Implementing ASP.NET Impersonation

Impersonation, instead of writing ASP.NET code for authentication and authorization, employs IIS to authenticate the user. If the user is authenticated, it passes an authenticated token to the ASP.NET application; otherwise , it passes an unauthenticated token. In an ASP.NET application, if the impersonation is enabled, ASP.NET assumes the client identity and relies on the settings in the NTFS directories and files to permit or deny the request. If impersonation is disabled, it runs with the local machine identity. For ASP compatibility, impersonation is disabled by default.

To enable impersonation, configure the configuration file in the application root directory as follows .

[View full width]

 
 [View full width] 
 <identity impersonate="true" name="Username" password="Password" />  [17]  

^[17] In .NET Framework version 1.1 you can put the password in an encrypted (DPAPI) registry key. There is a hotfix for .NET Framework version 1.0. Read more about it at http://support.microsoft.com /default.aspx?scid=kb;en-us;329250.