I'm setting up an intranet web server that will handle requests coming from multiple different types of employees.
One of the requests that my server will need to handle is to query data from a second server. The second server is managed by a different team and has restrictions as to who can access their server (using windows authentications - usedefaultcredentials). My server does have access to query the second web server.
For the requests that require my server to do the querying I would like a method to emulate the validation criteria set by this second server.
Is there a way to:
Forward the received request (or part of) to the second server to see if they validate the user
- Send a new request to the second server to ask if this user is validated
- Create a connection between the servers that will maintain the set of authorized users so that my server can validate the request. This would need to be done via automation for there is no chance that I can add a recurring task to other teams workload (Manually informing us of which user is now listed or unlisted is not a feasible solution).
- Using "How to configure an ASP.NET application for a delegation scenario" I delegate all users that are allowed to access my server (using NTLM - usedefaultcredentials). Using the fact that I'm impersonating the user I could in theory send a request to the second server to see if this specific user has access.
I can request the other team to do small changes but there can't be any big overhaul. Also it can only be one way (my server can't have any way to manage/change permissions on the second server).
Edit: After testing I believe Option 1 is not possible due to
'X-Xss-Protection': '1; mode=block'. I did stumble upon Impersonate a client after authentication and I'll try to see if its a potential solution. Note: The more I dig the more I feel like a solution from my end would be a vulnerability and option 3 would be the only 'correct' method. Could someone confirm this for me?
Edit 2: Added option 4