active directory - Can I impersonate a client authenticated with forms auth and establish a trusted connection to SQL Server? -

here i've been trying do

build asp.net mvc 3 application forms authentication , active directory membership. web server , database different physical servers hence double hop.

i thought answer older article on constrained delegation , protocol transition? far, have not been able technique work.

i'm testing dev machine (windows 7, iis7) web server before deploying windows 2008 (iis7) in production setup. windows 2008 make difference?

what works , fails

i'm able login forms auth , ad membership. seem working fine. when try make database call using code:

public void asuser(action action)     {         using (var id = new windowsidentity(user.identity.name + @"@example.com"))         {             windowsimpersonationcontext context = null;             try             {                 context = id.impersonate();                 action.invoke();             }             catch (exception ex)             {                 // ex.message type initializer system.data.sqlclient.sqlconnection threw exception                 // buried inner exeption requested registry access not allowed             }                         {                 if (context != null)                 {                     context.undo();                 }             }         }     } 

it fails exception leading me believe have setup issues on local dev server. inner exception requested registry access not allowed.

if set breakpoint , inspect windowsidentity after impersonate() call see impersonationlevel set identification. seems clue not setup correctly. can confirm?

am on right track , possible setup? pointers appreciated.

i think on right track. need more troubleshooting work on protocol transition setup.

i assume configured active directory membership provider correctly can logon web page using active directory user name , password. if that's not case, please ignore rest of answer :)

from saw in question, got user's token using s4uself windowsidentity. then, using s4uproxy pass impersonated token sql server. since said got impersonationlevel.identification only, means failed protocol transition.

you need understand allowing 1 machine protocol transition in domain high privilege. granting server protocol transition means trust server domain controller. need consciously make decision in ad turn server have ability , have domian administrator make change. if haven't done this, didn't setup thing properly.

there couple things check.

first, make sure selected "trust computer delegation specified services only" , picked "select use authentication protocol" on service account. may create domain account. here link on how create service account asp.net. remember, need domain account. after created domain service account, make sure go delegation tab on account , selected correct options.

second, need make sure spns set properly. realize link posted mention spn of asp.net service account. actually, need make sure service account on sql server set properly. otheriwse, windows won't use kerberos authentication @ all. fall use ntlm. there lot of details setup spn correctly on sql server. can check here first , see if have luck. experience, of dba don't know how set them properly. don't aware of because applications work fine ntlm. need pay attention sql server service account , port number it's using.

third, need make sure there nothing disabling kerberos delegation. sensitive ad accounts default not allowed delegated. example, built-in administrator account. so, better use other normal user accounts testing purpose.

update

i found another article teaching how setup protocol transition asp.net. mentioned need grant tcb right iis service account in order make sure can create impersonation type windowsidentity. can give shot.