Hi Chrysanthi - lovely to hear from you.

First - full disclosure - I have never done this so I don't know.  Here is my guess. 

I think, as you suggested it is related to credentials.

I think you have four choices:

- ask the AD administrators to allow the 'Network Service' (on windows server 2003) account to update AD.

- configure your web application into a private application pool and set that pool to use an account that has update rights to AD

- use impersonation in your web site.  You need a tag like this in the web config...

 <identity impersonate="true" userName="trustedToUpdateAD" password="LongAndDifficultToGuess"/>

Yes - it does mean that the password is written in plain text in the web config file.

- if you are already using AD to determine who has access to the site then you could try

<identity impersonate="true" />

This means that the web server will use the credentials of the logged in user.  When you connect to AD, if that user is allowed to update it should work, else it should be denied.

You need to consider what security you need in your application.  I think I option 4 is probably the most secure of the three but relies on you using AD for authentication.

Do let us know how it works out for you.

Hi Chrysanthi,

The second solution is a Server2003+ only method. It is done in IIS Manager.  Create a new Application Pool, and inside that configure the identity as the account you will allow access to AD.

Still in IIS manager go to the configuration for your site and on the Home Directory tab configure your site to use the new Application Pool.

I know you don't like option 3 very much.  This article http://msdn.microsoft.com/en-us/library/xh507fc5(VS.71).aspx mentions that option 3 does create a authorisation token that can be delegated to another server.  It doesn't actually say that option 4 does not allow delegation, but neither does it say it does allow delegation.  My bet is it does not.  It does point out a way that the id/password can be held encrypted in the registry.  That might cover your security concerns.