Reply to thread

Message: [QUOTE="Lior Amar, post: 4270673"] Your workaround is working cause the System account has extended privileges and can act as part of the system. The LogonUser should give you a Token that is imperonatable and should let you accomplish what you want (unless your login on as a Sensitive account). That it doesn't is very strange. Your ASPX page is impersonating a token that is coming from a client. What OS's are running on the Client and Server? The only reason I ask, is that LogonUser is a very bad API to use since it requires a cleartext password. If both client and server are running on 2K or above and the network is configured with ActiveDirectory then you should be able to utilize Kerberos security and have the clients Token delegated to the next machine. When you call DuplicateTokenEx, instead of passing it SecurityImpersonate..pass it SecurityDelegation. If the token you received is coming in with the Negotiate authentication then you should be ok to delegate the credentials to the next machine. Multiple hops are a PAIN IN THE A** in windows but once you get the configuration down, it's just a thing of beauty. Read this article, it shows how to set this up: [URL]http://msdn.microsoft.com/library/default.asp?url=/library/en-us/dnnetsec/ht[/URL] ml/SecNetHT05.asp Now, for why it's not working under ASPNET but is under System. The ASPNET account does not have the Act as part of System policy turned on. Pretty sure that once you turn that on your problem will go away. Give it a try and let me know... Lior [/QUOTE]

Verification