Impersonate tag in Web.Config in ASP.NET

MS 官方寫法：

https://support.microsoft.com/en-us/help/306158/how-to-implement-impersonation-in-an-asp-net-application

MS 寫的不太貼心：

Impersonate the IIS Authenticated Account or User

To impersonate the Microsoft Internet Information Services (IIS) authenticating user on every request for every page in an ASP.NET application, you must include an <identity> tag in the Web.config file of this application and set the impersonate attribute to true. For example:

<identity impersonate="true" />

back to the top

Impersonate a Specific User for All the Requests of an ASP.NET Application

To impersonate a specific user for all the requests on all pages of an ASP.NET application, you can specify the userName and password attributes in the <identity> tag of the Web.config file for that application. For example:

<identity impersonate="true" userName="accountname" password="password" />

Note The identity of the process that impersonates a specific user on a thread must have the “Act as part of the operating system” privilege. By default, the Aspnet_wp.exe process runs under a computer account named ASPNET. However, this account does not have the required privileges to impersonate a specific user. You receive an error message if you try to impersonate a specific user. This information applies only to the .NET Framework 1.0. This privilege is not required for the .NET Framework 1.1.

To work around this problem, use one of the following methods:

• Grant the “Act as part of the operating system” privilege to the ASPNET account (the least privileged account).Note Although you can use this method to work around the problem, Microsoft does not recommend this method.
• Change the account that the Aspnet_wp.exe process runs under to the System account in the <processModel> configuration section of the Machine.config file.

正確用法：

The identity section goes under the system.web section:

<system.web>
  <authentication mode="Windows"/>
  <identity impersonate="true" userName="foo" password="bar"/>
</system.web>

相關文章：

Enable Run As User to Act as the Operating System
http://stackoverflow.max-everyday.com/2018/02/enable-run-as-user-to-act-as-the-operating-system/

附註：在impersonate為其他帳號時，需要開啟 asp.net 的 temp folder 的寫入權限給該 user account, 不然會產生錯誤訊息。

附註： 如果遇到這一個 Exception 在 copy file 時：

System.IO.IOException: The user name or password is incorrect.

at System.IO.__Error.WinIOError(Int32 errorCode, String maybeFullPath)
at System.IO.File.InternalCopy(String sourceFileName, String destFileName, Boolean overwrite, Boolean checkHost)

請檢查 impersonate 相關的帳號/密碼設定，或寫法是否正確。