title: Windows Authentication Impersonation - Second request gets wrong user identity
body: <p>I have the following architecture:</p>
  
  <pre><code>Client1(Browser-App) -&gt; Server1 (WebAPI/IIS) -&gt; Server2 (WebAPI/IIS)
  </code></pre>
  
  <p>I am using ASP.NET for my server-side applications/apis and the user should be authenticated via "windows integrated authentication".</p>
  
  <p>As you can see there is a second hop from server1 to server2. NTML does not support the second hop if both WebAPIs are not on the same server.
  So I configured an AD domain to support "kerberos".</p>
  
  <p>It works now with the second hop.
  My test-WebAPIs output the identity of the user like this:</p>
  
  <pre><code>server1: test.domain/user1
  server2: test.domain/user1
  </code></pre>
  
  <p>But if I change the logged-in user on Client1 and execute the same request as "otherUser2", only the first hop gets the correct identity:</p>
  
  <pre><code>server1: test.domain/otherUser2
  server2: test.domain/user1
  </code></pre>
  
  <p>On the second hop the old user of the first request is displayed.
  I tested multiple scenarios: Same behaviour if the following requests come from another client with another windows user...</p>
  
  <p>It looks like the windows identity of the first request is cached on the server2... This is a big problem for me and I think this should not be possible... It's a big security hole if a request is executed in the wrong user context!</p>
  
  <p>Is this a known problem? Did I do something wrong?
  Is there a solution or a better configuration?</p>
  
  <p>On the first ASP.NET WebAPI I use impersonation like this:</p>
  
  <pre><code>WindowsIdentity identity = (WindowsIdentity)HttpContext.Current.User.Identity;
  
              using (var wic = identity.Impersonate())
              {
                  try
                  {
                      WebClient c = new WebClient
                      {
                          UseDefaultCredentials = true
                      };
  </code></pre>
  
  <ul>
  <li>I use the WebClient class of .NET.</li>
  <li>Both IIS server have "Windows Authentication" with "Negotiation" and "NTML" configured. </li>
  <li>Server1 is the DomainController, DNS and DHCP-Server (+IIS)</li>
  <li>Server2 is only a normal server with IIS installed.</li>
  <li>All computers are in the same domain.</li>
  </ul>
  
  <p>I cannot explain me this behavior... It makes no sense to me. Why should the first incoming request's identity should be cached on 'server2'?
  If I restart the IIS and re-execute the requests with another windows identity, this is the "first working request" and the others get his identity on 'server2'.</p>