HttpWebRequest, impersonation and DefaultCredentials problem.

[Jamie]

I'm trying to create a HttpWebRequest object that uses the current logged in
user's credentials.

It's currently setup with:
<identity impersonate="true" /> in web.config
IIS - Windows Authentication
IIS - Anonymous access disabled

making the request like this:
HttpWebRequest webrequest =
(HttpWebRequest)WebRequest.Create("http://myserver/site/page.aspx);
webrequest.Credentials = CredentialCache.DefaultCredentials;
HttpWebResponse webresponse = (HttpWebResponse)webrequest.GetResponse();


I've verified that impersonate is working correctly on the aspx page by
printing out:
System.Security.Principal.WindowsIdentity.GetCurre nt().Name.ToString();

It's also using windows authentication properly, i've verified that by
printing out: Page.User.Identity.Name.ToString();

It only seems to work when I browse to the page from the same system as the
webserver. When i go to another system
and browse to the web page i get a (401) unauthorized error message.

Any ideas?

[Kevin C]

This is a very common pitfall.

Here are a couple links.
[url]http://support.microsoft.com/default.aspx?scid=kb;en-us;810572[/url] (there are
more at the bottom of this linked article too)
[url]http://blogs.geekdojo.net/justin/archive/2003/12/10/430.aspx[/url] .

Long story short, unless you plan to deploy AD or already running (but
obviously not configured for delegation) you will need to come up with a
different means of propagating the credentials.

Kevin Cunningham

"Jamie" <spammerssuck@nospam.com> wrote in message
news:uIWgmLHAEHA.2308@tk2msftngp13.phx.gbl...

> I'm trying to create a HttpWebRequest object that uses the current logged

in

> user's credentials.
>
> It's currently setup with:
> <identity impersonate="true" /> in web.config
> IIS - Windows Authentication
> IIS - Anonymous access disabled
>
> making the request like this:
> HttpWebRequest webrequest =
> (HttpWebRequest)WebRequest.Create("http://myserver/site/page.aspx);
> webrequest.Credentials = CredentialCache.DefaultCredentials;
> HttpWebResponse webresponse = (HttpWebResponse)webrequest.GetResponse();
>
>
> I've verified that impersonate is working correctly on the aspx page by
> printing out:
> System.Security.Principal.WindowsIdentity.GetCurre nt().Name.ToString();
>
> It's also using windows authentication properly, i've verified that by
> printing out: Page.User.Identity.Name.ToString();
>
> It only seems to work when I browse to the page from the same system as

the

> webserver. When i go to another system
> and browse to the web page i get a (401) unauthorized error message.
>
> Any ideas?
>
>