Getting IIS to impersonate the windows user to SQL server in an intranet environment
I am developing an intranet site using C# and ASP.NET MVC. I have SQL Server on one machine and IIS running on a separate machine. I would like a user to visit the intranet site and without prompting the user internet explorer sends the users windows credentials to IIS and these are then passed to sql server meaning sql server can see the user accessing the database.
I am aware of the Kerberos double hop issue and it is this I am trying to get around. At present I can get IE to pass the windows credentials to IIS and authenticate fine. I just cannot get IIS to pass on those credentials to SQL Server and instead the request currently runs under the app pool identity which is set to a domain service account "htu\srv-htu-iis".
My setup is as follows:
<system.web> <authentication mode="Windows" /> <authorization> <deny users="?" /> </authorization> <identity impersonate="true" /> </system.web> <system.webServer> <validation validateIntegratedModeConfiguration="false" /> </system.webServer>
connection string="data source=hturesbsqlp01;initial catalog=R2_Dev;integrated security=True;MultipleActiveResultSets=True;App=EntityFramework""
IIS Authentication Settings
Anonymous Authentication = Disabled ASP.NET Impersonation = Enabled Forms Authentication = Disabled Windows Authentication = Enabled
IIS App Pool Settings
Managed Pipeline = Integrated Identity = htu\srv-htu-iis (domain service account)
Active Directory Settings
The domain service account htu\srv-htu-iis has had a service principal name set which associates our site with the account.
Active directory has
Allow Delagation to any service
SQL Server is running under its own SQL Domain Service account.
I ran the following code tests:
this correctly return the windows credentials of the user accessing the site
return the domain service account "htu\srv-htu-iis" which is what the app pool identity is running under.
Can anyone provide direction as to where I might be going wrong?
Well to anyone visiting this question in the future. I resolved this by restarting the IIS Service...doh! Seems my settings were fine just need a full restart of the service!