CODEWITHSUNDEEP
c#asp.netwebclientdotnet-httpclient
Rugdr
Rugdr

Reputation: 199

Asp.net Web api2 impersonate on webClient call

we have a web api what has is how user account let's say ApplicationPoolUser that used have access to the databases used by the api, etc which work fine.

but i'm trying to send a http get method on files on a remote server(sharepoint 2007) using webClient

here's what im using :

            WindowsImpersonationContext impersonationContext = null;
            Uri uri = new Uri(Path.Combine(this.Document.path , Document.fileNameOriginal));
            Stream stream = null;

// WindowsIdentity.GetCurrent().Name return 'ApplicationPoolUser'
                try
                {
                    WindowsIdentity wi = System.Web.HttpContext.Current.Request.LogonUserIdentity;
                    impersonationContext = WindowsIdentity.Impersonate(wi.Token); 
// WindowsIdentity.GetCurrent().Name return 'CurrentRequestingUser'

                WebClient client = new WebClient() { 
                    UseDefaultCredentials = true,
                    CachePolicy = new System.Net.Cache.RequestCachePolicy(RequestCacheLevel.BypassCache)
                };

                stream = client.OpenRead(uri);
 // OpenRead Authentified on sharepoint server has ApplicationPoolUser
            }
            catch(WebException ex)
            {
                HttpWebResponse webResp = (HttpWebResponse)ex.Response;
                if(webResp.StatusCode == HttpStatusCode.NotFound)
                throw new GeneralException(Common.Enums.ExceptionMessage.NotFound, webResp.StatusDescription);
                else
                {
                    throw ex;
                }
            }

is there a way to force the authentification on behalf of the user without turning asp.net Identity ON ? in the web.config / IIS site.

I dont want the whole code to execute has the impersonated user request just this small part ...

I did try to use httpClient instead by i've found that since httpclient start in a new thread, it will always use the application pool identity.

can i create the Negotiate Call myself and add it to the request ?

thank you.

EDIT : i have tried Removing all AuthenticationManager except Kerberos, and the request still use NTLM for authentication, what am i doing wrong ?

Upvotes: 3

Views: 2768

Answers (1)

TGlatzer
TGlatzer

Reputation: 6248

There are multiple factors, which can make an impersonation or to be precise a delegation of the user credentials impossible.

1) if you are using asynchronous methods (directly or not) you might experience a problem with flowing the identity. You can check, if that might be an problem with the following call:

 System.Security.SecurityContext.IsWindowsIdentityFlowSuppressed();

This should return false - if not you can use this as a reference: Calling an async WCF Service while being impersonated

2) You have to enable constrained delegation for the executing account. You have a so called Kerberos double hop scenario. You have to allow the Sharepoint user to act as another user or else impersonate() will not succeed as expected.

Upvotes: 2

Related Questions