Interview Questions on ASP.NET Impersonation

Interview Questions on ASP.NET Impersonation

Impersonation
1. What is impersonation?
By default, all ASP.NET code is executed using a fixed machine-specific account. To execute code using a specific identity we can use the built-in impersonation capabilities of ASP.NET. If you enable impersonation, Asp.Net application runs in the context of the identity whose access token IIS passes to ASP.NET. That token can be either an authenticated user token, such as token for a logged-in windows user, or token that IIS provides for anonymous users (IUSER_MACHINENAME identity).
2. What scenarios we can use impersonation??
If you want to give each web application different permissions. If you want to use existing windows user permissions.
3. When anonymous access is enabled in IIS, which identity is used to make a request?
IUSER_MACHINENAME
4. If anonymous access is disabled in IIS, which identity is used to make a request?
If anonymous access is disabled in IIS, the request is made using the account of the authenticated user.
5. How can you implement the impersonation in Asp.Net?
We can impersonate a user on a thread in ASP.NET, you can use the following methods. Impersonate the IIS Authenticated Account or User Include an <identity> tag in the Web.config file of this application and set the impersonate attribute to true. For example: <identity impersonate="true" /> Impersonate a Specific User for All the Requests of an ASP.NET Application. Specify the userName and password attributes in the <identity> tag of the Web.config file for that application. For example: <identity impersonate="true" userName="accountname" password="password" /> Impersonate the Authenticating User in Code To impersonate the authenticating user (User.Identity) only when you run a particular section of code, you can use the code to follow. This method requires that the authenticating user identity is of type WindowsIdentity System.Security.Principal.WindowsImpersonationContext impersonationContext; impersonationContext = ((System.Security.Principal.WindowsIdentity)User.Identity).Impersonate(); //Insert your code that runs under the security context of the authenticating user here. impersonationContext.Undo();
Impersonation