Double hop reloaded

[Sharon]

Hi to all..
I'm using impersonation, combined with windows authentication.
When the page tries to connect to active directory,
i get login failure, due to double hop issue.
As i understand it, the iis does not receive a
primary token, so how can i authenticate against Active directory?
Is it possible to delegate, when using impersonation and windows
authentication?
Thanks.
Sharon.

[Scott Allen]

Yes, I have some links to delegation resources on my blog:

http://odetocode.com/Blogs/scott/arc...2/24/1053.aspx

--
Scott
http://www.OdeToCode.com/blogs/scott/

On Wed, 30 Mar 2005 22:32:02 +0200, "Sharon" <sh****@void.null> wrote:

Hi to all..
I'm using impersonation, combined with windows authentication.
When the page tries to connect to active directory,
i get login failure, due to double hop issue.
As i understand it, the iis does not receive a
primary token, so how can i authenticate against Active directory?
Is it possible to delegate, when using impersonation and windows
authentication?
Thanks.
Sharon.

[Sharon]

Thanks Scott.
This is a "bit" confusing.
As i understand it so far, delegation is only possible using Kerberos,
and all users in Active Directory have to be marked for delegation.
Unfortunately, the fruit basket will not work here, and i've ruled out
pumping laughter gas into the IT room ventilation system.
What if i revert to the IIS identity before the Active Directory query?
Problem is, how do i get the WindowsImpersonationContext, to call Undo
method?
The only other solution is to use Basic authentication, which i don't like.
Sharon.
"Scott Allen" <sc***@nospam.odetocode.com> wrote in message
news:n8********************************@4ax.com...

Yes, I have some links to delegation resources on my blog:

http://odetocode.com/Blogs/scott/arc...2/24/1053.aspx

--
Scott
http://www.OdeToCode.com/blogs/scott/

On Wed, 30 Mar 2005 22:32:02 +0200, "Sharon" <sh****@void.null> wrote:

Hi to all..
I'm using impersonation, combined with windows authentication.
When the page tries to connect to active directory,
i get login failure, due to double hop issue.
As i understand it, the iis does not receive a
primary token, so how can i authenticate against Active directory?
Is it possible to delegate, when using impersonation and windows
authentication?
Thanks.
Sharon.

[Scott Allen]

Hi Sharon:

What you'll have to do is use an identity that the AD server
understands. Perhaps you could run the worker process under a domain
account with enough permissions in AD?

--
Scott
http://www.OdeToCode.com/blogs/scott/

On Thu, 31 Mar 2005 13:29:58 +0200, "Sharon" <sh****@void.null> wrote:

Thanks Scott.
This is a "bit" confusing.
As i understand it so far, delegation is only possible using Kerberos,
and all users in Active Directory have to be marked for delegation.
Unfortunately, the fruit basket will not work here, and i've ruled out
pumping laughter gas into the IT room ventilation system.
What if i revert to the IIS identity before the Active Directory query?
Problem is, how do i get the WindowsImpersonationContext, to call Undo
method?
The only other solution is to use Basic authentication, which i don't like.
Sharon.
"Scott Allen" <sc***@nospam.odetocode.com> wrote in message
news:n8********************************@4ax.com.. .

Yes, I have some links to delegation resources on my blog:

http://odetocode.com/Blogs/scott/arc...2/24/1053.aspx

--
Scott
http://www.OdeToCode.com/blogs/scott/

On Wed, 30 Mar 2005 22:32:02 +0200, "Sharon" <sh****@void.null> wrote:

>Hi to all..
>I'm using impersonation, combined with windows authentication.
>When the page tries to connect to active directory,
>i get login failure, due to double hop issue.
>As i understand it, the iis does not receive a
>primary token, so how can i authenticate against Active directory?
>Is it possible to delegate, when using impersonation and windows
>authentication?
>Thanks.
>Sharon.
>

[Sharon]

No i can't.
This project is for a very large organization,
and the department that controls the domain users,
will never allow it.
As a part of the policy, all users must change their passwords periodically.
So any hard coded user name and password, will eventually fail.
I tried disabling Impersonation, and still login fails.
Thanks.
Sharon.

"Scott Allen" <sc***@nospam.odetocode.com> wrote in message
news:3k********************************@4ax.com...

Hi Sharon:

What you'll have to do is use an identity that the AD server
understands. Perhaps you could run the worker process under a domain
account with enough permissions in AD?

--
Scott
http://www.OdeToCode.com/blogs/scott/

On Thu, 31 Mar 2005 13:29:58 +0200, "Sharon" <sh****@void.null> wrote:

Thanks Scott.
This is a "bit" confusing.
As i understand it so far, delegation is only possible using Kerberos,
and all users in Active Directory have to be marked for delegation.
Unfortunately, the fruit basket will not work here, and i've ruled out
pumping laughter gas into the IT room ventilation system.
What if i revert to the IIS identity before the Active Directory query?
Problem is, how do i get the WindowsImpersonationContext, to call Undo
method?
The only other solution is to use Basic authentication, which i don't like.Sharon.
"Scott Allen" <sc***@nospam.odetocode.com> wrote in message
news:n8********************************@4ax.com.. .

Yes, I have some links to delegation resources on my blog:

http://odetocode.com/Blogs/scott/arc...2/24/1053.aspx

--
Scott
http://www.OdeToCode.com/blogs/scott/

On Wed, 30 Mar 2005 22:32:02 +0200, "Sharon" <sh****@void.null> wrote:

>Hi to all..
>I'm using impersonation, combined with windows authentication.
>When the page tries to connect to active directory,
>i get login failure, due to double hop issue.
>As i understand it, the iis does not receive a
>primary token, so how can i authenticate against Active directory?
>Is it possible to delegate, when using impersonation and windows
>authentication?
>Thanks.
>Sharon.
>

[Brock Allen]

Then you're in a pickle. You either need to 1) setup a domain user for your
ASP.NET application that has the right creds for your AD, 2) enable the delegation
for your AD users if you're using integrated auth, or 3) switch to using
basic auth (over SSL, of course).

-Brock
DevelopMentor
http://staff.develop.com/ballen

No i can't.
This project is for a very large organization,
and the department that controls the domain users,
will never allow it.
As a part of the policy, all users must change their passwords
periodically.
So any hard coded user name and password, will eventually fail.
I tried disabling Impersonation, and still login fails.
Thanks.
Sharon.
"Scott Allen" <sc***@nospam.odetocode.com> wrote in message
news:3k********************************@4ax.com...

Hi Sharon:

What you'll have to do is use an identity that the AD server
understands. Perhaps you could run the worker process under a domain
account with enough permissions in AD?

--
Scott
http://www.OdeToCode.com/blogs/scott/
On Thu, 31 Mar 2005 13:29:58 +0200, "Sharon" <sh****@void.null>
wrote:

Thanks Scott.
This is a "bit" confusing.
As i understand it so far, delegation is only possible using
Kerberos,
and all users in Active Directory have to be marked for delegation.
Unfortunately, the fruit basket will not work here, and i've ruled
out
pumping laughter gas into the IT room ventilation system.
What if i revert to the IIS identity before the Active Directory
query?
Problem is, how do i get the WindowsImpersonationContext, to call
Undo
method?
The only other solution is to use Basic authentication, which i
don't like.
Sharon.

"Scott Allen" <sc***@nospam.odetocode.com> wrote in message
news:n8********************************@4ax.com...

Yes, I have some links to delegation resources on my blog:

http://odetocode.com/Blogs/scott/arc...2/24/1053.aspx

--
Scott
http://www.OdeToCode.com/blogs/scott/
On Wed, 30 Mar 2005 22:32:02 +0200, "Sharon" <sh****@void.null>
wrote:

> Hi to all..
> I'm using impersonation, combined with windows authentication.
> When the page tries to connect to active directory,
> i get login failure, due to double hop issue.
> As i understand it, the iis does not receive a
> primary token, so how can i authenticate against Active directory?
> Is it possible to delegate, when using impersonation and windows
> authentication?
> Thanks.
> Sharon.

[Sharon]

Thank you Scott & Brock vary much.
Maybe i'm in a pickle, but i'm out of the confusion.
Another option i have is revert to the old DB based app,
but that means rewriting a large portion of the code.
Basic authentication is becoming more and more appealing.
Thanks again.
Sharon.
"Brock Allen" <ba****@NOSPAMdevelop.com> wrote in message
news:31**********************@msnews.microsoft.com ...

Then you're in a pickle. You either need to 1) setup a domain user for your ASP.NET application that has the right creds for your AD, 2) enable the delegation for your AD users if you're using integrated auth, or 3) switch to using
basic auth (over SSL, of course).

-Brock
DevelopMentor
http://staff.develop.com/ballen

No i can't.
This project is for a very large organization,
and the department that controls the domain users,
will never allow it.
As a part of the policy, all users must change their passwords
periodically.
So any hard coded user name and password, will eventually fail.
I tried disabling Impersonation, and still login fails.
Thanks.
Sharon.
"Scott Allen" <sc***@nospam.odetocode.com> wrote in message
news:3k********************************@4ax.com...

Hi Sharon:

What you'll have to do is use an identity that the AD server
understands. Perhaps you could run the worker process under a domain
account with enough permissions in AD?

--
Scott
http://www.OdeToCode.com/blogs/scott/
On Thu, 31 Mar 2005 13:29:58 +0200, "Sharon" <sh****@void.null>
wrote:

Thanks Scott.
This is a "bit" confusing.
As i understand it so far, delegation is only possible using
Kerberos,
and all users in Active Directory have to be marked for delegation.
Unfortunately, the fruit basket will not work here, and i've ruled
out
pumping laughter gas into the IT room ventilation system.
What if i revert to the IIS identity before the Active Directory
query?
Problem is, how do i get the WindowsImpersonationContext, to call
Undo
method?
The only other solution is to use Basic authentication, which i
don't

like.

Sharon.

"Scott Allen" <sc***@nospam.odetocode.com> wrote in message
news:n8********************************@4ax.com...

> Yes, I have some links to delegation resources on my blog:
>
> http://odetocode.com/Blogs/scott/arc...2/24/1053.aspx
>
> --
> Scott
> http://www.OdeToCode.com/blogs/scott/
> On Wed, 30 Mar 2005 22:32:02 +0200, "Sharon" <sh****@void.null>
> wrote:
>
>> Hi to all..
>> I'm using impersonation, combined with windows authentication.
>> When the page tries to connect to active directory,
>> i get login failure, due to double hop issue.
>> As i understand it, the iis does not receive a
>> primary token, so how can i authenticate against Active directory?
>> Is it possible to delegate, when using impersonation and windows
>> authentication?
>> Thanks.
>> Sharon.