Impersonation and UnauthorizedAccessException

[kevingeist]

I hope someone can help me with this. Please tell me what I'm not
seeing. In my web app, I'm trying to create files to a common
directory. Only some network IDs have access to write to this
directory.

In my web.config I have:

<authentication mode="Windows"/>
<identity impersonate="true"/>


in my default.aspx.vb I have:
Dim impersonationContext As
System.Security.Principal.WindowsImpersonationContext
Dim currentWindowsIdentity As
System.Security.Principal.WindowsIdentity
....
currentWindowsIdentity = CType(User.Identity,
System.Security.Principal.WindowsIdentity)
impersonationContext = currentWindowsIdentity.Impersonate()
filePath = System.IO.Path.Combine("w:\kbg\", FileName)
My.Computer.FileSystem.WriteAllText(filePath, strData, False)
impersonationContext.Undo()

When I run the app on the localhost it works great. If I comment out
the impersonationContext line, the app fail because the ASPNET account
does not have access to write to the directory. When I uncomment it,
it works, my network account does have access rights. That's what I
want. My network account has access to the directory, I don't want
ASPNET to have access to it.

Next step, I bring up a browser session on another PC and run the app
on my development PC, I get an "Enter Network Password" popup. I enter
my network password, after a few tries I get an
"UnauthorizedAccessException: Access is to the path 'w:\KBG' is
denied." message. Why does it not work if initiated from another PC?
How do I fix it?

Any help would really be appreciated.

 

[Chris Taylor]

Is the w drive a local drive or is it a mapped network drive?

 

[kevingeist]

It is a mapped network drive.

Is the w drive a local drive or is it a mapped network drive?

 

[Joe Kaplan]

You would need to have Kerberos delegation working in that scenario then
(assuming you are using integrated auth in IIS). Otherwise you have a
double hop issue when accessing with a browser from a remote machine.

You could try following the normal procedures to set up Kerberos delegation.
I'm not sure exactly how it work with mapped network drives and naming
conventions, but you should be able to get it working fine using the share
name.

Joe K.