An IIS 6 Server on Windows Server 2003 has a virtual directory configured with anonymous access disabled and Integrated Windows authentication enabled. The directory in which the page exists restricts access via NTFS access control lists. Client certificates are required to access this server.
The page in question has the user's identity displayed on the page, and when a user from my domain MyDomain\friend went to the page as he often does, he saw that he had been identified as OtherDomain\stranger. This stranger has never set foot in the building where the user was sitting because it's a controlled area and that computer is manned 24/7. A small number of people were in the area around this computer and all said that the same user MyDomain\friend was seated there for hours prior to this event.
This is the IIS log entry from when the user first entered the page. I've changed the names and replaced the IP address with xx. The same IP address was on both lines. The 200 is correct for both users because "stranger" is a potential corporate consumer of the data, although a look at the logs indicates that "stranger" has not visited this web server in the last 30 days or so, and possibly ever. "Friend" noticed because the application on Page.aspx presents different data to "stranger" than to "friend".
The username given corresponds to the one he saw on screen. 3 minutes later he refreshed the page and it came up normally.
12:47:01 GET /Dir/Page.aspx - 443 OtherDomain\stranger xx.xx.xx.xx 200 0
12:50:44 GET /Dir/Page.aspx - 443 MyDomain\friend xx.xx.xx.xx 200 0
This server has been in place for over 5 years and I've not had anything like this reported before. When the administrator looked in MyDomain\friend's Active directory, it had nothing out of the ordinary and there were no pointers to other ids, alias, or anything of the sort.
How could this happen? Is there a way to prevent it? It seems to me that if one of my users could accidentally impersonate another user, there is a way a clever person could find a way to impersonate other users to gain access to information.