I am using IIS 7.5 and I want to impersonate users for my different applications in an intranet environnement. To do so, I am considering using the asp.net mechanism with the user/password in the web.config (encrypted), but I'm unsure about some possible threats. I'll explain it with a concept (I know my example is useless but it represents my situation so please bear with me)
Let's say that I have 2 directories:
One empty directory (DirectoryA) that permits access to all users (ntfs permissions) and that contains a web.config that impersonates UserA
One directory (DirectoryB) containing a web site that I want to restrict access to, which also contains a web.config that impersonates UserA (same user as DirectoryA, not a typo)
To have the impersonation going on DirectoryB, I need to give ntfs permission allowing UserA in DirectoryB.
My question is: is it possible for someone to access DirectoryA (which will impersonate him as UserA) and then somehow access the site on DirectoryB using the impersonated UserA? If it is, how?
Thanks for any insight