How to flow the user context from a Windows Service to SQL Server?

[Rich Carickhoff]

How can I get the user context from a Windows service to
SQL Server running on another computer?

I have built a .NET class that is hosted in a Windows
service (SYSTEM account) accessed by clients over TCP
remoting. The hosted class then accesses SQL Server and
Analysis Services on behalf of the clients so I need the
Windows client account to flow to SQL Server. I am able
to successfully pass the user context from the client and
impersonate in the hosted class using a custom channel
sink. However, I am unable to pass the user context from
the hosted class to SQL Server or Analysis Services
running on another computer. I get an error from SQL
Server saying Login Failed for user 'NT
AUTHORITY\ANONYMOUS LOGON'. Here is some more information
about my environment:


- Both computers are logged into the same Active Directory
domain as the same user.
- Both computers are trusted for delegation.
- Delegation is allowed for the user that I am using.
- I am using the kerberos security package and a delegate
impersonation level (I am assuming this is what I need to
pass the client user context to SQL Server running on
another computer).
- SQL computer is Win2K SP3 and the other computer is XP
Professional SP1 (.NET framework 1.1)
- I have tried hosting my class in IIS and get the same
result.
- I have tried inheriting from System.EnterpriseServices
in my hosted class and registering in COM+ but I got the
same result (unless I did something wrong).


Best Regards,
Rich

 

[Nick Malik]

Biztalk has the same problem.

(see the article at:
http://msdn.microsoft.com/library/d...ts_2002/htm/lat_admin_server_trouble_rpmm.asp )

Note: if you are not familiar with Biztalk, the Messaging Manager is a
client application that uses web services running under IIS to provide it's
data.
In this case, if the Messaging Manager is on machine one, and IIS is on
machine two, and the database is on machine three, then credentials from the
client can work in IIS, but cannot pass along to SQL.

Microsoft's answer: don't do that.

--- Nick