Re: Impersonation and double hop

What type of authentication are you using in IIS with your web services?
Are you using basic or IWA?

Joe K.

--
Joe Kaplan-MS MVP Directory Services Programming
Co-author of "The .NET Developer's Guide to Directory Services Programming"
http://www.directoryprogramming.net
--
"Glenn Thimmes" <gthimmes@xxxxxxxxxxxxxxxxxxxxxxxxxxxx> wrote in message
news:e3d64nXvHHA.3364@xxxxxxxxxxxxxxxxxxxxxxx
Hello,



I need a little advice in figuring out the right solution for a problem
that I am facing. I have a 3 tier application. Client, Web Service middle
layer, and SQL Server. I have been using a trusted account to get from the
WS to SQL, but now I have new requirements for getting user credentials
all the way to SQL Server. I was under the impression that by passing the
user login name and password to the middle layer, it could impersonate the
user and do a single hop to the SQL Server machine.



Unfortunately, this appears to still be a double hop scenario, even though
the middle layer has the username and password required for the domain
account. Is this correct?



And if that is the case, I suppose my only solution is to use Kerberos
delegation, which I am concerned that a highly competent and security
obsessed IT staff will refuse to set up for us during an onsite customer
implementation.



Am I missing any pieces to the puzzle? Any advice would be appreciated.



Thanks,



Glenn




.

Relevant Pages

  • Re: ADSI
    ... Joe Kaplan-MS MVP Directory Services Programming ... Co-author of "The .NET Developer's Guide to Directory Services Programming" ... I have question about Active Directory. ... users on SQL server 2005 associated with roles, ...
    (microsoft.public.dotnet.framework.aspnet.security)
  • Re: Web Single Sign On
    ... Joe Kaplan-MS MVP Directory Services Programming ... Co-author of "The .NET Developer's Guide to Directory Services Programming" ... current Windows credentials to the server, ... This common identity is the user's username used to logon to the ...
    (microsoft.public.dotnet.framework.aspnet.security)
  • Re: Changing ADAM user password
    ... Joe Kaplan-MS MVP Directory Services Programming ... Co-author of "The .NET Developer's Guide to Directory Services Programming" ... Running the bind from another W2K3SP1 machine ... support in digest or something like that. ...
    (microsoft.public.windows.server.active_directory)
  • Re: ASP.NET 2.0 WindowsTokenRoleProvider Local Groups Broken
    ... Joe Kaplan-MS MVP Directory Services Programming ... Co-author of "The .NET Developer's Guide to Directory Services Programming" ... There is no Group property on the WindowsIdentity object in .NET 2.0, ...
    (microsoft.public.dotnet.framework.aspnet.security)
  • Re: Secure SSL with LDAP and AD
    ... Joe Kaplan-MS MVP Directory Services Programming ... Co-author of "The .NET Developer's Guide to Directory Services Programming" ... LDAP over SSL with a third-party certification authority. ... Note that a self signed cert is probably a very poor choice as nothing ...
    (microsoft.public.windows.server.security)