Security :: Impersonation In SharePoint?
Apr 13, 2010
I noticed impersonation is turned on by default in MOSS web configs. I tried disabling it but the web app returns an error. So my question, is it possible to disable impersonation in MOSS? If it is possible are there any special considerations I should be aware of?
If you're interested in why I need to do this...I need to have a custom web part (developed with SmartPart) talk to a separate SQL server using the application pool rather than the current user (Kerberos is enabled). If I set the authentication mode to NTLM I get NTAuthority/ANonymous login errors from my SQL connection. If I turn Kerberos on, the currently logged in user's credentials are passed. If I hard code the user id and password in the connection string it seems to ignore it and default to whichever security model is in place (NTLM or Kerberos).
View 6 Replies
Similar Messages:
May 12, 2010
I currently have a client with a SharePoint site that wants to incorporate an (already written) ASP.NET application within a webpart in the SharePoint site. The ASP.net application currently uses an IIS impersonation account to connect to the SQL database.
Some added functionality the client is requesting would require me to grab the user's windows login identity to use the SharePoint UserProfileWebService to query the PropertyPages for that specific user. Because the (already written) ASP.NET application uses impersonation, when I grab the WindowsIdentity.GetCurrent().Name, I get the impersonation account and not the actual user's account.
Is there a way to keep the current setup (impersonation account on IIS to connect to SQL) and still grab the logged in user's credentials? Or would a better way about this be to change IIS to consume the Windows Identity of the logged in user and encrypt the connection string in the web.config?
View 2 Replies
Oct 4, 2010
I have an app that uses impersonation to gain access to a database (on server separate from IIS). The app connects to the database using a trusted connection and seems to be working just fine. However, we get these logon failure events in the security event viewer:
[Code]....
It must have something to do with impersonation because the login failure is for the domain account which my app is impersonating under. But again, the app is working fine so I'm having a hard time figuring out how to stop these logon failures.
View 2 Replies
Mar 4, 2010
what is impersonation in asp.net? Is authentication and impersonation both are same ?I googled and found both are one type of security.
View 3 Replies
Mar 13, 2011
We are in the process of building ASP.NET windows auth application. Where user need to interact with other internal system using the same single sign on. To interact application DB the system relies on App Pool account, for this we are every time doing the imporsanation to before every DB call. We can not have all useres added to DB, or create an SQL account. Which requires password and user to store in Web Config. We can encrypt it again you encrypt with what and etc ..So we have one windows account wihich same windows account used for our app pool as well.
I would like to know from the team is what is the best way to do the DB connection in this case?What is the implcations if we imporsanate the DB calls based on the app pool account ? Is it a best practice? I have read it creates its own thred and stuff, Do we need to worry ?
View 1 Replies
Jun 30, 2010
I've added the identity tag for impersonation. I've configured my site under IIS 5.1. The identity i've added is my domain username/password. But when I run any exe file from my asp.net file, it still runs under "aspnet" user name.
View 1 Replies
Aug 6, 2010
suggest me a good Video to look at that can give me a start on how to use Impersonation?
View 1 Replies
Dec 27, 2010
I am trying to use impersonation on an IIS server while I access Active Directory data. The following code works fine on the localmachine but when I put this same code on an IIS server I get an error: System.DirectoryServices.DirectoryServicesCOMException: An operations error occurred.
If I remove the top 4 lines and add my ID and passcode to the DirectoryEntry, everything works fine. I would prefer to not have my id and passcode anywhere on the web. Any ideas on how to fix this? Dim impersonationContext As System.Security.Principal.WindowsImpersonationContext
View 2 Replies
Sep 2, 2010
I am using impersonation in my ASP.NET application to access network resources. It works fine when I run on my computer, however when I setup the site on IIS6, it does not work. Is there some extra configuration, I need make in IIS for it?1. I created an account "TestUser" with the privilege as "act as operating system" on a server that has the resources which I want to access.2. The impersonation works fine on my computer, when I run from visual studio. My computer is on the network under same domain where the "TestUser" is created.
View 5 Replies
Sep 14, 2010
I am running ASP.MVC 2 with LINQ2SQL on IIS 7.5. I have enabled Windows Authentication with ASP.NET Impersonation. Application pool is running on different domain account [AsiaTestWebUser] is part of windows group [AsiaTestUserGrp]When i enable Asp.net impersonation on MVC web site. Once i hit LogOn from the default page , it's throwing me with below error message
[Code]....
View 1 Replies
Jun 14, 2010
In my Web.config of my ASP.NET app I have set below:
<authentication
mode="Windows"/>
<identity
impersonate="true"
/>
View 2 Replies
Oct 12, 2010
I have an Intranet which is on IIS 7.0. I want to authenticate my users and know who is logged in. What options do I have to set in IIS Authentication part that my users do not need to type their user name and password to login to Intranet. I have set the Authentication to Basic and Impersonation, but it is asking user name and password.
View 3 Replies
Apr 9, 2010
I have a service account SvcAcc to manage contacts (add/update/delete contacts) for all the exchange users. I Impersonate using the below cmdlet to manage contacts but it also allows SvcAcc to perform other functions (such as send email etc) on behalf of the user.
cmdlet
New-ManagementRoleAssignment -Name:impersonationAssignmentName -Role:ApplicationImpersonation -User:serviceAccount
//impersonation code
service.Credentials = new NetworkCredential(ServiceAccountUserName, ServiceAccountPassword, domain);
service.ImpersonatedUserId = new ImpersonatedUserId(ConnectingIdType.SmtpAddress, userEmail);
View 3 Replies
Mar 1, 2011
I have been looking for code samples on how to do impersation with forms authentication for the current logged on user. I have found samples on the internet and this site and most seem to refer to windows authentication not forms. I am wanting to run specific blocks of code under the current user's credentials to access lists of files on servers on the internal network and display them in the page.I found this article on MSN for using impersonation in various ways, http://support.microsoft.com/kb/306158 and I was able to use the section of code where it describes how to Impersonate a Specific User in Code. This works quite well with forms authentication but requires a service account in AD with login and password. One the same page is a sample of how to impersonate the authenticated user in code, but this only seems to work with windows authentication. As have all other samples I could find, such as the article here,http://www.codedigest.com/codedigest/9-identity-impersonate-at-code-level-in-asp-net.aspx. But trying those with forms authentication results in the error "Unable to cast object of ype 'System.Security.Principal.GenericIdentity' to type 'System.Security.Principal.WindowsIdentity'" Since there is no windows identity with forms authentication.Can anyone point to an article that describes how to do impersonation with forms authentication at the code level?
View 4 Replies
Oct 19, 2010
I need to pass the credential of the logged in user to the DB, which is on a different server, is it that Impersation can only work if the DB is on the same machine as the web server? How can I flow the credential to the the server?
View 2 Replies
Oct 28, 2010
It took me 6 hours to figure this one out and I'm wondering if someone can give me an answer why it has to work this way. I have two PCs, one is a webserver win2k 2003 and the other is the file server running Windows XP. Both PCs are on the same company domain therefore they can see each user. The share folder has NETWORK, NETWORK SERVICE, USERS (which include IIS authenticated users), a LOCAL account, and a specific User (which is me) that is given access to read. In my web application, I call a server.mappath. In IIS6.0, anonymous is disabled so users use integrated Windows Authentication. I can see this by verifiying User.Identity.Name.ToString(); Next, I also check WindowsIdentity.GetCurrent().Name.ToString();. In my first run, I set impersonate to true and thats it. Both User.Identity and both Windows.Identity show: mydomainsmith_B as an example.
When trying to access the UNC virtual path whcih has "Always use the authenticated user's credentials when validating access to the network directory" checked. This means , IIS6.0 will pass mydomainsmith_B credentials to the file server. I get an access denied which is verified by a thrown exception. I go back and check the file server and under the security tabs, I did add myself which shows smith_B under the security and for kicks, I'm also under Share tab.
Next, I try to authenticate using a "LOCAL" account on the file server. The local account is called username/password: temp/temp. So I set web.config to impersonate=true, userName=temp password=temp. Okay, so I go back into IIS 6.0 and for the virtual directory, I go to "Connect As" and set Username and password to: temp/temp and un-check "always use the authenticated user's credential". Finally, i reload the page. This time the page shows me:
User.Identity.Name: mydomainsmith_B
WindowsIdentity.GetCurrent().Name: temp
perfect, so now I'm impersonating temp. I click a button to access the UNC path and boom, it all works. So why doesn't my local PC authenticate ME, as MYSELF, which is on the domain, which is on the same domain. Why do I have to impersonate a local account to the file server? Why can't I just impersonate myself? Also, If I disable impersonation, it becomes NT AUTHORITYNETWORK SERVICE. This service also can't access the UNC path even when I have enabled the same security and same share settings.
View 1 Replies
Jan 10, 2011
I am trying to set up impersonation for a vrtual directory in one of my sites. If I set the impersonation to
<identity impersonate="true" userName="Domainuser" password="password"/>
it works perfectly.However, if I set the impersonation to
<identity impersonate="true"/>
and then go into the Properties of the Virtual Directory and set the Network Directory to Connect As my domain user it does not work.
Shouldn't the impersonation look at this user account? Or is it looking at my Anonymous Access account?
Also, do I need Windows authentication enabled for this to work?
View 2 Replies
Dec 9, 2010
I have a Win7 Pro laptop that I do my development on and it is in Domain1.I have a Win2003 server that has a shared folder on it and it is in Domain2. I have an impersonation routine in my code that allows IO to occur between my laptop and the server, it works.When I move the code to my Win2003 hosted servers the impersonation does not authenticate to the shared folder.Is there some kind of domain policy, IIS or Windows 2003 setting that prevents impersonation from occurring (there no impersonation in my web.config, only in code)? I saw in the security faq something about running the -ga command in order to grant the
permissions. What is this referring to exactly?
View 17 Replies
Jun 4, 2010
My Windows Server 2008 server hosts an ASP.net application that uses impersonation. The application works as long as the user being impersonated remains logged on to the server. However, when the user logs off, clients can no longer view the web pages. They get a cryptic error instead. How can I configure the server to work without the impersonated user remaining logged on?
View 5 Replies
Aug 2, 2010
I run a simple .aspx website on a Windows Server 2008 machine.There is no impersonation, and System.Security.Principal.WindowsIdentity.GetCurrent().Name returns NT AUTHORITYNETWORK SERVICE, which it the account which the application pool runs.I tried to test the security of the application and server by removing file permissions to the .aspx files. I was greatly worried when the website continued to run without problem (it should not have been able to read the .aspx files).By turning on file level auditing, I discovered that the .aspx files were being read by the machine$ account (if the machine is called Serv1, then the files would be read by the Serv1$ account, which seems to have access to all files on the local machine).Is this a security breach or is this behaviour by design ?
View 4 Replies
Jun 4, 2010
Programmatic impersonation access denied to UNC path
[WebMethod]
View 1 Replies
Jan 14, 2010
I set the impersonation to true in web config. First time accessing the page, it implements the impersonation to access Sql sERVer. However the second request and so on to page, it does not implement impersonation, rather it uses NT AUTHORITYIUSR user account.
I need to impersonate based on the user login all the time.. How can I achieve this?
View 13 Replies
Jun 30, 2010
I have an ASP.NET site that uses impersonation. As the impersonated user I use a domain user (not a local machine user). The site is hosted in IIS 6 running on Windows 2003. In IIS 6 for directory security windows authentication is ticked.The site has been running now for about 6 months without any problem. However since about a week back the site has started spuring up really wierd errors. For one, users cannot access the site anymore. When accessing a windows authentication dialog box appears having the user to enter the credentials. However these credentials are not accepted and the standard unauthorized page is displayed
View 7 Replies
Apr 26, 2010
If you use anonymous access + impersonation of a windows domain account to access a file on a network share, is the password sent in clear text?
View 3 Replies
Nov 10, 2010
I want to use IIS impersonation to connecto to a SQL server database as the user who is currently accessing a website. This is for auditing and security reasons. I've done some reading and discovered that because the SQL Server is on a sepearate physical server I need to enable Protocol Transitioning and Constrained delegation for the server that's running IIS. This is the article that I found. [URL] I didn't realise at the time I first read it but this article has the following header. Retired Content
This content is outdated and is no longer being maintained. It is provided as a courtesy for individuals who are still using these technologies. This page may contain URLs that were valid when originally published, but now link to sites or pages that no longer exist. What I want to know is, does the information in the article still apply, if I want to impersonate the user all the way to the SQL Server, do i still need Constrained Delegation or has this been implemented in some other way for ASP.NET 4?
View 1 Replies
