ASP.Net web application trying to use Impersonation and Delegation to connect to SQL Server

asp.net iis-7 kerberos delegation
Graham Clark picture Graham Clark · Jan 20, 2010 · Viewed 15.2k times · Source

I'm trying to use Impersonation and Delegation in an intranet ASP.Net web-app in order to pass authenticated users' credentials onto a SQL Server.

The web server and SQL server are two separate machines, but in the same domain, so Delegation is required.

I've done the following:

  • set <authentication mode="Windows"/> and <identity impersonate="true"/> in my web-app's web.config.
  • enabled Constrained Delegation from the web server to the MSSQLSvc service on the SQL Server, in Active Directory.
  • enabled only Windows Authentication in the website, through IIS.

Apparently this should all work, but it doesn't (the SQL Server is denying access to the anonymous user - "Login failed for user 'NT AUTHORITY\ANONYMOUS LOGON'").

In IIS7, the Application Pool is set to use Integrated Pipleline Mode and is running with the NetworkService Identity. The website only has Windows Authentication enabled, Extended Protection is Off, Kernel-mode authentication is enabled, and NTLM is the provider.

All the web pages I've read seem to indicate that my setup should work. What am I missing?

Answer

Graham Clark picture Graham Clark · Jan 20, 2010

I've discovered the answer:

The Windows Authentication provider in IIS7 must be set to Negotiate:Kerberos, not NTLM. This means that the Kernel-mode authentication setting must be disabled. This seems to be fine. I think I'm right in saying that Kernel-mode authentication is required when using a custom identity, i.e. one specific identity. Delegation can use an arbitrary number of identities. So all is well.

I've written a blog post about this too, which goes into a bit more detail.

Related questions

IIS 500.19 with 0x80070005 The requested page cannot be accessed because the related configuration data for the page is invalid error

I want to upload my own asp.net website on IIS with IIS Manager. But when I do this, I get the following error HTTP Error 500.19 - Internal Server Error The requested page cannot be accessed because the related configuration …

Read More
How do I resolve "HTTP Error 500.19 - Internal Server Error" on IIS7.0

What causes this error, how can I fix it? Detailed Error Information Module IIS Web Core Notification BeginRequest Handler Not yet determined Error Code 0x8007052e Config Error Can not log on locally to C:\inetpub\wwwroot as user administrator …

Read More
Cannot read configuration file due to insufficient permissions

I've recently encountered an error trying to host my asp.net site with IIS. I have found a solution that many swear by. Solution: Add IIS_IUSRS with Read permission on files in the folder Change IIS authentication method to …

Read More