Web Service and Impersonation

[Robert E. Maurer]

Hello.

Hopefully someone can help me (or at least explain what is going on to me.)

Before .Net, I would develop and application that had a web GUI, some COM
components, and some SQL Server tables. Then I would deploy the ASP files
and set up the web site to allow anonymous access and impersonate a specific
user. Then I would grant that specific user access to SQL Server and my
database. Then, when users would access my web site, it would create an
instance of a COM object in
COM+, using the identity that was set up in COM+. That object then creates
an instance of
another COM component, in process, that is my data access component. When I
profile this,
the user that I have configured in the COM+ application is what is used to
connect to SQL Server.

Now, I have a .Net web service written in C#. I edited the web.config file
to set the web service to "None" for authentication and Impersonate="true".
Then I set the web site in IIS to allow anonymous access and I set a
specific user. I then granted that specific user access to SQL Server and
my database. Finally, I have the web service create an interop assembly
object that
creates a reference to my data access COM component to attempt to access SQL
Server.

The problem is that when somebody accesses my web service, it attempts to
connect to SQL Server as either ASPNET or NT AUTHORITY\NETWORK SERVICE.

First, am I doing something wrong or have I missed a step? And, second, how
do I (if I can) configure my web service to impersonate a specific user
without seriously compromising the security of my machine.

Secondly, I assume that the web service and all assemblies it used will run
as the same user?

Finally, does this mean I need to put my web service into COM+ so that I can
configure an Identity?
That is a pain because then I have to put it into the GAC and then strong
name all of the interop assemblies, etc.

Thank you all in advance for any help you can provide.

Robert E. Maurer

 

[Jan Tielens]

You can alter the account that is used for your asp.net app. (e.g.
webservice) in the machine.config file: processModel node under the
system.web node. I think you can override this setting in your web.config
file of your web. app.

Secondly, I assume that the web service and all assemblies it used will run
as the same user? Yes

Finally, does this mean I need to put my web service into COM+ so that I can
configure an Identity?

No.

--
Greetz

Jan Tielens
________________________________
Read my weblog: http://weblogs.asp.net/jan

 

[Robert E. Maurer]

That means that I could not have two web differenct service applications
that access the database as two different users.

As an example, let's say I have one web service that gives stock quotes. I
would like it to access the database as UserA. I would like to have a
second web service that gives weather information access the database as
UserB.

If I set the process model as you suggest it would not work.

Robert E. Maurer

 

[Jan Tielens]

I assume you want to return some XML data, so I suggest you take a look at
this example:
XML Document Web Service
Description: This XML Web Service shows how to return entire XML documents
with a Web Service method.
http://www.xmlwebservices.cc/index_Samples.htm

Source:
http://www.xmlwebservices.cc/ws/v1/xml/XMLTest.asmx.htm

--
Greetz

Jan Tielens
________________________________
Read my weblog: http://weblogs.asp.net/jan