Solved

ASP .NET/IIS6 NT User Impersonation problems..

Posted on 2008-10-23
5
1,622 Views
Last Modified: 2013-11-05
Hi guys,

I've never really done this type of project before, but basically I want to have a site on our company's intranet website that will automatically utilize the visitor's NT domain credentials when they visit the page.

Now this little code snippet, if it works I should be golden:

currentWindowsIdentity = CType(User.Identity, System.Security.Principal.WindowsIdentity) impersonationContext = currentWindowsIdentity.Impersonate() strUser = currentWindowsIdentity.Name.ToString.Substring(currentWindowsIdentity.Name.ToString.IndexOf("\") + 1) Response.Write("You are validated on this page as: <B>" & strUser & "</B><BR>")

This works great when debugging through the ASP .NET Development Server on my work machine. It'll report my username and everything's good. However, when I move to production, it fails. Here's the error:

System.InvalidOperationException: An anonymous identity cannot perform an impersonation. at System.Security.Principal.WindowsIdentity.Impersonate(StackCrawlMark& stackMark) at System.Security.Principal.WindowsIdentity.Impersonate() at CCIWSignIn._Default.Page_Load(Object sender, EventArgs e)

Now, I'm thinking this might have something to do with the way IIS works through the anonymous IUSR_servername account? So I disabled anonymous access for that page in IIS, and enabled "Integrated Windows Authentication", which just prompts me for a username and password that is doesn't seem to want to accept in the DOMAIN/Username fashion. So I've unchecked that and tried "Digest authentication for Windows domain servers". This prompts me for authentication, which I provide, and the code above works, but is there a way to just use my already entered login credentials and not get prompted for them by the site?

Any insight would be appreciated...
0
Comment
Question by:Tabris42
  • 3
5 Comments
 
LVL 37

Expert Comment

by:samtran0331
ID: 22788872
>>seem to want to accept in the DOMAIN/Username fashion

I'm not sure if that is a typo in your post or that's what you actually tried, but just to make sure... it should be a backslash and not a forward slash...

DOMAIN\Username
0
 

Author Comment

by:Tabris42
ID: 22788955
Yes, that was just a typo...
0
 

Author Comment

by:Tabris42
ID: 22790561
I have found a workaround that works rather well... probably terrible for security though. This is to set "Basic authentication" for the folder in IIS. It still prompts for the username and password, however, so advice on how to avoid that and use the NT credentials already provided would be appreciated.
0
 
LVL 11

Accepted Solution

by:
AnthonyP9618 earned 500 total points
ID: 22791524
Did you ensure that your user account actually has NTFS permissions to the files on the Web server?  It's probably trying to use Integrated, but failing because your account doesn't have the proper permissions.  Can you check the Security Event Logs of the web server and review failed audit events for your user account?

You can always SSL enable the site and use Basic... at least that would encrypt the credentials :)
0
 

Author Comment

by:Tabris42
ID: 22797089
Good idea about the SSL. I've configured it for that and am still using the basic authentication... fiddled with the NTFS permissions but still get prompted every time.

If I can't get away with letting the user login automatically... is there at least a way I can make the User field fill out with their domain\username? Then they just need to enter their password?
0

Featured Post

Ransomware-A Revenue Bonanza for Service Providers

Ransomware – malware that gets on your customers’ computers, encrypts their data, and extorts a hefty ransom for the decryption keys – is a surging new threat.  The purpose of this eBook is to educate the reader about ransomware attacks.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Just a quick little trick I learned recently.  Now that I'm using jQuery with abandon in my asp.net applications, I have grown tired of the following syntax:      (CODE) I suppose it just offends my sense of decency to put inline VBScript on a…
Problem Hi all,    While many today have fast Internet connection, there are many still who do not, or are connecting through devices with a slower connect, so light web pages and fast load times are still popular.    If your ASP.NET page …
Along with being a a promotional video for my three-day Annielytics Dashboard Seminor, this Micro Tutorial is an intro to Google Analytics API data.
With Secure Portal Encryption, the recipient is sent a link to their email address directing them to the email laundry delivery page. From there, the recipient will be required to enter a user name and password to enter the page. Once the recipient …

810 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question