I have the following setup:
- ServerA, a web server with an asp.net mvc site
- ServerB, a web server with an asp.net Web Api service
The MVC site on ServerA consumes the Web Api service on ServerB. Users log into the MVC site but certain service methods in the Web Api require that the user is in a particular role etc so I need to be able to authenticate the user at the Web Api level.
For this reason, I have tried to set up Kerberos. ServerA has been trusted for delegation. The MVC website is running under a network user account (we'll call it ServiceAccount here) which has been set for delegation. I have set up an SPN for this. However, all requests from the MVC site to the Web Api show that the user is ServiceAccount and not the actual logged in user of the MVC site.
Information around Kerberos seems fragmented so I'm struggling to find a solution. Has anyone got any ideas what may be wrong here?