Configure Impersonation Authentication in IIS8 for MVC Application

Impersonation is when ASP.NET executes code in the context of an authenticated and authorized client. By default, ASP.NET does not use impersonation and instead executes all code using the same user account as the ASP.NET process, which is typically the ASPNET account.

There are 5 below steps by which we can establish Impersonation configuration in our secured application environment.

1.)    Creation of Application/Proxy user where Application is hosted.

2.)    Give appropriate access to the user.

3.)    Create Database Login user on database.

4.)    Authenticate User and provide credential on IIS.

5.)    Then Configure web.config on Application.

Creation of Application/Proxy user where Application is hosted and Give appropriate access to the user.

Create Database Windows Login in Database.

Now Open IIS Manager and navigate to the level you want to manage.

1.       In Features View, double-click Authentication.

2.       On the Authentication page, select ASP.NET Impersonation.

3.       In the Actions pane, click Enable to use ASP.NET Impersonation authentication with the default settings.

4.       Optionally, in the Actions pane, click Edit to set the security principal.

5.       In the Edit ASP.NET Impersonation Settings dialog box, select either Specific user or Authenticated user. Whichever you decide, IIS uses this identity for the security context of the ASP.NET application. By default, IIS 8 is set to impersonate the authenticated user.

6.       Click OK to finish or proceed to the next optional steps to change the identity to impersonate.

7.       Optionally, click Set to change the Specific user identity.

8.       In the Set Credentials dialog box, enter the name of an existing user account in User name, the password associated with that user account in Password, and then the exact same value in Confirm password for a new account IIS should use for anonymous access.

9.       Click OK to close the Set Credentials dialog box.

10.   Click OK to close the Edit ASP.NET Impersonation Settings dialog box.

Then Configure web.config on Application

Configure Aspnet/MVC app’s web.config as below

<configuration>

  <connectionStrings>

 <add name="xxxxx" connectionString="Database= Test;Server=SUMAN-29\MYSERVER;Integrated Security=SSPI; " providerName="System.Data.SqlClient" />

 <add name="ApplicationServices" connectionString="data source= SUMAN-29\MYSERVER;Integrated Security=SSPI; ; Initial Catalog=Test" providerName="System.Data.SqlClient" />

 </connectionStrings>

and

        <identity impersonate="true" password="@#@$@$@$@" userName="xxx" />

if SSL is enable  then

<authentication mode="Forms">

      <forms loginUrl="~/Account/LogOff" name="tech" timeout="30" requireSSL="True" />

    </authentication>

 Now Connect, Test and Discover
Seems it is opening …. 

#YoYo this is working and application goes live…