If the credentials are not delegated, how can Excel Services make per-user permission checks on files?
Even if the Access Model is a trusted subsystem, Excel Services can still do per-user permissions checks on files stored in Office SharePoint Server 2007. Excel Services is part of Office SharePoint Server 2007, and so it is trusted to do per-user permission checks even when it cannot delegate an end user’s identity; however, it does not affect how Excel Services connects to external data. In these topologies, as described in the previous paragraph, Windows authentication–type connections do not work because the back-end application server cannot delegate the workbook viewer’s identity.
