Special Edition Using® Microsoft® ASP.NET

ASP.NET Impersonation

Impersonation gives ASP.NET applications the capability to optionally execute with the identity of the client, on whose behalf they are operating. It avoids dealing with authentication and authorization issues in the ASP.NET application code, which adds administrative overhead in administering additional user names and passwords. You can rely on IIS, instead, to pass an authenticated token to the ASP.NET application and authenticate the user. If it cannot authenticate the user, it can pass an unauthenticated token. The ASP.NET application can impersonate whichever type of token is received if Impersonation is enabled. Because the ASP.NET application is now impersonating the client, it can rely on the settings in the NTFS ...