WCF Net.TCP传输安全Windows凭据场景：访问数据库的用户是谁？

Nice question! Let’s break this down step by step so you get a clear picture of what’s happening here.

By default, the account running your WCF service (like Network Service, Local System, or a custom service account you’ve configured) is the one that will access the database—not the user running the client application.

The key here is how WCF handles impersonation:

• When using Net.TCP transport security with Windows client credentials, WCF does verify the client’s valid Windows identity (whether it’s a local or domain user). However, it does NOT automatically switch to the client’s identity to run subsequent operations by default.
• The service process runs entirely under its own account context. When it connects to the database using Integrated Security=True in the connection string, the database will authenticate the service’s account, not the client’s.

This changes only if you explicitly enable impersonation on the WCF service:

• You can turn on impersonation via configuration: add <serviceAuthorization impersonateCallerForAllOperations="true"/> inside your <serviceBehaviors> section.
• Or do it via code: use OperationContext.Current.ServiceSecurityContext.WindowsIdentity.Impersonate() to temporarily switch to the client’s identity for specific operations.
• Once impersonation is enabled, the service code runs under the client’s Windows identity—so when it connects to the database, it will use that client user’s credentials.

• If you’re in a domain environment, the client user needs direct permissions to the database (like a SQL Server login and associated database user roles) for impersonation to work.
• The service account itself also needs the right permissions to perform impersonation (for example, the "Allow Impersonate" permission in an Active Directory domain).

内容的提问来源于stack exchange，提问作者evilmandarine