Security communication between an internet app and an intranet web service app
<p>I currently have two asp.net web applications, web1 (which is an internet app) and web2 (which is an intranet web service app with windows authentication setting). web1 locates at IIS6 on the DMZ of my company's network. web2 locates at another IIS6 on the intranet. web2 has SSL and a certificate so that the communication between web1 and web2 uses https. What I am going to do is to make extra security setting for web2, only allow web1 as a client to use the web methods from web2. No other clients/users can access web2 (including no accessing through URL). My current idea is to make impersonation for web2 and add code lines to the system.web tag on the web.config file something like this: </p>

<p>identity impersonate="true" userName="domain\user" password="password"</p>

<p>My questions are: 1) what steps I need to do to achieve the goal described above. Notice that the network domain for web1 is different compared to web2. 2) How to make a client account for web1? I guess I need to add some code either on the Page_Load method or on the web.config file to create an client account for web1. 3) Do I need to do some settings for two web servers?</p>

<p>Thank you very much for your help.</p>

<p>Stock</p>
