Question

Is it possible to Impersonate a user when using Forms Authentication?

The thing is that I want an external login for users and an internal site that just uses integrated windows security and the users need to be impersonated.

I’ve looked around and found that John’s answer here is really good, but I don’t quite get how I can mix it up with my Forms authentication.

Suggestions?

---

Edit

I want to have an <asp:Login /> control and this control will authenticate against an Active Directory which has the same set of users as the Windows Machine that I want to use impersonation on.

My problem is that I don’t get how I can impersoante with the same username and pasword that is provided to the <asp:Login /> control.

Answer 1

In order for that solution to work, you’ll need access to the user’s id and password. I don’t believe that you can get this using the Login user control; you’ll need to create your own login form and handle the login actions yourself. Keep the user’s id and password, preferably in a secure string, in the session once you’ve authenticated and when you need to access the internal site on their behalf, use the Impersonator class from the referenced example to impersonate them using the credentials.

  using (var context = Impersonator.LogOn( username, password ))
  {
      try
      {
      ....
      }
      finally
      {
         context.Undo();
      }
  }