title: Impersonation issue when making web request to other server
body: <p>I have an intranet MVC.NET website. Let's call it <strong>MySite</strong>. From <strong>MySite</strong> I'm trying to make a web request to another intranet website. Let's call the other website <strong>OtherSite</strong>. Both websites are in the same domain and are running under IIS. Both websites are using:</p>
  
  <pre><code>&lt;authentication mode="Windows" /&gt;
  &lt;authorization&gt;
    &lt;allow verbs="OPTIONS" users="*" /&gt;
    &lt;deny users="?" /&gt;
  &lt;/authorization&gt;
  </code></pre>
  
  <p><strong>MySite</strong> is accessed by an authenticated user (same domain) with a web browser (Chrome, IE). Let's call that user <strong>Client</strong>. The credentials from <strong>Client</strong>, should be used when <strong>MySite</strong> calls <strong>OtherSite</strong>.</p>
  
  <p><a href="https://i.stack.imgur.com/yySep.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/yySep.png" alt="enter image description here"></a></p>
  
  <p>I have tried the following:</p>
  
  <p>With <a href="https://msdn.microsoft.com/en-us/library/system.net.webrequest(v=vs.110).aspx" rel="nofollow noreferrer"><code>WebRequest</code></a>:</p>
  
  <pre><code>var request = WebRequest.CreateHttp(uri);
  request.Credentials = CredentialCache.DefaultCredentials;
  request.ImpersonationLevel = System.Security.Principal.TokenImpersonationLevel.Impersonation;
  var response = request.GetResponse();
  return response;
  </code></pre>
  
  <p>With <a href="https://msdn.microsoft.com/en-us/library/system.net.webclient(v=vs.110).aspx" rel="nofollow noreferrer"><code>WebClient</code></a>, as suggested <a href="https://stackoverflow.com/questions/12212116/how-to-get-httpclient-to-pass-credentials-along-with-the-request">here</a>;</p>
  
  <pre><code>using (var client = new WebClient { UseDefaultCredentials = true })
  {
      client.Headers.Add(HttpRequestHeader.ContentType, "application/json; charset=utf-8");
      var data = client.DownloadData(uri);
      return data;
  }
  </code></pre>
  
  <p>Both with and without this code around it:</p>
  
  <pre><code>var wi = (System.Security.Principal.WindowsIdentity)HttpContext.Current.User.Identity;
  var wic = wi.Impersonate();
  try
  {
      // Code for making request goes here...
  }
  catch (Exception exc)
  {
      // handle exception
  }
  finally
  {
      wic.Undo();
  }
  </code></pre>
  
  <p>I've tried with and without <code>&lt;identity impersonate="true" /&gt;</code> in the web.config for <strong>MySite</strong>.</p>
  
  <p>As soon as I try to impersonate the <strong>Client</strong> I get a <code>401</code> from <strong>OtherSite</strong>. And when I check the IIS logs for <strong>OtherSite</strong> it looks like the credentials aren't passed with the request at all.</p>
  
  <p>If I don't impersonate the user it all works great. But as soon as I try to impersonate it fails and returns a <code>401</code>. Do I have to do anything in Active Directory? I've seen <a href="https://stackoverflow.com/questions/27725896/programmatic-impersonation-delegation-for-remote-resources-double-hop">this question</a>, where the answer was delegation. Is that the issue? What can be the reason for the <code>401</code> I get when i impersonate?</p>
  
  <p>The IIS-logs on <strong>OtherSite</strong> looks like this when I impersonate:</p>
  
  <pre><code>2016-10-19 07:33:26 2a01:9080:700:0:3fe7:b92a:552:1246 GET /odata/$metadata - 80 - 2a01:9080:700:0:8d90:4bc0:2ffd:d088 - - 401 0 0 0
  2016-10-19 07:33:26 2a01:9080:700:0:3fe7:b92a:552:1246 GET /odata/$metadata - 80 - 2a01:9080:700:0:8d90:4bc0:2ffd:d088 - - 401 1 2148074252 0
  </code></pre>
  
  <p>They look like this when I don't impersonate:</p>
  
  <pre><code>2016-10-19 07:57:11 2a01:9080:700:0:3fe7:b92a:552:1246 GET /odata/$metadata - 80 MyDomain\SVC_ServiceAccount1 2a01:9080:700:0:8d90:4bc0:2ffd:d088 - - 200 0 0 0
  2016-10-19 07:57:11 2a01:9080:700:0:3fe7:b92a:552:1246 GET /odata/$metadata - 80 MyDomain\SVC_ServiceAccount1 2a01:9080:700:0:8d90:4bc0:2ffd:d088 - - 200 0 0 0
  </code></pre>
  
  <p>I have a service account for the app pool, named <strong>MyDomain\SVC_ServiceAccount1</strong> in the logs above. Real name is something else...</p>