c# - Verify that the currently authenticated windows user has delegation rights -

given have wcf service using windows authentication, , want impersonate them , call wcf service, so:

using (servicesecuritycontext.current.windowsidentity.impersonate()) {     // call wcf service } 

i've set config settings , works fine, long on client side,they include following line:

client.clientcredentials.windows.allowedimpersonationlevel = tokenimpersonationlevel.delegation; 

but, how verify before trying make call user token has delegation rights? i.e. client, don't control, has set allowedpersonationlevel?

if haven't set it, sorts of weird exceptions thrown (like cannot load assembly x etc).

ideally, i'd able following:

using (servicesecuritycontext.current.windowsidentity.impersonate()) {     if (userdoesnthavedelegationrights())         throw new securityexception("no delegation rights");      // call wcf service } 

note windowsidentity.getcurrent().impersonationlevel equal tokenimpersonationlevel.impersonation, unfortunately not option.

there might confusion here in definitions. in terms of impersonation levels windows identity can be:

• impersonated - service can impersonate user locally
• delegated - service can impersonate user remotely

the ability delegate powerful highly restricted in active directory:

1. the client has allow delegation
2. the service account doing delegation must marked "trusted delegation" in active directory.

here's how enable account delegation. requires active directory domain admin make change. every corporate environment i've ever worked in has policy not allow delegation.

back question:

so while tokenimpersonationlevel.delegation exists, considered security risk , (if ever) used. tokenimpersonationlevel.impersonation highest level ever get.

tokenimpersonationlevel.impersonation useful. can still connect database or make remote service call impersonated user. remote service (not on same box) can't impersonate user second time. basic rule of thumb "impersonation enables 2 machines hops". if user's credentials have "hop" farther, fail.

if need pass user's credentials between many servers best choice federated security model such windows identity foundation (wif). see identity management in active directory.