Improving Web Application Security: Threats and - CGISecurity

Chapter 17: Securing Your Application Server 497ImpersonationDCOM clients set the impersonation level to determine the impersonationcapabilities of the server with which they are communicating. When an EnterpriseServices application on a middle-tier application server is configured, the configuredimpersonation level affects any remote calls made to downstream components,including the database server. The impersonation level is set on the Security page ofthe Properties dialog box of the application in Component Services, as Figure 17.9shows.Figure 17.9DCOM impersonation levelsThe appropriate level depends on the desired application-level functionality,although you should use the following guidelines to determine an appropriate level:●●●●Avoid Anonymous impersonation. The downstream component will not be ableto identify your application for authentication or authorization purposes.Use Identify to allow the downstream component to authenticate and authorizeyour application. It will not, however, be able to access local or remote resourcesusing the impersonated security context of your application.Use Impersonate if you want to allow the downstream component to impersonatethe identity of your application so that it can access local resources on thedownstream server.Use Delegate if you want to allow the downstream component to impersonate theidentity of your application so that it can access local or remote resources. Thisrequires accounts configured for delegation in Active DirectoryAll downstream resource access that is performed by serviced components on yourmiddle-tier application server normally uses the server application’s identity. If,however, the serviced components perform programmatic impersonation, and theclient application (usually an ASP.NET Web application or Web service on the Webserver) has been configured to support Kerberos delegation, then the client’s identityis used.For more information, see “How To: Enable Kerberos Delegation in Windows 2000”in the “How To” section of “Microsoft patterns & practices Volume I, BuildingSecure ASP.NET Applications: Authentication, Authorization, and Secure Communication”at http://msdn.microsoft.com/library/default.asp?url=/library/en-us/dnnetsec/html/secnetlpMSDN.asp.