Re: <identity impersonat=> problems.

From: Paul Clement (UseAdddressAtEndofMessage_at_swspectrum.com)
Date: 08/02/05 

Date: Tue, 02 Aug 2005 13:12:24 -0500

On 2 Aug 2005 09:54:30 -0700, "nobody101@comcast.net" <nobody101@comcast.net> wrote:

¤
¤
¤ I have a web service configured with Anonymous access disabled.
¤ The calling client, prior to executing a method on the service,
¤ sets its network credentials for the IIS to authenticate:
¤
¤
¤ CredentialCache cacheVU = new CredentialCache();
¤ cacheVU.Add( new Uri(<my url here>), "Negotiate",new
¤ NetworkCredential( Username, Password, Domain) );
¤
¤
¤ WebServiceProxy.Credentials = cacheVU;
¤
¤
¤ My web service method works OK. However, I need to access a network
¤ share, so I wanted to use the
¤
¤
¤ <identity impersonate="true" />
¤
¤
¤ setting in my web service's web.config file. However,
¤ when I try to access the remote share, I get an access denied error:
¤ Access to the path "..." is denied
¤
¤
¤ However, if I change the <identity> element and add the "username"
¤ and "password" attributes - which are the same username and password
¤ that the web service authentication use, it works OK.
¤
¤
¤ I thought the <identity> w/o the username/password should
¤ inherit the user context.
¤
¤
¤ I added some debug statements, and displayed:
¤
¤
¤ - Thread.CurrentPrincipal.Identi­ty
¤ - WindowsIdentity.GetCurrent
¤ - User.Identity
¤
¤
¤ and in both cases ( with and without explicit username/password in the
¤ <identity> element), the
¤ dumped names are the same, so I am assuming the impersonation is
¤ enabled. So, why are my access rights denied for the case w/o the
¤ explicit username/password defined?

Probably because you cannot impersonate and delegate the encrypted credentials (authenticated via
IIS) to the remote server in order to access the resource. This is not supported through Integrated
Windows authentication. It would probably work with Basic authentication. When using the web.config
identity you not only have the credentials to delegate but they are unencrypted.

You may want to check the following article on delegation:

http://msdn.microsoft.com/library/default.asp?url=/library/en-us/vsent7/html/vxconaspnetdelegation.asp

Paul
~~~~
Microsoft MVP (Visual Basic)

Relevant Pages

  • Re: WSS Web Service Security
    ... I assume you guys are using basic authentication. ... I have a web service (a DIME receiver currently sitting outside WSS because ... I can't get it to work inside without breaking the WSS services). ... However without defining credentials in the web service I can't get ...
    (microsoft.public.sharepoint.windowsservices)
  • Re: Pass through credentials to web service
    ... It is the double-hop' limitation of NTLM authentication. ... application server, the server cannot then use those credentials to ... >I have a client application that calls a web service. ...
    (microsoft.public.dotnet.framework.aspnet)
  • Re: Anonymous and integrated authentication for Web service
    ... Can you tell me where to look for information on how to create a .net client ... I tried changing values in the UseDefaultCredentials and Credentials ... Given this are you saying they both can call the same web service? ... Integrated Windows authentication ...
    (microsoft.public.inetserver.iis.security)
  • RE: IIS, Basic authentication, Default domains, and Session
    ... by using an authentication method other than Anonymous, ... automatically passes the credentials for every new request during the ... How IIS Authenticates Browser Clients ... This would mean in your scenerio that IE is passing the username (without a ...
    (microsoft.public.inetserver.iis.security)
  • Re: Passing user credintials from a web page to a web service.
    ... If you're using Basic authentication the username is available via HttpContext.Current.User.Identity and the password is in some server variable. ... Using .Net/ASP 1.1 on a server using integrated authentication-- I have a web page that will collect some data from the user, call a web service to get additional data, and then merge and format the data back to the user's browser. ... But I want the web service to authenticate with the user's credentials, not the credentials of IIS serving the aspx page. ...
    (microsoft.public.dotnet.framework.aspnet)