Impersonation only works when a user is specificed

Question

I am having an issue accessing a webservice with impersonate without a specified user.

Works: <identity impersonate="true" userName="DOMAIN\USERNAME" password="MyPassword" />

Doesn't Work

<identity impersonate="true" />

While debugging I used the code below to verifiy the correct Domain and Username were being used, they are.

System.Security.Principal.WindowsIdentity.GetCurrent().Name;

Here is more of my web.config

<authentication mode="Windows" />
<identity impersonate="true" /> 
<authorization>
  <allow users="*" />
  <deny users="?"/>
</authorization>

I am logging into the prompt, image below enter image description here

Any ideas why it will only work when I specify a user in the web.config? I am logging in with the same Domain\Username and password that I put into the <identity impersonate="true" userName="DOMAIN\USERNAME" password="MyPassword" /> . I've tried with multiple accounts and they all work when I put their credentials in the web.config but none work with identity set as<identity impersonate="true" /> and logging in.

EDIT The remote server returned an error: (403) Forbidden. enter image description here

EDIT 2 Everything works fine while debugging and while hitting the service on the server that contains the IIS it is hosted on, I've tried with multiple accounts and they all work. Everything is on the same domain

Do you have Anonymous Authentication enabled in IIS? Try to debug this code: `System.Web.HttpContext.Current.User.Identity.Name` — Cristina Alboni, May 07 '15 at 15:24
I tried the code you suggested and I am getting the expected DOMAIN\username. — joetinger, May 07 '15 at 15:31
What error do you receive when you try to access your database? — Cristina Alboni, May 07 '15 at 15:35
I added the error to the question. From Googling the error is thrown when you an invalid username or password when trying to hit the webservice. I edited the question to reflect that it is a webservice, sorry for any confusion — joetinger, May 07 '15 at 16:24

score 3 · Answer 1 · edited May 23 '17 at 11:58

Note the following text from https://support.microsoft.com/en-us/kb/306158

Impersonate a Specific User for All the Requests of an ASP.NET Application

To impersonate a specific user for all the requests on all pages of an ASP.NET application, you can specify the userName and password attributes in the tag of the Web.config file for that application. For example: Note The identity of the process that impersonates a specific user on a thread must have the "Act as part of the operating system" privilege. By default, the Aspnet_wp.exe process runs under a computer account named ASPNET. However, this account does not have the required privileges to impersonate a specific user. You receive an error message if you try to impersonate a specific user. This information applies only to the .NET Framework 1.0. This privilege is not required for the .NET Framework 1.1.

To work around this problem, use one of the following methods: Grant the "Act as part of the operating system" privilege to the ASPNET account (the least privileged account).

Note Although you can use this method to work around the problem, Microsoft does not recommend this method. Change the account that the Aspnet_wp.exe process runs under to the System account in the configuration section of the Machine.config file.

You could setup the Aspnet_wp.exe process to run as the user you are trying to impersonate to get the desired privileges.

This has also been discussed before: How do you do Impersonation in .NET?

score 1 · Answer 2 · answered May 20 '15 at 05:43

1

It could be the NTLM double-hop authentication issue. In short, ensure that Kerberos SPNs are properly set so it is used instead of NTLM. This MSDN blog post has a great explaination.

http://blogs.msdn.com/b/besidethepoint/archive/2010/05/09/double-hop-authentication-why-ntlm-fails-and-kerberos-works.aspx

Alternatively, basic or forms authentication will also achieve what you're looking to accomplish. This is because the application will have the user's credentials and, if properly configured, can use them to access back end resources.

You may also want to look into Kerberos delegation. Its a way to restrict that second hop to just one resource via it's SPN.

answered May 20 '15 at 05:43

user2320464

359
1
5
11

thanks for the response. I have not had a chance to try this yet but after reading the article it seems like it could be the answer – joetinger May 21 '15 at 20:07
After reading this about setting SPNs https://support.microsoft.com/en-us/kb/929650 will this set the application pool to use the provided domain/user every time the site is accessed? – joetinger May 21 '15 at 20:26
No. From a high level setting the SPN is just a way to register a resource with an account. In this case you're registering the account used for your website. That way when someone authenticates via Kerberos that account can verify/decrypt the service ticket presented by the user requesting access. – user2320464 May 23 '15 at 05:22

Impersonation only works when a user is specificed

2 Answers2