Improving Web Application Security: Threats and - CGISecurity

356 Part III: Building Secure Web ApplicationsConfigure Client CredentialsTo successfully communicate with a remote component that is configured forWindows authentication, the client must configure the remoting proxy with thecredentials to use for authentication. Failure to do so results in an access denied error.You can configure the use of default credentials to use the client’s current thread orprocess token, or you can set explicit credentials.Using Default CredentialsTo use the client’s process token (or thread token if the client thread is currentlyimpersonating), set the useDefaultCredentials property of the client proxy to true.This results in the use of CredentialsCache.DefaultCredentials when the clientreceives an authentication challenge from the server. You can configure the proxyeither by using the configuration file or programmatically in code. To configure theproxy externally, use the following element in the client configuration file:To set default credentials programmatically, use the following code:IDictionary channelProperties;channelProperties = ChannelServices.GetChannelSinkProperties(proxy);channelProperties ["credentials"] = CredentialCache.DefaultCredentials;If you use default credentials in an ASP.NET client application that is configured forimpersonation, the thread level impersonation token is used. This requires Kerberosdelegation.Using Alternate CredentialsTo use a specific set of credentials for authentication when you call a remote object,disable the use of default credentials within the configuration file by using thefollowing setting.Note Programmatic settings always override the settings in the configuration file.