Kerberos Delegation issue! Web server isn't utilizing client's credentials to access remote re
I'm developing an Intranet application that requires the Web server to impersonate a client to access remote resources (the app accesses my company's exchange server using WebDAV) on behalf of the client (all within the same Active Directory domain). However, I'm having a problem with the authentication delegation part- I don't think the user's credentials are being passed to the exchange server).
In my app, I attempt to use the DefaultCredentials of the user (which should be the user credentials of the logged-in user, since we use Integrated Windows authentication):
Request.Credentials = CredentialCache.DefaultCredentials;
If I build my own CredentialCache object (complete with hard-coded username, password, and domain) and set Request.Credentials to it, the app works fine.
Also, when running off my own computer's server (localhost)- i.e., delegation is not an issue- the app also works as expected.
I've confirmed that my server computer is trusted for delegation within Active Directory ('trust computer for delegation') . I've also confirmed that the client user accounts can be delegated within Active Directory.web.config file for ASP.NET app:
<identityimpersonate="true"/>
<authenticationmode="Windows"/>machine.config file on server:
<processModel
userName="SYSTEM"
comImpersonationLevel="Impersonate" (also tried "delegate")
..
<identityimpersonate="false"userName=""password=""/> (also tried "true")
According to
this link,The server process account (the user account under which the server process is running, or the computer account if the process is running under the local SYSTEM account) must be marked as trusted for delegation in Active Directory.
I figure I must be missing something that prevents the server process account (SYSTEM, right?) to be trusted for delegation.. or is it something else?
I am using:
.NET Framework, ASP.NET 1.1
C#
Windows Server 2003
Exchange 2003
Any help would be greatly appreciated!
Thanks!!
