WCF and <identity impersonate="true" />

Question

Hi there,

What is the difference between these two lines of web.config code
1.

<identity impersonate="true" />

2.

<identity impersonate="true" userName="MyUserName" password="MyPassword"/>

Where MyuserName and MyPassword are my windows credentials. If you have IIS setup to use windows credentials shouldn't "1." pass in my windows credentials and hence be the same as "2."?

My app is dying when I use "1" with an authentication error when trying to connect to my WCF service. There is obviously nothing wrong with the code in my service and the code that calls my service as "2" works just fine and passes the client credentials to my WCF service.

the IIS config for the website is setup for windows authentication and the user it runs under is trusted for delegation.

So how can I get my windows credentials passed through without hard coding them?

Answer 1

If you read the MSDN page about the ASP.NET identity impersonation, you will notice that if the <identity> element does not include credentials, ASP.NET will impersonate the token passed to it by IIS, which can be either the identity of the request authenticated user or the anonymous Internet user account (IUSR_machinename). Seems to me that in the scenario 1. above ASP.NET is getting the anonymous user token, which would explain the failure. You can try disabling anonymous access to your web service to force the WIndows authentication to kick in.

Answer 2

What you're seeing is a problem with delegation. If you use

<identity impersonate="true" />

then what happens is your ASP.NET pages will run under the credentials of the user logged in (assuming Windows authentication). However these credentials are not passed onto any calls made outside of your application such as a connection to SQL or a connection to a WCF service. You need to use the credentials passed to ASP.NET and then use impersonation before calling your web service;

using (((WindowsIdentity)HttpContext.Current.User.Identity).Impersonate())
{
    WCFTestService.ServiceClient myService = new WCFTestService.ServiceClient();
    Response.Write(myService.GetData(123) + "<br/>");
    myService.Close();
}

There's more details on the WCF Security Patterns and Practices site.