Question

I know this probably isn’t possible, but I would like to be able to get the Request user ID from within an ASP.NET web service method. So far, I’ve tried User.Identity.Name, Context.Request.LogonUserIdentity.Name, Request.ServerVariables["AUTH_USER"] and Request.ServerVariables["LOGON_USER"]. Am I tilting at windmills here, or is there something super simple that I’m missing?

Answer 1

Well, what do you mean by User ID?

If they’ve authenticated via Windows Authentication, User.Identity gives you the WindowsIdentity object that corresponds to that user.

If you want the User ID which corresponds to an authenticated user to “magically” show up in your pages, you can do that too! In your Global.asax, there is a function called Application_AuthenticateRequest which you implement to take whatever identity is passed to your application and turn it into a IPrincipal-based object which can be accessed from your pages.

So when you implement AuthenticateRequest(), you can take the HttpContext.Current.User.Identity.Name, and use that to look up your User ID from your database. From there, you construct your own IPrincipal-derived object and set the HttpContext.Currrent.User reference to that object you create. You can then cast “User” in your pages over to the object you create and read the User ID. We do this all the time. Here’s some sample code (which actually caches the Principal object so that you don’t have to go to the DB on every request):

protected void Application_AuthenticateRequest(object sender, EventArgs e) {
        try {
            IIdentity myIdentity = HttpContext.Current.User.Identity;
            MyPrincipal myPrincipal = (MyPrincipal)HttpContext.Current.Cache[myIdentity.Name];

            if (myPrincipal == null) {
                    myPrincipal = (MyPrincipal)GetPrincipalFromDatabase(HttpContext.Current.User.Identity);
                    HttpContext.Current.Cache.Insert(myIdentity.Name, myPrincipal, null, DateTime.Now.AddMinutes(1), TimeSpan.Zero);                
            }

            HttpContext.Current.User = myPrincipal;
        }
        catch (SecurityException) {
            HttpContext.Current.User = null;
        }
        catch (Exception ex) {
            Trace.WriteLine("Could not validate your user.");
        }
    }