Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Delegation Browser->ScrapperTest.aspx->WhoAmI.aspx not working with defaults values #379

Open
TiagoFAbreu opened this issue Oct 3, 2024 · 0 comments

Comments

@TiagoFAbreu
Copy link

Hi all.
I would like to report a problem with "samples/samples/aspnet/Identity/CurrentUserInfoRetrieval/ScrapperTest.aspx".

For the use case with delegation to work (so the identity in the browser is passed to ScrapperTest.aspx that passes it to WhoAmI.aspx) the webapp that ScrapperTest.aspx is running, needs to have on IIS Manager, Authentication, ASP.NET Impersonation Enable, with “Authenticated User”. But with this we cause the following error: “
HTTP Error 500.24 - Internal Server Error
An ASP.NET setting has been detected that does not apply in Integrated managed pipeline mode.
Most likely causes:
system.web/identity@impersonate is set to true.
Things you can try:
If the application supports it, disable client impersonation.
If you are certain that it is OK to ignore this error, it can be disabled by setting system.webServer/validation@validateIntegratedModeConfiguration to false.
Move this application to an application pool using Classic .NET mode - for example, %SystemRoot%\system32\inetsrv\appcmd set app "Default Web Site/" /applicationPool:"Classic .NET AppPool"
(You can set "Classic .NET AppPool" to the name of another application pool running in Classic managed pipeline mode)

Only by changing one of the above (app pool to classic or system.webServer/validation@validateIntegratedModeConfiguration to false), have on the ScrapperTest.aspx page, Options, select “Use Credentials”, and have all setspn and delegations done), only then, the identity in the browser goes to ScrapperTest.aspx and then to WhoAmI.aspx (I can see the identity of the user of the browser in the “Page Content from response”).

If I Disable “ASP.NET Impersonation”, even selecting ScrapperTest.aspx, Options select “Use Credentials”, with the page WhoAmI.aspx, the “Page Content from response” will say that the user arriving to WhoAmI.aspx is the user of the Application Pool of the web app of ScrapperTest.aspx, and not the user of the Browser.

So, can you make it work without those changes, so with the default values?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant