Question re impersonation/security
 

Hi,

I have a slight problem with security. I am calling a webservice using
impersonation on a remote Windows 2003 Server. The call is made using
impersonation using a special user id created for the web service application
concerned. Stepping into the webservice using the remote debugger, and
looking at the My.Request.LoginUserIdentity shows that the web service is
indeed running under the correct, impersonated, user identity. So far so good.

However, the web service is a thin one which calls a much more substantial
..NET dll assembly. This DLL also needs to run in under the same user ID
(impersonated), and have the security permissions of that user ID. But it
doesnt seem to do so.

When you step into the assembly, you cannot see the My.Request object and
therefore cannot see the LoginUserIdentity. But you can see the My.User
object, which I might expect to show the same identity. But in fact is
appears to be a blank username.

Does this mean my assembly, called from the webservice, is not running under
the user Id I hoped it would and therefore does not have the impersonated
User's permissions? If so, how can I correct this?

Thanks

Ian