Home | Contact Us | FAQ | Search & Site Map | Link to Us
Sign In | Join | Other 45 Sites in Network
HomeAnnouncementsFree MagazinesWhite PapersSubmit Content
Discussion GroupsASP.NETWindows FormsLanguages.NET FrameworkVisual Studio.NET
Articles.NET FrameworkASP.NETToolsWindows Forms
.NET DirectoryOpen Source ProjectsUser GroupsWeb Resources
Related Topics
Visual Basic 6SQL ServerMS AccessOther DB ProductsMS Server ProductsMore Topics ...

.NET Forum / ASP.NET / Security / August 2003

Tip: Looking for answers? Try searching our database.

impersonate/delegate problem

Thread view: 
Enable EMail Alerts  Start New Thread
Thread rating: 
Jerry - 07 Aug 2003 15:04 GMT
Ok.. so I've read and seen lot of messages and MSDN docs concerning the
above issue.. how do I get it to work?
I want to impersonate the current user accessing my website...
so I turn on the site directory security to NOT allow anonymous but turn ON
integrated windows authentication.
Then I change the web.config to allow impersonate = "true".

So far so good.. this setting will allow me to run the request process from
the user to the webserver under the current users identity...

Now that same process needs to access some network resources..specifically
see if some windows services are running on network servers...  so I need to
"delegate" the current users identity to the ASPNET...

but I thought the impersonate="true" would do that but I guess it doesn't..
It looks like the impersonate is only for the process b/w the client and
webserver.

seeing how we are running Win2000 servers and desktops.. and using Active
Directory..
what more do I need to get delegate to work?

I want to be able to use the user's identity for the delegate..

I've tried setting a valid username and password in the webconfig but I
don't want to use that.. since it opens up the
id/pwd to everyone in the development group..

Do I have to turn on the property for the webserver to support delegate in
the AD?

Thanks,
Jerry
Rich - 19 Aug 2003 00:35 GMT
Not sure if you found the answer to this question, but
that's exactly what we had to do(enable delegation on the
webserver from within AD users and computers) to pass the
original callers identity to our remote resource. Our
network folks are looking into the cons of allowing this
on our production network. They don't want to create a
possible security risk. I'm trying to find out more info
about the potential risks of turning this on.

>-----Original Message-----
>Ok.. so I've read and seen lot of messages and MSDN docs concerning the
[quoted text clipped - 32 lines]
>
>.
Jerry - 19 Aug 2003 01:10 GMT
Thanks Rich..

I did get it to work once that was turned on..
Without that feature, you don't have delegation so I'm not sure if you have
a choice...

> Not sure if you found the answer to this question, but
> that's exactly what we had to do(enable delegation on the
[quoted text clipped - 55 lines]
> >
> >.

Free Magazines

Get these publications absolutely FREE for up to 12 months. There are no hidden fees and no obligation. Simply choose a title, complete the application form and submit it. Read more ...

Oracle MagazineNetwork ComputingComputer WorldBio-IT WorldeWeekInformation WeekInfosecurity
 
Sign In
Join
My Latest Posts
My Monitored Threads
My Blog
My Photo Gallery
My Profile
My Homepage

Start New Thread
Enable EMail Alerts
Rate this Thread



©2008 Advenet LLC   Privacy Policy - Terms of Use
This website includes both content owned or controlled by Advenet as well as content owned or controlled by third parties.