Re: making a Web Request from my server

Sorry this one dropped off my radar slightly.

I'm aware of the Double hop issue and thought I had it covered, we currently authenticate via the same server against remote databases as the impersonated user fine.

If we assume (and I know it's a big assumption) that I've got the kerberos setting of the originating web server correct. Would I need to reconfigure the servers That I'm connecting to?

This is now a purely academic question as it's unlikely that I will have the time (and funding) to compete as planned.

The interim solution was to open a raw TCP/IP socket to port 80, if it fails assume the system is down. This is mostly successful but doesn't deal with an app pool that has been suspend as that still accepts connections.


Steven Cheng[MSFT] wrote:
Hi MC,

Any progress on this issue? If there is anything else we can help, please feel free to post here.

Sincerely,

Steven Cheng

Microsoft MSDN Online Support Lead


This posting is provided "AS IS" with no warranties, and confers no rights.
--------------------

Date: Wed, 19 Dec 2007 03:14:28 GMT
Subject: RE: making a Web Request from my server


Hi MC,

As for this issue, since you mentioned that the webrequest call in VS Test Server works, but fails in deployment environment(in IIS), I think it is likely caused by security account problem.

When running in VS Test Server, the application is running under your

logon

user account(maybe a domain account) that can be forwarded to remote machine.

However, in IIS server, the running process account is IIS service account which maybe a local account. As you said that you've use "windows authentication" and impersonate the client user. This can only make the worker thread (for processing each requesty) running under the client impersonated user, but if you make remote access(such as webrequest call

or

access remote file share), the security identity impersonated from client authenticated user can not be forwarded to a further remote machine. This is called "double hop" limitation.

For your scenario, I think the reasonable way to resolve the problem is either:

** use a domain account as the process account for your ASP.NET

application

in IIS
** programmatically impersonate(need username password credentials) when you want to send remote webrequest call

#How To: Use Impersonation and Delegation in ASP.NET 2.0
http://msdn2.microsoft.com/en-us/library/ms998351.aspx

If you want more info about double hop issue, you can have a look at the following links:

http://weblogs.asp.net/avnerk/archive/2004/09/22/232967.aspx

http://blogs.msdn.com/nunos/archive/2004/03/12/88468.aspx

Sincerely,

Steven Cheng

Microsoft MSDN Online Support Lead





.

Relevant Pages

  • Re: Requiring User Name and Password for Connection to Network Res
    ... If you don't have a matching account on the server, and if the Guest account on ... then the server should request that you authenticate ...
    (microsoft.public.windowsxp.network_web)
  • Re: Requiring User Name and Password for Connection to Network Res
    ... connected via a Peer to Peer LAN with one another and a shared network ... If you don't have a matching account on the server, and if the Guest account on ... then the server should request that you authenticate ...
    (microsoft.public.windowsxp.network_web)
  • Re: Requiring User Name and Password for Connection to Network Res
    ... with an account that is mirrored on the server, ... If you're logged in locally with an account that is NOT mirrored on the ... server, and Guest is activated for network access, you'll authenticate with ... Check your user name and password blah ...
    (microsoft.public.windowsxp.network_web)
  • Re: Multiple AD domains and MIT Kerberos
    ... an account that is not in the root domain of the forest. ... account from any of the domains in the forest to authenticate to the AIX ... As son as we place the target SPN on a sub-domain account only ... host/host.example.exm@xxxxxxxxxxx and when accessing the web server ...
    (comp.protocols.kerberos)
  • Re: Some emails not reaching our server
    ... I ran a test to see if the message ever reached our server and for some ... I had a customer send me an email from the account that ... > found 6 servers that never reach us and they all stop on the same hop. ... > lookups from that server come back with the correct DNS information. ...
    (microsoft.public.exchange2000.admin)