I have a web app written in ASP.NET Core 2.0 that authenticates against Azure AD using OpenID Connect. It is running on a machine that is part of an Azure AD domain. The app does have an Application set up in Azure AD.
We would like to use the Azure AD user account to connect to the SQL Server database, which resides on another (windows) machine. So far, I have been attempting to use impersonation to achieve this.
This seems to me to be an instance of the double-hop problem, but nothing I've tried has worked.
- Users will be accessing the site over the internet, outside of the domain, so we can't rely on windows authentication directly
- Authentication via OpenID Connect is working - I get the expected user information and claims
- The claims identity does appear to correspond correctly with the domain user
- I can impersonate a user by obtaining a WindowsIdentity using login credentials (using advapi32)
What I've tried:
- Using S4UClient to obtain a WindowsIdentity - I can obtain the WindowsIdentity, but it does not delegate.
- Setting SPNs for the web server and processes, including creating a service account that the site runs under.
- Assigning Kerberos delegation to the machine
- Creating a WindowsIdentity using the UPN claim - again, I get the WindowsIdentity but cannot connect to the SQL Server.
- Running the site with the SYSTEM account (I know this is not advisable, but it doesn't seem to work anyway, so...)
- Setting Kerberos constrained delegation to the sql server from the web server
- Setting the website to use Windows authentication (with and without anonymous auth) and removed all providers except Negotiate.
- Possibly other things, I will update if/as I think of them.
I'm about ready to start discussing other options with the database team, but having this work would simplify user management.
Any thoughts or suggestions?