I am developing an API using C# ASP.Net Core runtime and I'm planning to host this in IIS.

One of the requirement is to get information from another RESTful API server which currently has windows authentication (LDAP authentication).

I already have a solution by using a service account which is hardcoding the service account name and password in appsettings.json.

The code is as follows

var serviceApi = _config["Api:ServiceApi"].ToString(); // this is the URL of other RESTful API from appsettings.json
var serviceAccount = _config["ServiceAccount:UserName"].ToString(); // service account username from appsettings.json
var serviceAccountPwd = _config["ServiceAccount:Password"].ToString(); // service account password which is currently shown as clear text in appsettings.json
var serviceAccountDomain = _config["ServiceAccount:Domain"].ToString(); // service account domain name from appsettings.json
var client = new WebClient();
CredentialCache cc = new CredentialCache();
cc.Add(
    new Uri(serviceApi),
    "NTLM",
    new NetworkCredential(serviceAccount, serviceAccountPwd, serviceAccountDomain));
client.Credentials = cc;
client.Headers["Content-Type"] = "application/json";
string response = client.DownloadString($"{serviceApi}/User");

The downside of this solution is, the password of service account is visible in appsettings.json. I need other solution which will not expose the password in clear text.

One of the solution that I can think of is to store service account information in IIS application pool identity. However, I still cannot make WebClient to use IIS app pool identity. What I can do so far to make WebClient to use the NTLM credential of my own from windows.

Here's the code

var serviceApi = _config["Api:ServiceApi"].ToString();
var client = new WebClient();
client.UseDefaultCredentials = true; // this is not getting credential from IIS app pool identity but rather from logged in account in windows operating system
client.Headers["Content-Type"] = "application/json";
string response = client.DownloadString($"{serviceApi}/User");

Could please help me with how to use IIS app pool identity as credential for other RESTful API application?