Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm trying to make a call to the SharePoint Search Webservice from an Asp.NET 4.0 application that does not reside on the SharePoint server. Everything seems to work, accept it is using the AppPool's credentials (a domain service account) to authenticate to SharePoint, which only returns results that that pin has access to. What I need to be able to do is impersonate the calling user, so that I get results for that user and not the domain account. I've set the server that the application is running under up to be trusted for delegation to the http spn that the SharePoint server is using, but I get a 401 error when doing the impersonation in my code. What could I be doing wrong?

share|improve this question
This question is probably better suited for StackOverflow. One question, have you set your application to impersonate the logged on user? – GregD Nov 17 '10 at 18:05
up vote 1 down vote accepted

This is what is known as the "double-hop" limitation of NTLM authentication, which means that it cannot pass the users credentials from one server to the next. See the "Challenge/Respose" section at: In order to get past that, you would need to convert over to either Kerberos Authentication or claims-based (if you have SharePoint 2010). Neither of these options are to be taken on lightly.

However, depending on the needs of your application you might be able to simply use a client-side call to your web service via jQuery ( The call would come from the browser rather than the SharePoint server and thus would pass the credentials of the user.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.