在ASP.NET中模拟而不声明密码

Question

I am trying to implement impersonation in ASP.NET. I am following this URL .

Microsoft beautifully explains the process.

However, I am a bit skeptical about declaring the password in web.config

Is there any way, we can achieve impersonation without declaring password?

Thank you

Answer 1

If you want to use user name and password for impersonation you have to store it somewhere.

But here is a list of things you can try:

• Don't store credentials, but ask user to type them in. This will remove maintenance headache from you (user left company, password expired etc)
• Store credentials in web config using encryption
• Use Windows impersonation where currently logged in user passes a security descriptor automagically.