"The RPC Server is unavailable" error requesting a certificate with impersonation in ASP.NET.

i creating web service allows users request certificate.

the web service can accessed windows authentication.

i impersonate authenticated user submit certificate request, code snippet illustrates:

var identity = (windowsidentity)httpcontext.current.user.identity;  var certrequest = new ccertrequestclass();  using (var context = identity.impersonate()) {      var disposition = certrequest.submit(          cr_in_base64header | cr_in_formatany,          base64certificaterequest,          "certificatetemplate:mytemplatename",          @"testca.test.com\test ca");  }

the above code fails error message "the rpc server unavailable. (exception hresult: 0x800706ba)"

instead, code works if don't impersonate current user, request submitted credentials of application pool (a domain account created).

the code works if impersonate user logonuser api.

checking network trace wireshark, see @ point there dcerpc ntlm authentication call null user:

131 7.948461000 2002:808e:8830::808e:8830 2002:bcb8:15e3::bcb8:15e3 dcerpc 239 auth3: call_id: 3, fragment: single, ntlmssp_auth, user: \

that call followed remotecreateinstance request, fails nca_s_fault_access_denied.

is possible submit certificate request impersonating current user? should configure special permission application pool account, or on certification authority?

thanks,
paolo

---

paolo tedesco - http://cern.ch/idm

could double-hop issue [0].  setup service use kerberos auth (register necessary spns, etc) , configure points to use kerberos well.  rule out double-hop issue , make service more secure.  here's link things kerberos [1].  this article [2] may too. 

if you're unable find solution in forum, try posting msdn.

[0] double-hop authentication: why ntlm fails , kerberos works

[1] kerberos survival guide

[2] how to: use impersonation , delegation in asp.net 2.0

Windows Server  >  Security