ASP.NET Core 2.1，C＃应用程序，C＃Web服务，访问SQL数据库

Question

I have been fighting with the following problem all week and was hoping somebody could be of help. My application has three parts.

1. a SQL database (own machine),
2. a web service (IIS machine) and
3. the application itself (also on the same IIS as the web service).

The application talks to the web service which in turn gets data from the SQL database. I am using windows authentication. When the app is running locally on my machine it receives data from the web service without a problem. When I host the application on the web server (both the application and the web service are hosted on the same machine) I get a 401 (authentication) error.

in the app I get the current windows user using in the controller:

    System.Security.Claims.ClaimsPrincipal currentUser = this.User;
    WindowsIdentity identity = (WindowsIdentity) currentUser.Identity;

To access the web service (which in turn accesses the database) I use this code:

    await WindowsIdentity.RunImpersonated(identity.AccessToken, async () =>
    {
        request = new HttpRequestMessage(HttpMethod.Get, uri);
    });

I have checked on IIS that I am getting the correct identity when the code is running on the server -> I do actually get the Windows user and not the IIS AppPool user (I was getting that previously before I swapped to using System.Security.Claims.ClaimsPrincipal).

I know the problem is that the identity is not being passed to the web service although I am using the correct user. Any ideas?

Answer 1

ok, so after a lot of online research I found the problem. Since 2003 Microsoft has implemented a loopback check for Man-in-the-Middle attacks - this was causing problems for me as my FQDN was not the same as the URL base address. I deactivated this check ( http://artykul8.com/2010/01/windows-server-iis-sharepoint-and-null-sid-audit-failures/ ) and now my credentials are being passed through correctly. As this is a test server I don't have a problem with this solution :)