title: ASP.NET MVC 5: App Pool, Windows Authentication and Active Directory
body: <p>Background:</p>
  
  <p>I have an MVC 5/C# app that interfaces an outside API. It uses the <code>Active Directory</code> users' <code>Principal Context</code> for authorization. The app checks if the <code>UserPrincipal.Current</code> has their Un/Pw combo stored in the Db to be used for any operations later on the external API.</p>
  
  <pre><code> public bool IsUserSetup()
      {
          try
          {
              // find currently logged in user
              var user = UserPrincipal.Current; // &lt;- ERRS HERE -----
              // check if this user exists in Db with creds
              if (user != null)
              {
                  var u = _userProfileRepository.GetUserProfileByUserSID(user.Sid.ToString());
                  if (u != null
                      &amp;&amp; !string.IsNullOrEmpty(u.RallyUsername)
                      &amp;&amp; !string.IsNullOrEmpty(u.RallyPassword)
                      &amp;&amp; u.IsActive // &lt;-- make sure this person is an active user
                      )
                  {
                      return true;
                  }
              }
          }
          catch (Exception ex)
          {
              string exMessage = ex.Message;
              //throw ex;
          }
          return false;
      }
  </code></pre>
  
  <ul>
  <li>I understand that <code>UserPrincipal.Current</code> will return the App Pool's identity by default.</li>
  <li>I also understand setting Impersonate to True IIS will use the current user's context as in:
  <code>&lt;system.web&gt;
  &lt;identity impersonate="true"/&gt;...</code></li>
  </ul>
  
  <p>However, if I turn Impersonation on (true), then I get this:</p>
  
  <pre><code>An ASP.NET setting has been detected that does not apply in Integrated managed pipeline mode.
  </code></pre>
  
  <p>So, I change the <code>app pool</code> to use 'classic'(Which I don't think is the answer or path I should take), and I get this error:</p>
  
  <pre><code>The page you are requesting cannot be served because of the ISAPI and CGI Restriction list settings on the Web server.
  </code></pre>
  
  <p>Obviously, this works great in IIS Express, it sees me (domain\username) just fine. But when I switch it to IIS or deploy it to an actual web server, I get these problems.</p>
  
  <p>I need to get the current user/principal so I can store their SID and credentials to the external API in the Db. Then upon using the site/app, it auto-magically uses their creds to do work in the API as needed.</p>
  
  <p>What do I need to do to either:</p>
  
  <ul>
  <li>setup IIS to allow impersonation to work</li>
  <li>adjust my code to do the same</li>
  </ul>