title: Steps to enable double-hop delegation in IIS7 windows 2008
body: <p>my ASP.NET web application uses windows authentication on our intranet. I want it to be able to make a server-side http request to another server on the same domain that also requires windows authentication.</p>
  
  <p>I've followed the instructions on temporarily impersonating the authenticated user when making the additional request here:</p>
  
  <p><a href="http://msdn.microsoft.com/en-us/library/ff647404.aspx" rel="nofollow">http://msdn.microsoft.com/en-us/library/ff647404.aspx</a></p>
  
  <p>Using code like this:</p>
  
  <pre><code>using System.Security.Principal;
  
  // Obtain the authenticated user's Identity
  WindowsIdentity winId = (WindowsIdentity)HttpContext.Current.User.Identity;
  WindowsImpersonationContext ctx = null;
  try
  {
    // Start impersonating
    ctx = winId.Impersonate();
    // Now impersonating
    // Access resources using the identity of the authenticated user
    var request = WebRequest.Create("http://intranet/secureapp");
    request.Credentials = CredentialCache.DefaultCredentials;
    var response = request.GetResponse();
    using (var streamReader = new StreamReader(response.GetResponseStream()))
    {
        Response.Write(streamReader.ReadToEnd());
    }
  }
  // Prevent exceptions from propagating
  catch
  {
  }
  finally
  {
    // Revert impersonation
    if (ctx != null)
      ctx.Undo();
  }
  // Back to running under the default ASP.NET process identity 
  </code></pre>
  
  <p>But, unfortunately, I always get a 401 unauthorized error.</p>
  
  <p>Do I need to configure our webserver with active directory to allow it to delegate the autenticated user (could be any one of about 200 users, so don't want to have to do anything 200 times :))? If so, can anyone tell me how to do this?</p>