Improving Web Application Security: Threats and - CGISecurity

286 Part III: Building Secure Web ApplicationsYou may also have a method that allows callers from several different roles.However, you might want to subsequently call a different method, which is notpossible with declarative security.ImpersonationBy default, ASP.NET applications usually do not impersonate the original caller fordesign, implementation, and scalability reasons. For example, impersonatingprevents effective middle-tier connection pooling, which can have a severe impact onapplication scalability.In certain scenarios, you might require impersonation (for example, if you require analternate identity (non-process identity) for resource access). In hostingenvironments, multiple anonymous identities are often used as a form of applicationisolation. For example, if your application uses Forms or Passport authentication, youcan impersonate the anonymous Internet user account associated by IIS with yourapplication’s virtual directory.You can impersonate the original caller, which might be the anonymous Internet useraccount or a fixed identity. To impersonate the original caller (the IIS authenticatedidentity), use the following configuration:To impersonate a fixed identity, use additional userName and password attributes onthe element, but make sure you use Aspnet_setreg.exe to store encryptedcredentials in the registry. For more information about encrypting credentials inconfiguration files and about Aspnet_setreg.exe, see Chapter 19, “Securing YourASP.NET Application and Web Services.”Using Programmatic ImpersonationIf you do not want to impersonate an account for the entire request, you can useprogrammatic impersonation to impersonate for a portion of the request. Forexample, you want to use the ASP.NET process account to access you application’sprimary resources and downstream database, but you need to access an alternateresource, such as another remote database or a remote file share, using an alternateidentity.To do this, use IIS to configure the anonymous user account as the trusted alternateidentity. Then use the following code to create an impersonation token using theanonymous account only while you execute your remote resource access code: