HttpWebRequest, impersonation and DefaultCredentials problem.

[Jamie]

I'm trying to create a HttpWebRequest object that uses the current logged in
user's credentials.

It's currently setup with:
<identity impersonate="true" /> in web.config
IIS - Windows Authentication
IIS - Anonymous access disabled

making the request like this:
HttpWebRequest webrequest =
(HttpWebRequest)WebRequest.Create("http://myserver/site/page.aspx);
webrequest.Credentials = CredentialCache.DefaultCredentials;
HttpWebResponse webresponse = (HttpWebResponse)webrequest.GetResponse();


I've verified that impersonate is working correctly on the aspx page by
printing out:
System.Security.Principal.WindowsIdentity.GetCurrent().Name.ToString();

It's also using windows authentication properly, i've verified that by
printing out: Page.User.Identity.Name.ToString();

It only seems to work when I browse to the page from the same system as the
webserver. When i go to another system
and browse to the web page i get a (401) unauthorized error message.

Any ideas?

 

[Kevin C]

This is a very common pitfall.

Here are a couple links.
http://support.microsoft.com/default.aspx?scid=kb;en-us;810572 (there are
more at the bottom of this linked article too)
http://blogs.geekdojo.net/justin/archive/2003/12/10/430.aspx .

Long story short, unless you plan to deploy AD or already running (but
obviously not configured for delegation) you will need to come up with a
different means of propagating the credentials.

Kevin Cunningham