title: Thread Is impersonating: False while <identity impersonate="true" />
body: <p>I'm having trouble diagnosing an anomaly in an application. It works fine in development and test, but doesn't work in preproduction. </p>
  
  <p>I get an access denied error and I suppose it is because the thread isn't impersonating the current user.
  This is the log I have</p>
  
  <pre><code>Event code: 3005
  Event message: An unhandled exception has occurred.
  Event time: 01/02/2016 10:54:17
  Event time (UTC): 01/02/2016 09:54:17
  Event ID: b924fd2c31b44bb59f5e9b9b79f9afc6
  Event sequence: 28
  Event occurrence: 5
  Event detail code: 0
  
  Application information:
      Application domain: /LM/W3SVC/3/ROOT/SPApp/girsmt-3-130987927149445639
      Trust level: Full
      Application Virtual Path: /SPApp/girsmt
      Application Path: \IIS-CERT\WebAppExt\SPApp\girsmt\
      Machine name: D3IISFEC01
  
  Process information:
      Process ID: 26980
      Process name: w3wp.exe
      Account name: IIS APPPOOL\girsmt
  
  Exception information:
      Exception type: WebException
      Exception message: The remote server returned an error: (401) Unauthorized.
  at System.Net.WebClient.DownloadDataInternal(Uri address, WebRequest&amp; request)
  at System.Net.WebClient.DownloadString(Uri address)
  at System.Net.WebClient.DownloadString(String address)
  at Generali.SharePoint.Security.SPClientSecurityProvider.CreateContext()
  at Generali.Security.SecurityContext.CreateFrom(ContextConfiguration config)
  at Generali.Security.SecurityContext..ctor(ContextConfiguration config)
  at HierarchyDA.DataAccess.Hierarchy..ctor(SecurityProvider securityProvider, String HierarchyId, String connectionString, String siteUrl)
  at GEN.AG.GIRSMT.BusinessLayer.Controllers.DocumentHierarchyController.get_Hierarchy()
  at GEN.AG.GIRSMT.BusinessLayer.Controllers.DocumentHierarchyController.get_CurrentUserGroups()
  at GEN.AG.GIRSMT.BusinessLayer.Controllers.PermissionsController.get_Permissions()
  at GEN.AG.GIRSMT.BusinessLayer.Controllers.PermissionsController.CanDo(Permission permission, Policy policy)
  at GEN.AG.GIRSMT.BusinessLayer.Controllers.PermissionsController.CanEditSystemTables()
  at GEN.AG.GIRSMT.BusinessLayer.Controllers.TopMenuController.CanUseSeeAdminMenu()
  at GEN.AG.GIRSMT.AppWeb.GeneralCounsel.Page_Load(Object sender, EventArgs e)
  at System.Web.Util.CalliEventHandlerDelegateProxy.Callback(Object sender, EventArgs e)
  at System.Web.UI.Control.OnLoad(EventArgs e)
  at System.Web.UI.Control.LoadRecursive()
  at System.Web.UI.Control.LoadRecursive()
  at System.Web.UI.Page.ProcessRequestMain(Boolean includeStagesBeforeAsyncPoint, Boolean includeStagesAfterAsyncPoint)
  
  Request information:
      Request URL: https://webappextcert.generali.com:443/spapp/girsmt/pages/admin/update.aspx?SPHostUrl=http://corpcert.generali.com/sites/GGC/girsmt&amp;SPLanguage=en-US&amp;SPClientTag=0&amp;SPProductNumber=15.0.4569.1000
      Request path: /spapp/girsmt/pages/admin/update.aspx
      User host address: 10.180.71.189
      User: CORPGEN\e3mpozz2
      Is authenticated: True
      Authentication Type: NTLM
      Thread account name: IIS APPPOOL\girsmt
  
  Thread information:
      Thread ID: 2086
      Thread account name: IIS APPPOOL\girsmt
      Is impersonating: False
      Stack trace:    at System.Net.WebClient.DownloadDataInternal(Uri address, WebRequest&amp; request)
  at System.Net.WebClient.DownloadString(Uri address)
  at System.Net.WebClient.DownloadString(String address)
  at Generali.SharePoint.Security.SPClientSecurityProvider.CreateContext()
  at Generali.Security.SecurityContext.CreateFrom(ContextConfiguration config)
  at Generali.Security.SecurityContext..ctor(ContextConfiguration config)
  at HierarchyDA.DataAccess.Hierarchy..ctor(SecurityProvider securityProvider, String HierarchyId, String connectionString, String siteUrl)
  at GEN.AG.GIRSMT.BusinessLayer.Controllers.DocumentHierarchyController.get_Hierarchy()
  at GEN.AG.GIRSMT.BusinessLayer.Controllers.DocumentHierarchyController.get_CurrentUserGroups()
  at GEN.AG.GIRSMT.BusinessLayer.Controllers.PermissionsController.get_Permissions()
  at GEN.AG.GIRSMT.BusinessLayer.Controllers.PermissionsController.CanDo(Permission permission, Policy policy)
  at GEN.AG.GIRSMT.BusinessLayer.Controllers.PermissionsController.CanEditSystemTables()
  at GEN.AG.GIRSMT.BusinessLayer.Controllers.TopMenuController.CanUseSeeAdminMenu()
  at GEN.AG.GIRSMT.AppWeb.GeneralCounsel.Page_Load(Object sender, EventArgs e)
  at System.Web.Util.CalliEventHandlerDelegateProxy.Callback(Object sender, EventArgs e)
  at System.Web.UI.Control.OnLoad(EventArgs e)
  at System.Web.UI.Control.LoadRecursive()
  at System.Web.UI.Control.LoadRecursive()
  at System.Web.UI.Page.ProcessRequestMain(Boolean includeStagesBeforeAsyncPoint, Boolean includeStagesAfterAsyncPoint)
  
  Custom event details:
  </code></pre>
  
  <p>and this is the the web config</p>
  
  <pre><code>&lt;configuration&gt;
  &lt;configSections&gt;
      &lt;!-- For more information on Entity Framework configuration, visit http://go.microsoft.com/fwlink/?LinkID=237468 --&gt;
      &lt;section name="entityFramework" type="System.Data.Entity.Internal.ConfigFile.EntityFrameworkSection, EntityFramework, Version=6.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" requirePermission="false" /&gt;
  &lt;/configSections&gt;
  &lt;system.web&gt;
      &lt;customErrors mode="Off" /&gt;
      &lt;compilation debug="true" targetFramework="4.5" /&gt;
      &lt;httpRuntime targetFramework="4.5" /&gt;
      &lt;authorization&gt;
      &lt;deny users="?" /&gt;
      &lt;/authorization&gt;
      &lt;httpHandlers&gt;
      &lt;add path="Telerik.Web.UI.WebResource.axd" type="Telerik.Web.UI.WebResource" verb="*" validate="false" /&gt;
      &lt;/httpHandlers&gt;
      &lt;identity impersonate="true" /&gt;
      &lt;globalization uiCulture="it" culture="it-IT" /&gt;
  &lt;/system.web&gt;
  &lt;appSettings&gt;
      &lt;add key="ClientId" value="XXXXXXXXXXXXXXXXXXXXX" /&gt;
      &lt;add key="ClientSecret" value="XXXXXXXXXXXXXXXXXXXXXX=" /&gt;
      &lt;add key="IssuerId" value="XXXXXXXXXXXXXXXXXXXXXXXX" /&gt;
  &lt;/appSettings&gt;
  &lt;system.serviceModel&gt;
      &lt;behaviors&gt;
      &lt;endpointBehaviors&gt;
          &lt;behavior name="GEN.AG.GIRSMT.AppWeb.GIRSAspNetAjaxBehavior"&gt;
          &lt;enableWebScript /&gt;
          &lt;/behavior&gt;
      &lt;/endpointBehaviors&gt;
      &lt;/behaviors&gt;
      &lt;serviceHostingEnvironment aspNetCompatibilityEnabled="true" multipleSiteBindingsEnabled="true" /&gt;
      &lt;services&gt;
      &lt;service name="GEN.AG.GIRSMT.AppWeb.GIRS"&gt;
          &lt;endpoint address="" behaviorConfiguration="GEN.AG.GIRSMT.AppWeb.GIRSAspNetAjaxBehavior" binding="webHttpBinding" contract="GEN.AG.GIRSMT.AppWeb.GIRS" /&gt;
      &lt;/service&gt;
      &lt;/services&gt;
      &lt;bindings&gt;
      &lt;basicHttpBinding&gt;
          &lt;!--Used by app for SharePoint--&gt;
          &lt;binding name="secureBinding"&gt;
          &lt;security mode="Transport" /&gt;
          &lt;/binding&gt;
      &lt;/basicHttpBinding&gt;
      &lt;/bindings&gt;
      &lt;protocolMapping&gt;
      &lt;add binding="basicHttpBinding" scheme="https" bindingConfiguration="secureBinding" /&gt;
      &lt;/protocolMapping&gt;
  &lt;/system.serviceModel&gt;
  &lt;connectionStrings&gt;
      &lt;add name="PersistenceDBContext" connectionString="XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX" providerName="System.Data.SqlClient" /&gt;
  &lt;/connectionStrings&gt;
  &lt;entityFramework&gt;
      &lt;defaultConnectionFactory type="System.Data.Entity.Infrastructure.LocalDbConnectionFactory, EntityFramework"&gt;
      &lt;parameters&gt;
          &lt;parameter value="mssqllocaldb" /&gt;
      &lt;/parameters&gt;
      &lt;/defaultConnectionFactory&gt;
      &lt;providers&gt;
      &lt;provider invariantName="System.Data.SqlClient" type="System.Data.Entity.SqlServer.SqlProviderServices, EntityFramework.SqlServer" /&gt;
      &lt;/providers&gt;
  &lt;/entityFramework&gt;
  &lt;system.webServer&gt;
      &lt;validation validateIntegratedModeConfiguration="false" /&gt;
      &lt;handlers&gt;
      &lt;add name="Telerik_Web_UI_WebResource_axd" verb="*" preCondition="integratedMode" path="Telerik.Web.UI.WebResource.axd" type="Telerik.Web.UI.WebResource" /&gt;
      &lt;/handlers&gt;
      &lt;httpProtocol&gt;
      &lt;customHeaders&gt;
          &lt;add name="Access-Control-Allow-Credentials" value="true" /&gt;
          &lt;add name="Access-Control-Allow-Origin" value="http://webappextcert.generali.com" /&gt;
      &lt;/customHeaders&gt;
      &lt;/httpProtocol&gt;
  &lt;/system.webServer&gt;
  &lt;runtime&gt;
      &lt;assemblyBinding xmlns="urn:schemas-microsoft-com:asm.v1"&gt;
      &lt;dependentAssembly&gt;
          &lt;assemblyIdentity name="System.Web.Http" publicKeyToken="31bf3856ad364e35" culture="neutral" /&gt;
          &lt;bindingRedirect oldVersion="0.0.0.0-5.2.2.0" newVersion="5.2.2.0" /&gt;
      &lt;/dependentAssembly&gt;
      &lt;dependentAssembly&gt;
          &lt;assemblyIdentity name="Newtonsoft.Json" publicKeyToken="30ad4fe6b2a6aeed" culture="neutral" /&gt;
          &lt;bindingRedirect oldVersion="0.0.0.0-7.0.0.0" newVersion="7.0.0.0" /&gt;
      &lt;/dependentAssembly&gt;
      &lt;dependentAssembly&gt;
          &lt;assemblyIdentity name="System.Net.Http.Formatting" publicKeyToken="31bf3856ad364e35" culture="neutral" /&gt;
          &lt;bindingRedirect oldVersion="0.0.0.0-5.2.2.0" newVersion="5.2.2.0" /&gt;
      &lt;/dependentAssembly&gt;
      &lt;/assemblyBinding&gt;
  &lt;/runtime&gt;
  &lt;/configuration&gt;
  </code></pre>
  
  <p>As you can see the web config has identity impersonate="true" but in the log I still see "Is Impersonating: False"
  What am I missing?</p>