title: How to delegate Windows Authentication session when running an app on IIS 8?
body: <p>I have an intranet application written with c# on the top of ASP.Net MVC 5 Framework. My app is configured to authenticate users via "Windows Authentication" method. This app is running on IIS 8. </p>
  
  <p>My app uses a third party SDK to interact with another program I have running on the same domain. This third party app allows the user to login using Windows Authentication also via the provided SDK.</p>
  
  <p><strong>Problem</strong></p>
  
  <p>However the server where the SDK is communication with is always returning "Invalid user name/password is invalid". </p>
  
  <p>After deep troubleshooting, I found out that IIS is not returning the correct username. Instead of returning the "Authenticated User" it is returning the user that is running the pool app. So, to fix this problem, I change the app settings to the following</p>
  
  <ul>
  <li>I disabled "Anonymous Authentication"</li>
  <li>I enabled "Windows Authentication"</li>
  <li>I enabled "ASP.NET Impersonation" while the "ASP.NET Impersonation" settings are set to "Authenticated user". Note:
  that this require "Classic" managed pipeline not "Integrated" for
  some reason.</li>
  <li>I change the AppPool managed pipeline setting to "Classic" v4</li>
  <li>Changed the user that is running the AppPool to "Network Service" instead of "ApplicationPoolId"</li>
  <li>Then kept the Authentication Providers list to "Negotiate" and "NTLM"</li>
  <li>Finally, I kept the "Kernal-mode authentication" enabled.</li>
  </ul>
  
  <p>So the above settings returned the correct username, but is it <strong>not</strong> delegating the password to the SDK. I guess because of the communication hob, IIS is protecting the logged in user and it is <strong>not</strong> allowing me to delegate the password to another service/SDK.</p>
  
  <p>So then I tried to change my setup to the following</p>
  
  <ul>
  <li>I change the AppPool managed pipeline setting to "Integrated" v4.0</li>
  <li>Changed the user that is running the AppPool to "Network Service"</li>
  <li>I disabled "Anonymous Authentication"</li>
  <li>I enabled "Windows Authentication"</li>
  <li>I <strong>disabled</strong> "ASP.NET Impersonation"</li>
  <li>The Authentication Providers list "Negotiate:Kerberos",  "Negotiate" and "NTLM"</li>
  <li>I disabled "Kernal-mode authentication" as it won't work with "Kerberos" provider.</li>
  </ul>
  
  <p>So the above prevented me from logging into my MVC app altogether, It just keeps on prompting me for my credential over and over.</p>
  
  <p>To fix that, I located my web-server name in my domain controller, and I went to the "Delegation" tab and changed it to "Trust this user for delegation to any service (Kerberos only)"</p>
  
  <p>No this setup, allowed me to login into my MVC app. But this time, it is not delegating neither the username or the password to the SDK. In fact, the username that I get is the PoolApp username not the authenticated user.</p>
  
  <p>To cover all of my bases, I change the user that is AppPool to an actual user that has windows authentication access into the Server where the SDK is connecting to. Sure enough that worked just fine and I am able to connect to the second service. However, it is <strong>always</strong> delegating the username/password that is running the AppPool to the SDK instead of delegating the connected/authenticated username/password.</p>
  
  <p>In conclusion, IIS is not delegating the username/password to the SDK for some reason. How can I get IIS to delegate the connected user session/credential to another service?</p>
  
  <p>It is also possible that the the delegation is failing because the users are using "NTLM" authentication instead of Kerberos, yet the server will only delegate when Kerberos authentication only" If this is the case, how can I force the user to use "Kerberos" authentication instead of "NTLM?</p>