Impersonation the current user using WindowsImpersonationContext to access network drive

Question

I need to access a remote drive from a Web App. The drive isn't accessible to the ASP.NET process, so I want to impersonate the current user for the request.

I saw some basic examples using WindowsImpersonationContext, and have tried the following.

WindowsImpersonationContext impersonationContext = null;

try
{
    impersonationContext = ((WindowsIdentity)User.Identity).Impersonate();

    file.SaveAs(filePath);
}
finally
{
    if (impersonationContext != null)
    {
        impersonationContext.Undo();
    }
}

I'm still getting an access denied exception.

I've read a bit of stuff about LogonUser, but as far as I can tell you need a user name and password to get credentials from that. I'm not looking to log in as a different specific user, just the current user (who should have permissions to access the file store), so I don't think I actually need the LogonUser API.

Does anyone have any idea what I'm missing? Should the above code work?

I'd also note that including

<identity impersonate="true" />

doesn't work, but including

<identity impersonate="true" userName="myName" password="myPassword" />

in the web.config lets me in. I've seen a few people ask questions about why this is, but I've seen no explanation. I'm wondering if it is connected to my problem though.

Answer 1

You're probably running into an Impersonation vs. Delegation issue. When you Impersonate a user, you can access local resources as that user, but not remote resources. With Delegation, you can access remote resources too. Try the following:

1. Ensure that Windows authentication is enabled in IIS, and that Anonymous authentication is disabled (Anonymous authentication takes precedence of other authentication mechanisms)
2. Enable <authentication mode="Windows" /> in your web.config to ensure ASP.NET processes Windows authentication (this should only apply to Classic pipeline mode).
3. <identity impersonate="true" /> should be enough.

The other thing you may need to do, is ensure that the the account running the AppPool is permitted to act like a delegate.