I'm trying to make a call to the SharePoint Search Webservice from an Asp.NET 4.0 application that does not reside on the SharePoint server. Everything seems to work, accept it is using the AppPool's credentials (a domain service account) to authenticate to SharePoint, which only returns results that that pin has access to. What I need to be able to do is impersonate the calling user, so that I get results for that user and not the domain account. I've set the server that the application is running under up to be trusted for delegation to the http spn that the SharePoint server is using, but I get a 401 error when doing the impersonation in my code. What could I be doing wrong?
This is what is known as the "double-hop" limitation of NTLM authentication, which means that it cannot pass the users credentials from one server to the next. See the "Challenge/Respose" section at: http://support.microsoft.com/kb/264921. In order to get past that, you would need to convert over to either Kerberos Authentication or claims-based (if you have SharePoint 2010). Neither of these options are to be taken on lightly.
However, depending on the needs of your application you might be able to simply use a client-side call to your web service via jQuery (http://jquery.com/). The call would come from the browser rather than the SharePoint server and thus would pass the credentials of the user.