You are viewing limited content. For full access, please sign in.

Question

Question

Logging in using WindowsImpersonationContext

asked on April 12, 2018 Show version history

Using Laserfiche 10.3, we have users logged in to their computers using Windows Authentication and then connecting through a browser to a web application that also authenticates them using Windows Authentication.

From there, the web application connects to Laserfiche (server is running on a different machine than the web application). When the web application connects to Laserfiche using a specific name/password, it works without any problem. But, I'm trying to connect with the Windows credentials of the user who's connected to the web application.

My code (C#) looks something like this: 

RepositoryRegistration repositoryRegistration = new RepositoryRegistration (serverName, databaseName);

if (session == null)
    session = new Session();

IIdentity winId = System.Web.HttpContext.Current?.User?.Identity;
if (winId != null)
{
    wi = (WindowsIdentity)winId;

    WindowsImpersonationContext wic = wi.Impersonate();
    if (wic != null)
    {
        try
        {
            session.LogIn(repositoryRegistration);
        }
        catch (Exception e)
        {
            // log an error, etc.
            SessionLogout();
        }
        finally
        {
            if (wic != null)
                wic.Undo();
        }
    }
}

 

It seems to work if a user is logged on to the same machine as our web application but, otherwise, it fails with an "Access denied. [9013]" error.

Any suggestions?

0 0

Replies

replied on April 12, 2018

When the user, your web application, and LFS are on three separate machines, you need to perform delegation-level impersonation, which means you need to configure Kerberos for the web server.  We have some whitepapers on the site that outline the general steps for getting our web applications to work in that environment.

2 0
replied on April 13, 2018

Thank you Brian. I'll look into it.

0 0
You are not allowed to follow up in this post.

Sign in to reply to this post.