How can I use Windows Authentication to allow group members access to my web application

Question

I under stand how to configure .NET Authorization under Windows Authentication to limit access to a website to specific users and groups.

However, for a web application, how do I set the database connection to impersonate the logged in user? The SQl database is on another server.

If this strictly IIS configuration? Code? Both? For an individual, I can add the credentials via the <identity> element, but what about impersonating AD group members?

The SQL Server is set up to to only allow connections from a specific group. The DBA set this up, I do not know the details.

Setting

<identity impersonate="true" />

and Integrated Security=true results in the following error:

HTTP Error 500.24 - Internal Server Error
An ASP.NET setting has been detected that does not apply in
Integrated managed pipeline mode.

Answer 1

Using <identity impersonate="true" />

in your web.config along with Integrated Security=true; in your connection string should do this for you.

It will be up to the database to discover if the Active Directory User supplied is in the appropriate AD Group.