title: How can I fix the Kerberos double-hop issue?
body: <p>I'm having some trouble calling a web service from within a web application and I was hoping someone here might be able to help. From what I can tell, this <em>seems</em> to have something to do with the Kerberos <a href="http://blogs.technet.com/b/askds/archive/2008/06/13/understanding-kerberos-double-hop.aspx" rel="noreferrer">double-hop issue</a>. However, if it is, I'm not sure what to do to actually fix the problem. To make things harder, I don't have the proper permissions to make changes to Active Directory accounts, so I need to know what to ask for when requesting changes. In my situation, I need to pass the credentials (Integrated Windows Authentication) from a web application onto a backend web service so that the web service runs under the proper user context. </p>
  
  <p>Here's my exact issue:</p>
  
  <p><strong>This works</strong></p>
  
  <p><img src="https://i.stack.imgur.com/4wTxI.png" alt="Working scenario"></p>
  
  <p><strong>This doesn't work</strong></p>
  
  <p><img src="https://i.stack.imgur.com/wvsyl.png" alt="Non-working scenario"></p>
  
  <p>The <em>only</em> difference between the working scenario and the non-working scenario is that the working scenario is running the application on localhost (whether a developer's PC or on the server in question) and the non-working example is running on another machine. The code between both scenarios is exactly the same.</p>
  
  <p><strong>What I've tried</strong></p>
  
  <ol>
  <li>Adding an SPN to the domain account that runs the app pool for each server <code>setspn -a http/server1 DOMAIN\account</code></li>
  <li>Different methods of impersonation</li>
  <li>Removing the impersonation code <code>using(...)</code> and executing the web service call as the app pool account. This works as expected.</li>
  </ol>
  
  <p>Does anyone have any idea on what I might be able to do in order to fix this problem?</p>