What you are asking to do is "delegation". You want to automatically
delegate user credentials from the web client to the WebService to access
some other network resource on that user's behalf.

Ability to delegate depends on the authentication protocol. Integrated
Authentication does not support this. Kerberos supports it securely. Basic
authentication supports it insecurely. You cannot simply "pass on the
default credential from the client" unless you do it insecurely.

<identity impersonate="true" /> has nothing to do with delegation but is
required since otherwise, the Web Service will run as process identity which
obviously is not the remote authenticated identity.

So, really, IIS has little to do with this situation. Here is URL on how to
set it up to access a remote network UNC share, which is the exact same
problem as your Web Service and the solution/understanding are similar.
http://www.microsoft.com/technet/prodtechnol/windowsserver2003/technologies/webapp/iis/remstorg.mspx

--
//David
IIS
http://blogs.msdn.com/David.Wang
This posting is provided "AS IS" with no warranties, and confers no rights.
//
[quoted text, click to view]
Thanks. Does that mean we have to hardcode the password or display a
dialog to accept the credentials? Can we not pass on the default
credential from the client to the ASP.NET application and have ISS
impersonate the user and pass it on the web servive?
We tried to set <identity impersonate="true" /> in app's Web.config
file, but it did not work.

[quoted text, click to view]