title: Impersonation and asynchrony in ASP.NET WebAPI
body: <p><strong>Update 2</strong></p>
  
  <p>This question originally was "Does impersonation work with Web API?"<br/>
  And the question to that question is "Yes, it does." </p>
  
  <p>But the problem was not about Web API but impersonation itself. (The description of the problem is below)<br/></p>
  
  <p>But now I'd like to tell others about the solution.<br/></p>
  
  <p>My controllers are async and my mistaken premise was that any thread spawned by impersonated thread has the same identity as its parent.<br/>
  By default it is false: TPL does not flow impersonation across threads.</p>
  
  <p>Impersonation flow can be enabled either <a href="http://blogs.msdn.com/b/tom/archive/2008/04/22/making-an-asynchronous-call-using-the-impersonation-identity.aspx" rel="nofollow noreferrer">programmatically or in configuration</a>.<br/>
  Note, please, that changes should be made to <em>aspnet.config</em> file and not web.config of your application.<br/></p>
  
  <p>As <a href="http://weblogs.asp.net/owscott/archive/2011/12/01/setting-an-aspnet-config-file-per-application-pool.aspx" rel="nofollow noreferrer">this post</a> states aspnet.config file can be set per application pool.</p>
  
  <p>And <a href="http://blog.codeishard.net/2012/09/17/await-async-mvc-and-impersonation/" rel="nofollow noreferrer">this post</a> the link to which kindly provided Andrew tells about the whole quest in more details.</p>
  
  <p>To those of you who will turn impersonation on for the first time I'd like to note that IIS 7.5 has a very nice feature to enter credentials of impersonated account. These credentials are not needed in config file and it is sifficient to write only.</p>
  
  <pre><code>&lt;identity impersonate="true"/&gt;
  </code></pre>
  
  <p>After entering credentials they will be automatically added to config file.</p>
  
  <p><img src="https://i.stack.imgur.com/e4T59.png" alt="enter image description here">
  <img src="https://i.stack.imgur.com/VP3X5.png" alt="enter image description here"></p>
  
  <p><strong>Original question:</strong></p>
  
  <p>I turned impersonation on and provided user credentials.</p>
  
  <pre><code>&lt;identity impersonate="true" usernName="foo" password="bar"/&gt;
  </code></pre>
  
  <p>But when I connect to sql server via Entity Framework I get the error "Login failed for user {MachineName}$". That is EF runs under IUSR account. Meanwhile <code>WindowsIdentity.GetCurrent()</code> returns identity of 'foo' user.</p>
  
  <p>Impersonated account has all needed permissions on SQL server where Windows authentiaction is enabled.<br/></p>
  
  <p>Moreover, if I disable impersonation and just set application pool to run with the credentials of this identity, everything works fine.<br/></p>
  
  <p>I cannot understand why it doesn't work when impersonation is on but AppPool runs under default account.</p>
  
  <p><strong>Update 1</strong></p>
  
  <p>EF Connection string is</p>
  
  <pre><code>&lt;add name="PtKbEntities" connectionString="metadata=...;provider=System.Data.SqlClient;provider connection string=&amp;quot;data source=...;initial catalog=...;Trusted_Connection=Yes;MultipleActiveResultSets=True;App=EntityFramework&amp;quot;" providerName="System.Data.EntityClient" /&gt;
  </code></pre>
  
  <p>I host application on Win2008 Srv, IIS 7.5</p>