title: WCF:Relationship between NetworkCredential and Impersonation
body: <p>I have a WCF service hosted in IIS 7 in the default app pool in Integrated mode with anonymous access disabled and windows Authentication enabled.</p>
  
  <p>I have put the following attribute on the method implementation for my interface.</p>
  
  <pre><code>[OperationBehavior(Impersonation = ImpersonationOption.Required)]
  </code></pre>
  
  <p>If I do not supply network credentials in the call to my service I get the expected behavior in that the following are true:</p>
  
  <p>ServiceSecurityContext.Current.WindowsIdentity.Name = myDomain\myUser<br/>
  ServiceSecurityContext.Current.PrimaryIdentity.Name = myDomain\myUser<br/>
  Thread.CurrentPrincipal.Identity.Name = myDomain\myUser<br/>
  I can connect to a database on a remote system using SSPI and myDomain\myUser authentication.<br/>
  WindowsIdentity.GetCurrent().Name = myDomain\myUser<br/>
  I can use Thread.CurrentPrincipal.IsInRole() to verify the user is in a role.<br/>
  I can use WindowsIdentity.GetCurrent().Groups to retrieve a list of groups for the user.<br/></p>
  
  <p>But if I supply network credentials using the following:</p>
  
  <pre><code>var networkCredential = new NetworkCredential(user, pwd, dom);
  base.ClientCredentials.Windows.ClientCredential = networkCredential;
  base.ClientCredentials.Windows.AllowNtlm = true;      
  base.ClientCredentials.Windows.AllowedImpersonationLevel 
            = System.Security.Principal.TokenImpersonationLevel.Delegation;
  </code></pre>
  
  <p>Then all of the above is the same EXCEPT the database connection and two of the groups listed are different.  The connection to the database is being made using the NT Authority\Anonymous login user.  Using the NetworkCredentials puts the user in the NT Authority\Network group rather than NT Authority\Interactive and additionally the LOCAL group is removed.</p>
  
  <p>My goal is to make the connection to the database using the credentials passed by NetworkCredential, any advice would be appreciated.</p>
  
  <p>Shane Holder</p>