IIS)

Here: How to get HttpClient to pass credentials along with the request? is claimed that HttpClient cant pass security token to another thread, and its better to use synchronous methods of System.Net.WebClient

Code using webclient:

var wi = (WindowsIdentity)HttpContext.User.Identity;
var wic = wi.Impersonate();
try
{
    string URI = "http://testdelegationapp.avp.ru/";
    using (WebClient wc = new WebClient())
    {
        wc.UseDefaultCredentials = true;
        string response = wc.DownloadString(URI);
    }
}
finally
{
    wic.Undo();
}

Result is even worse, the same 401 error, but in fiddler i can see that webclient using NTLM ticket to get to remote app!

Configuring of flowing tokens throw threads from here :Unable to authenticate to ASP.NET Web Api service with HttpClient doesnt help either. SecurityContext.IsWindowsIdentityFlowSuppressed() is false.

WindowsIdentity.GetCurrent().Name and Thread.CurrentPrincipal.Identity.Name shows impersonated user as it should be.

Upvotes: 3

Views: 986

Answers (1)

Gunman7840
Gunman7840

Reputation: 129

All that time problem was in chrome browser, by default it prohobits kerberos delegation. You shoud add the following to registry:

Path: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Google\Chrome ; 
string: AuthNegotiateDelegateWhitelist ; 
value: *.avp.ru

So, now my working configuration is

HttpClient for web requests.

ASP impersonation ON in IIS if you want to execute all your app under delegated credentials. If you want method specific delegation, then use:

var wi = (WindowsIdentity)HttpContext.User.Identity;    
var wic = wi.Impersonate();
wic.Undo();

HttpClient executes request in another thread , so in aspnet_config.config we need following changes:

<legacyImpersonationPolicy enabled="false"/>
<alwaysFlowImpersonationPolicy enabled="true"/>

You can find aspnet_config.config in:

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet.config
C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet.config
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\aspnet.config
C:\Windows\Microsoft.NET\Framework\v2.0.50727\aspnet.config

Upvotes: 4

Related Questions