4

I'm having problems accessing a text file on a remote server with ASP.NET. The ASP.NET 1.1 application is running on Server 2003 using Impersonation with the requester's Windows Credentials. The client, webserver, and remote server are all on the same domain, and the user has permission to access the text file. The user can open the text file from their machine over a UNC share. When the user runs the site logged in directly on the server it works fine. However, when the user tries on their machine, it does not work. How should Impersonation be set up for this to work?

EDIT: Other features of the app work fine, it just accessing the remote file that doesn't work.

Lance Fisher
  • 25,684
  • 22
  • 96
  • 122

3 Answers3

4

It sounds like you're running into the multi-hop problem. When you use integrated authentication, you can authenticate from your browser to IIS. But, you can't authenticate to any other machines on the domain. The reason is that with standard credentials, they can't verify who you are.

There are 2 primary workarounds that I'm familiar with:
  1. Implement Kerberos, these certificates allow you to do a more advanced authentication, and allow for multiple-network hops.
  2. Re-impersonate your user using the LogonUser win32 api (requires a password).
Jay Mooney
  • 2,208
  • 1
  • 19
  • 23
  • 1
    Yeah default NTLM derived credentials are good for only one machine-to-machine hop. Basic auth could also be an option if prompts weren't an issue - you'd want to do it over SSL, and secure the log files. – stephbu Feb 05 '09 at 21:16
  • Thanks, I was suspecting something like this. – Lance Fisher Feb 06 '09 at 23:03
0

In IIS, Anonymous, and Basic authentication both need to be unchecked at a minimum on the application folders. You might want to check the application folder itself instead of just the root folders. There may be other configuration options, but this is the "low hanging fruit" option.

hova
  • 2,811
  • 20
  • 19
0

As a test, specify a username and password in the impersonation tag to force the application to always impersonate as a user you know has access to the file.

If the application can now access the text file, you will know it is the transfer of the user's credentials to the server.

If the application STILL can't access the text file, the credentials are not the problem and there's a server configuration issue.

Jay S
  • 7,904
  • 2
  • 39
  • 52