G
Guest
Hi
I have a small ASP.NET application that is running on a dedicated web server. This application is attempting to make a remote DCOM call to another server in order to log into another system as a specified user. The user should be be IIS authenticated user
I am getting what I believe is some strange behaviour...I have tested the following combinations (IIS Anonymous access is off in all of these)
1. machine.config <impersonate = false>, IIS Basic Authentication off, Integrated Windows Authentication on. In this config, the application does not work, causing an "Access denied" error when attempting to create a connection to the remote databas
2. machine.config <impersonate = true user & password supplied>. This works fine in all configurations, however I require the login to be done with the username of the user connecting to the site, not this specified use
3. machine.config <impersonate = true no username/password supplied>, IIS Basic Authentication off, Integrated Windows Authentication on. This causes the same error shown in (1
4. machine.config <impersonate = true no username/password supplied>, IIS Basic Authentication on, Integrated Windows Authentication on. This allows the user access to the page, but then requests a username/password login when attempting to create the remote connection. No username allows access, however, and the user is given "Not authorised" pag
5. machine.config <impersonate = true no username/password supplied>, IIS Basic Authentication on, Integrated Windows Authentication off. This works perfectly
I am a little jumpy about using only Basic Authentication for this application, as I think we need a little more security than that.
I suppose my basic question is why does this work when the user is forced to login (basic authentication) and not work when the username is found using Integrated Windows authentication? What is different between the two authenticated users
This has been driving me mad for a while now, so any help is gratefully accepted!
Thank
Simon
I have a small ASP.NET application that is running on a dedicated web server. This application is attempting to make a remote DCOM call to another server in order to log into another system as a specified user. The user should be be IIS authenticated user
I am getting what I believe is some strange behaviour...I have tested the following combinations (IIS Anonymous access is off in all of these)
1. machine.config <impersonate = false>, IIS Basic Authentication off, Integrated Windows Authentication on. In this config, the application does not work, causing an "Access denied" error when attempting to create a connection to the remote databas
2. machine.config <impersonate = true user & password supplied>. This works fine in all configurations, however I require the login to be done with the username of the user connecting to the site, not this specified use
3. machine.config <impersonate = true no username/password supplied>, IIS Basic Authentication off, Integrated Windows Authentication on. This causes the same error shown in (1
4. machine.config <impersonate = true no username/password supplied>, IIS Basic Authentication on, Integrated Windows Authentication on. This allows the user access to the page, but then requests a username/password login when attempting to create the remote connection. No username allows access, however, and the user is given "Not authorised" pag
5. machine.config <impersonate = true no username/password supplied>, IIS Basic Authentication on, Integrated Windows Authentication off. This works perfectly
I am a little jumpy about using only Basic Authentication for this application, as I think we need a little more security than that.
I suppose my basic question is why does this work when the user is forced to login (basic authentication) and not work when the username is found using Integrated Windows authentication? What is different between the two authenticated users
This has been driving me mad for a while now, so any help is gratefully accepted!
Thank
Simon