Hi!
In our web application we provide a way for users to switch which account/credentials (Windows identity) that should be used when making requests to external services.
This "Switch user" service works like this:
The user provides the new credentials that should be used.
The application performs a "login", fetch the toke and creates a new WindowsIdentity based on the token.
The created identity is placed in the session.
When a page is requested and an Identity is available in session, the HttpContext.Current.User is replaced with this one.
Everything works as excepted when the application is hosted in IIS6. We have verified that all request to external services is made using the new identity.
When we host the application in IIS7 we run into problems however. Everything works fine until we tries to access the new identity (for example by fetching the name) and we get the followin ...
Go to the complete details ...