title: Getting IIS to impersonate the windows user to SQL server in an intranet environment
body: <p>I am developing an intranet site using C# and ASP.NET MVC. I have SQL Server on one machine and IIS running on a separate machine. I would like a user to visit the intranet site and without prompting the user internet explorer sends the users windows credentials to IIS and these are then passed to sql server meaning sql server can see the user accessing the database.</p>
  
  <p>I am aware of the Kerberos double hop issue and it is this I am trying to get around. At present I can get IE to pass the windows credentials to IIS and authenticate fine. I just cannot get IIS to pass on those credentials to SQL Server and instead the request currently runs under the app pool identity which is set to a domain service account "htu\srv-htu-iis".</p>
  
  <p>My setup is as follows:</p>
  
  <p><strong>Web.Config</strong></p>
  
  <pre class="lang-xml prettyprint-override"><code>&lt;system.web&gt;
      &lt;authentication mode="Windows" /&gt;
      &lt;authorization&gt;
          &lt;deny users="?" /&gt;
      &lt;/authorization&gt;
      &lt;identity impersonate="true" /&gt;
  &lt;/system.web&gt;
  &lt;system.webServer&gt;
      &lt;validation validateIntegratedModeConfiguration="false" /&gt;
  &lt;/system.webServer&gt;
  </code></pre>
  
  <p><strong>Connection String</strong></p>
  
  <pre><code>connection string=&amp;quot;data source=hturesbsqlp01;initial catalog=R2_Dev;integrated security=True;MultipleActiveResultSets=True;App=EntityFramework&amp;quot;"
  </code></pre>
  
  <p><strong>IIS Authentication Settings</strong></p>
  
  <pre class="lang-none prettyprint-override"><code>Anonymous Authentication = Disabled
  ASP.NET Impersonation = Enabled
  Forms Authentication = Disabled
  Windows Authentication = Enabled
  </code></pre>
  
  <p><strong>IIS App Pool Settings</strong></p>
  
  <pre class="lang-none prettyprint-override"><code>Managed Pipeline = Integrated
  Identity = htu\srv-htu-iis (domain service account)
  </code></pre>
  
  <p><strong>Active Directory Settings</strong></p>
  
  <p>The domain service account htu\srv-htu-iis has had a service principal name set which        associates our site with the account. </p>
  
  <p>Active directory has </p>
  
  <pre class="lang-none prettyprint-override"><code>Allow Delagation to any service
  </code></pre>
  
  <p>SQL Server is running under its own SQL Domain Service account.</p>
  
  <p><strong>Tests</strong></p>
  
  <p>I ran the following code tests:</p>
  
  <pre><code>System.Web.HttpContext.Current.User.Identity.Name
  </code></pre>
  
  <p>this correctly return the windows credentials of the user accessing the site</p>
  
  <pre><code>System.Security.Principal.WindowsIdentity.GetCurrent().Name
  </code></pre>
  
  <p>return the domain service account "htu\srv-htu-iis" which is what the app pool identity is running under.</p>
  
  <p>Can anyone provide direction as to where I might be going wrong?</p>