Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have an intranet web application.

Even though I've set "Windows Authentication = Enabled" (and all other Authentications are disabled), when the application tries to access resources, it is treated as though it is run by the same user that runs the Application Pool's process.

Is there a problem here, or do I not understand correctly how Windows Authentication works?
If I did get it wrong, is there another way to make the application run as the client user?

share|improve this question
up vote 2 down vote accepted

Remote resources? If using Kerberos, there are a few caveats to get that working correctly. For an IIS computer to impersonate a user when accessing remote resources, it needs to generate a delegation-level token for the user.

If the application pool is running under a custom identity (it usually is in these scenarios), the account needs to have the ability perform unconstrained delegation. On the account Delegation tab in Active Directory Users and Computers, select "Trust this user for delegation to any service (Kerberos only)".

If you don't see the Delegation tab, it means an SPN has not been assigned to the account. That needs to be corrected first using the setspn.exe command.

The IIS identity account needs to have the "Act as part of the operating system" privilege (SetTCB privilege) on the IIS server(s).

Download the Delegation Configuration tool and add that as an application on the web site. It lets you browse to the application url and generate a report that determines if delegation is configured correctly.

It's also very easy for the code to check the token type to determine if it is a delegation token or not, and log that information to a file.

Summary (Kerberos Protocol Transition and Constrained Delegation)

How To: Use Impersonation and Delegation in ASP.NET 2.0

DelegConfig download

share|improve this answer

You have to add impersonation to your web.config:

<identity impersonate="true" />

share|improve this answer
Is that the same as defining "ASP.Net Impersonation - Enabled" in the IIS? Because I've tried that, to no avail. – Yehuda Shapira Jun 20 '12 at 14:11
Yes, that is the same, and should definitely work. (Windows auth + ASP.NET Impersonation) – MichelZ Jun 20 '12 at 14:18

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.