0

We have two intranet applications both hosted on the same domain, both hosted on IIS, both using Windows Authentication but hosted on DIFFERENT windows 2008 servers.

My goal is to have ASP.net web application A call the service B. I also want A to pass the logged-in user's authentication information to B.

One thing, I want to avoid Kerberos delegation, because of the hassle of setting it up and also the security concerns.

Can you please recommend me ways to achieve my goal?

fahmi
  • 591
  • 6
  • 27
  • Are these REST api's that are exposed by web applications? Since these are intranet applications and could be over SSL HTTP basic authentication should be enough and easy to implement. – Andy Dufresne Jan 24 '19 at 04:33
  • @AndyDufresne Hi Andy, basic authentication would require us to access username and password that we do not have as the logged in user is authenticated by the domain controller. – fahmi Jan 24 '19 at 05:51

1 Answers1

1

I'm not sure how you think you can securely authenticate B from A without doing delegation.

If you're not concerned about doing this securely you can just pass the username in the request and impersonate on the far side.

Alternatively you can stuff the authenticated information into a token (JWT, SAML, etc.), sign it with a shared secret, and include it with the request. Then server B can validate it using the shared secret and impersonate as necessary. This does mean you need to make sure both servers know the secret, and figure out how to generate the token.

Delegation is the smart way to go here though. You don't have to figure out impersonation or build out a way to mint and validate tokens. It's primarily configuration driven.

Steve
  • 4,463
  • 1
  • 19
  • 24
  • Are you referring to setting up Constraint Delegation from Windows Server 2008 as mentioned here under the title "To configure constrained delegation when the Domain Functional Level is Windows Server 2003, Windows Server 2008, or Windows Server 2008 R2" : https://learn.microsoft.com/en-us/microsoft-desktop-optimization-pack/appv-v4/how-to-configure-the-server-to-be-trusted-for-delegation ? – fahmi Jan 25 '19 at 00:01