Problem using ASP.Net Impersonation to access UNC share

[JoeyNic]

I am working on an application where a web service (on the web tier)
calls another web/gateway service (on the app tier). This then needs
to save a file to a UNC share on a file server in our internal
network.

The issue that I'm having is that as our app tier is not on a domain,
I am unable to impersonate a domain account to access the share. I am
able to map a network drive to the share from the app tier by
connecting as a domain account but I have been unable to do the same
using ASP.Net. I have tried impersonating a domain account via the
web.config and also via the code.

I have managed to get a POC working by creating a local account on the
app tier and then creating the same account on the file server. If I
set my app to impersonate this local user I am able to save the file
successfully but when I try to impersonate a domain account the
authentication fails.

Has anybody else experienced a similar issue? Is there a way I can
impersonate a domain account on the app tier even though it is not on
the domain?

 

[Anthony Jones]

I am working on an application where a web service (on the web tier)
calls another web/gateway service (on the app tier). This then needs
to save a file to a UNC share on a file server in our internal
network.

The issue that I'm having is that as our app tier is not on a domain,
I am unable to impersonate a domain account to access the share. I am
able to map a network drive to the share from the app tier by
connecting as a domain account but I have been unable to do the same
using ASP.Net. I have tried impersonating a domain account via the
web.config and also via the code.

I have managed to get a POC working by creating a local account on the
app tier and then creating the same account on the file server. If I
set my app to impersonate this local user I am able to save the file
successfully but when I try to impersonate a domain account the
authentication fails.

Has anybody else experienced a similar issue? Is there a way I can
impersonate a domain account on the app tier even though it is not on
the domain?

You can't impersonate a domain account unless you have created a trust
relationship between the off domain machine and the domain (in which case
you may as well place the machine on the domain). Unless the local machine
trusts the domain controller on the domain it isn't going to authenticate an
account on that domain.

The 'twin' accounts approach would seem to be your best bet.