In the .NET Framework version 2.0, the impersonated identity flows across asynchronous points within an application domain. In the .NET Framework version 2.0, you can enable or disable the flow of impersonation across asynchronous points by properly configuring the runtime element in the machine.config file or in the application configuration file. For ASP.NET, the impersonation flow can be configured in the aspnet.config file found in the <Windows Folder>\Microsoft.NET\Framework\vx.x.xxxx directory.
By default ASP.NET disables the impersonation flow in aspnet.config file by using the following configuration settings:
configuration>
<runtime>
<legacyImpersonationPolicy enabled="true"/>
<alwaysFlowImpersonationPolicy enabled="false"/>
</runtime>
</configuration>
In ASP.NET, if you want to allow the flow of impersonation instead, you must explicitly use the following configuration settings:
<configuration>
<runtime>
<legacyImpersonationPolicy enabled="false"/>
<alwaysFlowImpersonationPolicy enabled="true"/>
</runtime>
</configuration>
For more information, see <legacyImpersonationPolicy> Element and <alwaysFlowImpersonationPolicy> Element.