Hi Rich,

Our AD/network guys illustrated a potential security issue using the
following example. By the way, I assume that by delegation you mean passing
user's credential from one machine to the other, which would allow a Web
application running on machine A to connect to a SQL server running on
machine B using integrated Windows authentication with credentials
(actually, authentication token or Kerberos ticket) of a remote user
accessing the site from machine C. Without delegation, a Web application can
only pass user's credentials to a SQL Server running on the same machine.
So, let's say that I am an internal hacker and I would like to connect to
some secure database using credentials of the company's CEO (CIO, or
whatever). If delegation is enabled on my network, what I can do is:

(1) Create a fake internal Web site.
(2) Send an HTML e-mail (or regular e-mail with a link) pointing to my fake
Web site to the CEO (CIO, or whatever).
(3) In the code-behind logic, use caller's credentials (Kerberos ticket) to
connect to the database and do whatever I want on behalf of the user.

The main danger in this scenario is that the user will never know what have
happened. Without delegation, this risk is eliminated because my fake Web
site would not be able to propagate user's credentials to the remote SQL
Server unless I use basic authentication for the Web site, which is also a
risk, but at least it will be visible to the user that some security-related
operation is happening.

Alek