Windows 2019 "Could not create windows user token from the credentials specified"

Question

I have IIS installed on a stand alone server that needs to be able access folders on another server that is domain joined. I have confirmed the domain creds used in the web.confg file can access the domain server since I can access shares via UNC path. Problem is the web site on the stand alone server is getting the error "Could not create windows user token from the credentials specified" . I made sure my web config file has the following line present and no luck. App pools are running under a local account, but will not run when I try to use a domain account.

Thoughts???

<identity impersonate="true" userName="domain\user123" password="xxxxx"/>

Answer 1

That isn't going to work. You are confusing identity with credentials I believe. In order to connect via UNC you have to provide credentials that are valid on that remote machine. In your case that would be a domain account. It doesn't matter what your local account is nor does it even need to have permissions on the remote server. If it doesn't have permissions you get prompted. It's basically like when you connect to a remote website that requires a UN/PWD. Your local credentials aren't good enough so you get prompted.

Identity on the other hand is a verification that you are who you say you are. For a domain account that requires that you provide domain credentials and those domain credentials be validated by a domain controller. If you're on a domain then that is automatic. If you are not on a domain then there is no DC to authenticate to and no domain identity can work. Hence you can run your app with a local account and you can use domain credentials to connect to remote domain-authenticated resources but you cannot run your app locally with domain credentials nor connect to domain-authenticated resources using a local account.

The identity section in your config is specifying the account you want to use to identify who you are. If you use a domain account then it must validate which requires a DC. Since you're running on a non-domain machine that won't work. You cannot identify yourself with a domain account on a non-domain machine.

It is strongly recommended by pretty much every guideline you'll read that you only connect to domain file shares using domain machines. This is just good security practice. In the rare case where you cannot do this then your options are limited. One option is to modify the share permissions (and by extension the NTFS folder permissions) to allow anyone to read the file share. You then don't really need to provide any credentials as everyone is allowed. Naturally this is a security risk if the files are sensitive.

Option 2 is to forego the UNC and create a file share. For a web app this is a little problematic but can be done. However .NET does not expose this functionality so you'll need to either find a third party library that lets you do it or you need to wrap the underlying Win32 calls yourself. Here is one post that provides some starter code but I cannot confirm how well it works. Just make sure you don't persist the connection as this could cause problems if you restart the site. Also be aware that web apps can be running in multiple processes at the same time so I would recommend that you don't hard code a drive letter but look for one that is not in use so that if your app is already running elsewhere it won't fail. Again, this can be a little problematic.

Of course option 3 is to just put the machine on the domain. For a public facing site I wouldn't recommend it but an internal site should be fine.