Impersonate user in WCF from multiple callers

Question

I'm using WCF services ensuring that UserName/Password must be provided for each request. I need use same service from many clients, but I need impersonate the call to access the appropriate resources for each client. When I call the service directly from the client there is no problem, because I use for each client a pair UserName/Password defined in theirs web.config. The problem came when I need to call a second Web service from a call to the first-one using the same identity. This second Web service requires UserName/Password, but I only know who is the caller (UserName) but not the password.

How I can impersonate this second call without knowing the password for the corresponding username?

EDIT: The app (Web App and Services) is running in a shared hosting environment where I can't use Windows Authentication to configure Kerberos for Delegation. I have defined a UserNameValidator to process on each call the pair UserName/Password against a custom SQLServer database. Moreover, the intended customers of this app will use it from Internet, without requiring a windows account, that is because I need a more flexible, SQL-based, authentication schema.

Answer 1

You need to look at using Kerberos to handle the passing of authentication onwards to other services from your first WCF service.

Answer 2

Have you taken a look at the declarative security options? The linked article by Juval Lowy includes an internet application scenario as well.