I have several servers (all on the same DC) within an Intranet environment at my company. For simplicity, I'll focus my question on the IIS and SQL Servers. I have an IIS 7.5 web server and a remote SQL Server 2005 on another machine on the domain.
Here are my requirements for what I hope to accomplish:
- Web applications on the IIS server should use some form of authentication (presumably Windows Authentication) such that the user does not need to authenticate as it will use their network user credentials as they are logged into their Windows machines.
- The authentication method should ideally be supported over a VPN connection into the network as well.
- The user identity (Principal) should be passed onto the remote SQL Server such that a query on that server would be able to identify the user in order to support authorizations based on their username. e.g. the query
select suser_sname()
should return the actual username of the person performing actions to the DB via the IIS web application. - The solution should work at least with SQL Server and UNC paths on the network.
- Highly reliable and future proof (i.e. best practice).
I have spent at least a couple weeks (cumulatively) researching this off and on over the past few years as I have had time, yet to no avail. Please help me to understand first, if it possible to meet these requirements (as I am reasonably certain that it is), point me in the right direction as to "HOW" to accomplish this, and what limitations I should consider with said solution.
What I have done so far:
- I have a test app which is reporting Kerberos as the
AuthenticationType
using Windows Auth enabled exclusively. - The Windows Auth is configured to use "Negotiate" as the provider and also Requires Extended Protection with Kernel Mode enabled.
- The App Pool uses .NET 4.0 in Integrated mode.
- The App Pool Identity is a custom domain account which we registered as the SPN.
- The IIS server has Delegation enabled in AD, but the SQL Server does not.
The best I have been able to accomplish is to confirm the presence of the Kerberos http header, but my test app reveals that the App Pool's custom user (the SPN account) is getting passed instead of my own. Here are the results of my test app too if you like:
Result Field Description Test App Code
------ ----------------- -------------
Negotiate Page Authentication Type Page.User.Identity.AuthenticationType
<dc>\<username> Page Identity Page.User.Identity.Name
Kerberos Principal Windows Auth Type WindowsIdentity.GetCurrent().AuthenticationType
<dc>\<spnUser> Principal Windows Identity WindowsIdentity.GetCurrent().Name
<dc>\<username> HttpContext User HttpContext.Current.User.Identity.Name
<dc>\<username> Server Var "LOGON_USER" Request.ServerVariables("LOGON_USER")
<dc>\<username> Thread Current Principal Threading.Thread.CurrentPrincipal.Identity.Name