lundi 8 avril 2019

Trying to get an Impersonation Level of Delegate in C# Web API

I am trying to setup a Web API that will, when needed, call a backend Server with the calling Users creds.

So, User (User1) calls API, API runs under IIS Application Pool with its own Service Account (WebApp) which I am trying to get to impersonate User1 to access backend server.

I can Impersonate but only to an ImpersonationLevel of Impersonate which only gives me access to local resources. To Impersonate to a remote server I need an ImpersonationLevel of Delegate.

Compiling using VS2017, C# Web Project, ASP.NET Web Application (.NET Framework) with an Empty project template with "Web API" checked. No option to set Authentication with these options.

Code to Impersonate is

WindowsImpersonationContext myImpersonation = ((System.Security.Principal.WindowsIdentity)User.Identity)Impersonate();

Using this code to show Impersonation Level (have also verified with local resources and WireShark).

WindowsIdentity.GetCurrent().ImpersonationLevel

I think I have set Kerberos delegation OK including SPNs.

Can anyone tell me if the code above should give me an ImpersonationLevel of Delegate (Is the code OK)? If not what should I be doing in code? Are the Project settings OK?




Aucun commentaire:

Enregistrer un commentaire