ASP Migration COM+ and security

Typical ASP applications were built as a layer of simple ASP with some
COM+ components that did the heavy lifting.

Now, when you migrate your ASP application to ASP.NET and you also migrate your
COM+ components to .NET then you might encounter some issues with security.

One common issue is impersonation.

Sometimes the COM+ were created to use the current user account.

And there is a slight 
difference between ASP and ASP.NET:

“Impersonation is when ASP.NET executes code in the context of an authenticated and authorized client. By default, ASP.NET does not use impersonation and instead executes all code using the same user account as the ASP.NET process, which is typically the ASPNET account. This is contrary to the default behavior of ASP, which uses impersonation by default. In Internet Information Services (IIS) 6, the default identity is the NetworkService account.”

That will cause errors in your ASP.NET application like:

To solve this issue you must use ASP.NET Impersonation, and to enable impersonation go to the web.config file and add:

<identity impersonate=”true”/>

For more info on impersonation see: http://msdn.microsoft.com/en-us/library/aa292118(v=vs.71).aspx