I know there have been mkore than a dozen articles on this topic, but for some reason I have not been able to find a solution.
Server WEB1 has IIS7.5 with a site using Windows Authentication (kernel mode off, provider: "negotiate:kerberos") and a AppPool running as NETWORK SERVICE and in Integrated mode.
Impersonation is working fine, but delegation to another server STORAGE1 providing CIFS is not.
I get permission errors when trying to access a UNC located there.
WEB1's computer object in AD has been configured to delegate with "Trust this computer for delegation to any service (Kerberos only)" and I have also tried "Trust this computer for delegation to specified services only : User Kerberos only" with services "CIFS/STORAGE1" & "HOST/STORAGE1" (I know cifs is included with host, I figured that it couldn't hurt using both) with 'Expanded' selected to include the FQDN for the CIFS and HOST service too.
I have a packet capture of a file operation that fails from WEB1 to STORAGE1 and it looks like the message for auth only include the hostname WEB1.
I created a test share with the EVERYONE account given full access on the share level and the NTFS level, and I still get access denied error messages.
I have tried using DELEGCONFIG V2. While I can get impersonation to WEB1 all ticked off, the 2nd hop to STORAGE1 cannot be verified and the delegation level is only at "IMPERSONATE".
At this point I really need to get this application deployed so I am happy to use any work-arounds while I try and find the root cause.
If you have ANYTHING to contribute (suggestions, questions, anything) I would greatly appreciate it.
Help me SF, you are my only hope!
EDIT: In case it is helpful, the code to impersonate the authenticated user for the file operations on STORAGE1 looks like:
WindowsImpersonationContext imp = ((WindowsIdentity)User.Identity).Impersonate(); FileInfo fi = Classes.File(id.Value); bool dir = fi.Directory.Exists; bool file = fi.Exists; imp.Undo();