'IIS Windows Authentication + ASP.NET Impersonation

Building an ASP.NET intranet web application in VB.NET that (hypothetically) relies on Windows Authentication and ASP.NET Impersonation to permit domain users to perform certain actions on the server such as reading/writing from shared folder access (all machines on same network/domain). I'm having trouble writing to a share that my domain-user has access to under the expected scenario.

If IIS is set to use Basic Authentication + ASP.NET Impersonation and I provide my domain login info, then this:

Dim FilePath As String = "\\SomeServerName\ShareIHaveAccessTo\FileName.bin"
Dim SomeData As String = "TESTING123"
My.Computer.FileSystem.WriteAllText(FilePath, SomeData, False)

...works just fine, and writes the file to the shared folder. But using Basic Authentication means I have to manually type my username and password into a browser-auth-prompt every time I access the site.

But If I use Windows Authentication + ASP.NET Impersonation and attempt the run the same code, I don't have to manually provide my credentials anymore, BUT, the write operation fails telling me:

' Access to the path '\\SomeServerName\ShareIHaveAccessTo\FileName.bin' is denied.

' at System.IO.__Error.WinIOError(Int32 errorCode, String maybeFullPath)`
' at System.IO.FileStream.Init(String path, FileMode mode, FileAccess access, Int32 rights, Boolean useRights, FileShare share, Int32 bufferSize, FileOptions options, SECURITY_ATTRIBUTES secAttrs, String msgPath, Boolean bFromProxy, Boolean useLongPath, Boolean checkHost)
' at System.IO.FileStream..ctor(String path, FileMode mode, FileAccess access, FileShare share, Int32 bufferSize, FileOptions options, String msgPath, Boolean bFromProxy, Boolean useLongPath, Boolean checkHost)
' at System.IO.StreamWriter.CreateFile(String path, Boolean append, Boolean checkHost)
' at System.IO.StreamWriter..ctor(String path, Boolean append, Encoding encoding, Int32 bufferSize, Boolean checkHost)
' at System.IO.StreamWriter..ctor(String path, Boolean append, Encoding encoding)
' at Microsoft.VisualBasic.FileIO.FileSystem.WriteAllText(String file, String text, Boolean append, Encoding encoding)
' at Microsoft.VisualBasic.MyServices.FileSystemProxy.WriteAllText(String file, String text, Boolean append)
' at Web_Board_Agenda_Manager__WBAM_._default.Page_Load(Object sender, EventArgs e) in C:\-DevelopmentPathRemoved-\default.aspx.vb:line 25

Why would this work perfectly with Basic Auth but not with Windows Auth? I have Anonymous Auth disabled, so if Windows Auth itself was failing, the site wouldn't load at all. How is it that I can successfully authenticate and impersonate, but only using Basic Auth will allow me to do the file-write operations on my profile's shared folders?

P.S.,

  • I also printed out HttpContext.Current.User.Identity.Name, System.Security.Principal.WindowsIdentity.GetCurrent().Name, and Environment.UserName on page load. They don't change between Basic and Windows Auth.

  • I also tried manually impersonating in-code, same result.

  • I even tried directly forcing the AppPool in IIS to use my domain username/password. Still no dice using Win Auth.



Sources

This article follows the attribution requirements of Stack Overflow and is licensed under CC BY-SA 3.0.

Source: Stack Overflow

Solution Source