What is Impersonation in ASP.NET?

Question

Please explain impersonation for non-technical users.Then please explain it in the context of ASP.NET. Is Impersonation good or evil? Do we use it in the case of Forms-based Authentication?

Oviduct

Answer 1

You should check out Keith Brown's description of impersonation. It is really a Windows concept.

When you have an application using forms authentication (FA) the IIS process is running under the credentials of a specific user setup in IIS.

Example: If you have a user called Bob logged on using FA and IIS setup to run as Network Service. Bob accesses a page which makes a web service call to another computer, the other computer will see the IIS user and not Bob. You can use impersonation to allow Bob to access the web service as a real Windows user and not Network Service.

Impersonation is not evil but it can be misused. You really need to understand the impact on your overall security model. It is also something that creates a lot of work for a developer to debug. This is especially the case if you do not have admin rights to the resource (eg. web service) you are trying to access.

Evin

@ImadoddinIbnAlauddin I replaced the link with one going to the internet archive page. I'm actually going to try and contact the author directly to see if he can get this back online. – Evin

Answer 2

Web applications run through a web server. That web server runs as a user with different permissions than yourself. Impersonation allows the application to run as you (or any other user with different priveledges on the cmoputer), as if you were logged in to the computer running it itself.

It actually makes things quite good. It allows you another way to grant/restrict access to protected files on the computer.

And yes, you can apply it using Forms Authentication (but you don't have to).

Pulvinate

Answer 3

ASP.NET applications can execute with the Windows identity (user account) of the user making the request. Impersonation is commonly used in applications that rely on Microsoft Internet Information Services (IIS) to authenticate the user.

ASP.NET impersonation is disabled by default. If impersonation is enabled for an ASP.NET application, that application runs in the context of the identity whose access token IIS passes to ASP.NET. That token can be either an authenticated user token, such as a token for a logged-in Windows user, or the token that IIS provides for anonymous users (typically, the IUSR_MACHINENAME identity).

Crowder