Hi everyone,

A customer, with a very complex network and set of security policies, has configured a two-hop Kerberos environment in a single domain. It *sounds* very standard but they are having a problem I’ve not encountered before.

1. People are auto-logging into Web Client.
2. People are unable to export/download documents.

We have found two ways to resolve this issue:

1. Either we give the users Windows account, or <Everyone> explicit rights to C:\ProgramData\Laserfiche\WebAccess\Temp\export on the Web Client server
2. Or we disabled ASP.Net Impersonation on the list of Authentication options for the /Laserfiche web application. This authentication option was enabled as per the Kerberos instructions.

Option 1 would require heavy review and approval by the Info Security team. Option 2 seems to work without any issues and people are being automatically logged in. Are there are options available to us? Can you foresee any issues with ASP.Net Impersonation disabled?

Any advice or experience you could share would be great!

-Ben