3

code:

System.Security.Principal.WindowsImpersonationContext impersonationContext;
impersonationContext =
    ((System.Security.Principal.WindowsIdentity)User.Identity).Impersonate();

//access network resources.

impersonationContext.Undo();

web.config:

<authentication mode="Windows">       
</authentication>
<identity impersonate="true"
userName="user"
password="password"></identity>

As clear from web.config file, the app runs in an impersonated mode. I need to impersonate temporarily on top of that to access a network resource. I do that as shown above.

This works fine on server if I browse to the website on the local IE installed on the server but when I access the app from my PC or any other PC, I get a access denied.

Btw, this is all within an enterprise domain environment. so IE in both cases is passing a valid authenticated token.

Any ideas what is going on. thanks.

1 Answer 1

3

You need to make sure the server will delegate the impersonated security contexts in your application to another server (the network resource you mentioned).

I'm pretty sure it works while you're logged onto your server because it is using the security context of you being logged in directly, and not the impersonated context that exists in the application.

I can't remember specifics on configuration but I do know it is referred to as delegation or "Kerberos Double Hop". "Constrained Delegation" is when you configure such that only one type of delegation is allowed. IE, your app is only allowed to delegate security contexts when talking to Active Directory (port xyz) on this other specific server - otherwise not.

See Understanding Kerberos Double Hop

See DelegConfig - it is helpful in configuring delegation.

Also see: TechNet Article

And: this other article

3
  • I just realized I missed your second to last sentence. Ignore my answer if you've already ruled out delegation issues.
    – HAL9000
    Apr 16, 2010 at 0:20
  • Thanks Ben for the reply. I was pretty certain it was something to do with AD as it only works on local requests. The link about Kerberos Double Hop was very insightful. At this point though, I have pretty much given up and going a completely different route. Apr 16, 2010 at 13:27
  • hey no problem. It took our sysadmins a long time to get delegation configured right on our servers - and the wait was painful. If you can design around it then by all means. Good luck!
    – HAL9000
    Apr 16, 2010 at 20:13

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.