David
Sat Mar 08 04:44:37 CST 2008
On Mar 7, 1:24=A0pm, "Joel" <joelijohnson.removethisp...@hotmail.com>
wrote:
> I have inherited a legacy ASP application. =A0The application is is using
> windows integrated authentication. =A0 The application needs to make a cal=
l to
> a service via the MSXML object. =A0The service also makes use of windows
> integrated authentication. =A0 Problem is that when the application makes =
a
> call to the service the user's credentials are not passed along and IIS on=
> the machine running the service sees the request as an anonymous call.
>
> How do I force the MSXML object to pass the users credentials to the
> service?
>
> Joel
The problem you face is called delegation. There is no way to force
any object to pass the user credentials to the service -- that is
insecure.
If IIS5, you must use configure and use Kerberos and Delegation in
Windows integrated authentication with both the client and the double-
hop with MSXML.
If IIS6, you can use any authentication method with the client,
configure Protocol Transitioning (which involves Kerberos and
delegation), and double-hop with MSXML.
There is no other way that you can "pass along the user's credentials"
on the network call. Any authentication protocol that allows that is
insecure -- thus you cannot do this with Windows Integrated
Authentication until you turn on delegation and constrains its usage,
at which point it is secure.
//David
http://w3-4u.blogspot.com
http://blogs.msdn.com/David.Wang
//