IIS 6.0 and ASP.NET 2.0 Credentials

  • Article

The one area that many developers do not have good grasp at is how Authentication tokens from IIS 6.0 is passed to ASP.NET 2.0 and how these tokens can subsequently be used for Authorization in an ASP.NET 2.0 Web Application.

The one question that arises quite often is when I click on “Integrated Windows Authentication” in IIS 6.0 “Authentication tab” how does this information get passed to ASP.NET 2.0 and when it is passed to my Web Application how do I flow the client identity between different Services such as a Web Service or a database like SQL Server or what happens when I want to do impersonation?

I have created part one of a two part blog at my new security blog site: https://blogs.msdn.com/s4cd/archive/2006/08/24/718656.aspx