Impersonation in ASP.NET Web Application Does Not Work When Working in IIS

Question

I am working on an ASP.NET 4.0 MVC3 web application that runs on an intranet environment. The application uses Windows authentication. Its application pool is started by a domain user who has spn installed on the domain controller. Authentication works using Kerberos (in IE and Firefox after some additional configuration).

Now I want to upload files to sharepoint, but for me it is important to upload the file as the user who is currently logged into the application (so the file is created in Sharepoint with its credentials).

I have the following code in a ResourceExists(Uri uri) function:

 '... Dim identity As System.Security.Principal.WindowsIdentity = HttpContext.User.Identity Dim impersonationContext = identity.Impersonate() response = request.GetResponse() impersonationContext.Undo() '... 

This works when starting locally, but when I deploy the server, I get an exception:

 System.Net.WebException: The remote server returned an error: (401) Unauthorized.\r\n at WebDav.WebDavClient.ResourceExists(Uri uri)\r\n at Website.Website.WebdavController.Upload(HttpPostedFileBase file, UploadViewModel vm) 

I read something about credential transfer, which is not possible in NTLM, but I'm sure I'm using Kerberos (I checked the headers with wirehark and fiddler) and I see the following:

 Authorization: Negotiate YIIFpQYGKwYBBQUCoIIFmTCCBZWgJDAiBgkqhkiC9x... 

Any ideas why impersonation doesn't work when working on an IIS server?

Answer 1

I found the answer here:

http://support.microsoft.com/kb/810572

"Kerberos does not work in a load-balanced architecture, and IIS reverts to NTLM authentication. Since you cannot use NTLM for delegation, any applications or services that require delegation do not work. For more information, click the following article number to view the article in Microsoft "

And that was just that. I tried now with another machine, which is unbalanced in load and works.

The only thing that surprises me is that ImersonationLevel Identity is not Impersonate yet Delegate ...

Answer 2

After setting up <identity impersonate="true"/> in the web.config file, try the following:

 using (((WindowsIdentity)User.Identity).Impersonate()) using (var client = new WebClient { Credentials = CredentialCache.DefaultNetworkCredentials }) { string result = client.DownloadString("http://sharepoint"); } 

Answer 3

you need to set up your site in IIS in order for the impersonation to work.

see Configure ASP.NET Impersonation Authentication (IIS 7)