Question

(This question is similar to Get UPN or email for logged in user in a .NET web application, but not quite.)

In a .NET (C#) web application using Windows authentication, I’d like to find the UPN of the signed-in user.

I know how to do this by querying Active Directory: take the ‘DOMAINNAME\userName’ from HttpContext.Current.User.Identity as WindowsIdentity; look up DOMAINNAME under the ldap://RootDSE and find its dnsRoot; query for (&(objectCategory=person)(objectClass=user)(sAMAccountName=...userName...)) under ldap://...dnsRoot...; get this entry’s userPrincipalName property. (More detail is in answer https://stackoverflow.com/a/513668/223837).

My question: Can the UPN be found without a call to Active Directory? Given Microsoft’s focus on using UPNs everywhere, isn’t the UPN already stored somewhere in the token which is created when the user authenticates to the web server?

(Supporting observation: If I run whoami /upn on Windows 7, then Wireshark does not show any Active Directory connections.)

(If it makes any difference: note that our web application does not use impersonation, i.e., our web app does not run under the user identity.)

Answer 1

Try System.DirectoryServices.AccountManagement.UserPrincipal.Current, which has the property UserPrincipalName. Of course, that would require the application to be running under Windows authentication.

Edit Meh, it looks like this API still performs a directory lookup.