WCF Web Services - Multiple Hop impersonation on the same server

Question

I have 3 web services, all located on the same server.

My Client calls Service A, which impersonates the client to call Service B, and all is well.

Now, I want to impersonate the caller of service B (which is my username) to call Service C. When I use the same technique as before (AllowedImpersonationLevel = Impersonate, user.Impersonate()), The user doesnt get passed to service C. Instead, Service C sees the user as the user I am running it under in IIS (which is a UPN, not the standard NETWORK SERVICE account).

Is there anything special I need to do to get this working? Is this a delegation issue? (I thought it would not be delegation because they are all on the same server)

Thanks SO!

Answer 1

You can try turning on ASP.Net Compatibility on Service C

In Web.cofig

<system.web>
   <identity impersonate="true"/>
   <authentication mode="Windows"/>
</system.web>
<system.serviceModel>
   <serviceHostingEnvironment aspNetCompatibilityEnabled="true" />
</system.serviceModel>

In your service class

[AspNetCompatibilityRequirements(RequirementsMode = AspNetCompatibilityRequirementsMode.Allowed)]
public class Service : IService
{
    public string ExecuteRequest(string xmlRequest)
    {
        IRequestManager requestManager = new RequestManager();
        return requestManager.ProcessRequest(xmlRequest);
    }

}

Answer 2

I would have expected to have to use delegation since you are crossing process boundaries twice. Have you tried TokenImpersonationLevel.Delegation?

Answer 3

You require delegation in this scenario. The configuration you require is ImpersonationLevel.Delegation (set in config or code). Have a look at the WCF Security Guidance on codeplex it is a very good source. Be careful as achieving delegation, particularly in a production environment, requirements more than simply selecting the correct option in the config file. You need to ensure that the application you connect to, eg SQL server, are configured for delegation, and that certain infrastructure requirements are met within active directory and the like, such as service principal names (SPN).